PALM SEC
Services

Security observability

Security data

Detection engineering

Runtime and cluster security

Kubernetes platform

Pentesting and AppSec

AI security

All services →
AboutContact

Skip the next security product. Onboard engineers who understand the problem.

Palm Sec is a team of security and platform engineers. We build security observability and detection, secure AI systems, and test applications and cloud environments, using open-source tools like Tetragon, Cilium and Falco wherever they fit. It plugs into the systems you already run, and your team ends up owning it.

Talk to an engineerBrowse services

Security observability

  • Which process opened that connection?
  • Which pods are talking to the internet?
  • Who assumed that role, and from where?
  • What changed on the node before the alert?
  • How do we collect events from 10K+ nodes?
See how we build it →

AI security

  • Which sandboxes actually hold up for agent-run code?
  • Which emerging isolation technologies are worth adopting?
  • How do we give developers MCP servers without handing over the keys?
  • What does agent observability look like at scale?
See how we secure it →

What we work on

Security observability

Pipelines that carry security telemetry from every cluster and account to the places you investigate from.

Runtime event pipelines · Network flow pipelines · Cloud audit pipelines · Vector and Fluent Bit · OpenTelemetry · Prometheus and Grafana

Security data

Where security telemetry lives, how it is shaped, and how cheaply you can keep it.

ClickHouse · Elasticsearch · OpenSearch · OCSF · Kafka and MSK

Detection engineering

Detections written, tested and versioned like code, for the tools you already run.

Tetragon TracingPolicies · Falco rules · KubeArmor policies · Cilium network policy · WAF rules

Runtime and cluster security

The runtime sensors and cluster policy that keep workloads in the state you intended.

Tetragon · Falco · KubeArmor · Cilium and Hubble · Custom eBPF · Kyverno · Trivy · Kubescape

Kubernetes platform

The clusters and delivery machinery the security tooling runs on.

Amazon EKS · Karpenter · Argo CD and GitOps · Terraform

Pentesting and AppSec

Testing of applications, pipelines and identity, ending in findings your engineers can reproduce and fix.

Penetration testing · AI red teaming · SAST and DAST · StackHawk · StackRox · Snyk · Cloudflare WAF · AWS WAF · ModSecurity · Entra ID auditing

AI security

Securing the applications, agents and tool integrations built on language models.

LangChain · Firecracker · Kata Containers · WASM sandboxes · MCP security

Where teams usually start

See what is happening across your clusters

Process, network and cloud-account telemetry from Tetragon, Cilium and CloudTrail, collected and enriched in one pipeline.

Learn more →

Keep security logs somewhere you control

ClickHouse, Elasticsearch or OpenSearch with schemas, retention and ingestion designed around how you investigate.

Learn more →

Make detections reliable

TracingPolicies, Falco rules, KubeArmor, Cilium policy and WAF rules written as code, tested against real events and tuned to cut noise.

Learn more →

Everything we work on

There are many options. We help choose technologies that will last and are relevant.

Runtime eventpipelinesNetwork flowpipelinesCloud auditpipelinesVector andFluent BitOpenTelemetryPrometheusand GrafanaClickHouseElasticsearchOpenSearchOCSFKafka and MSKTetragonTracingPoliciesFalco rulesKubeArmorpoliciesCiliumnetworkpolicyWAF rulesTetragonFalcoKubeArmorCilium andHubbleCustom eBPFKyvernoTrivyKubescapeAmazon EKSKarpenterArgo CD andGitOpsTerraformPenetrationtestingAI redteamingSAST and DASTStackHawkStackRoxSnykCloudflareWAFAWS WAFModSecurityEntra IDauditingLangChainFirecrackerKataContainersWASMsandboxesMCP security

Security observability

Runtime event pipelinesNetwork flow pipelinesCloud audit pipelinesVector and Fluent BitOpenTelemetryPrometheus and Grafana

Security data

ClickHouseElasticsearchOpenSearchOCSFKafka and MSK

Detection engineering

Tetragon TracingPoliciesFalco rulesKubeArmor policiesCilium network policyWAF rules

Runtime and cluster security

TetragonFalcoKubeArmorCilium and HubbleCustom eBPFKyvernoTrivyKubescape

Kubernetes platform

Amazon EKSKarpenterArgo CD and GitOpsTerraform

Pentesting and AppSec

Penetration testingAI red teamingSAST and DASTStackHawkStackRoxSnykCloudflare WAFAWS WAFModSecurityEntra ID auditing

AI security

LangChainFirecrackerKata ContainersWASM sandboxesMCP security

How we work with your teams

We partner with enterprise, product, specialty, platform, developer and DevOps teams, and each step of an engagement is built with the people who will own the result.

  1. 1

    Assess

    We review your clusters, accounts and existing tooling with the people who run them, and agree a target design.

    WithEnterprise securityPlatform

  2. 2

    Pilot

    One non-production environment, working end to end, built alongside the engineers who will maintain it.

    WithDevOpsDevelopers

  3. 3

    Roll out

    Staged deployment through your own pipelines and change process, with results measured at each stage.

    WithPlatformProduct

  4. 4

    Hand off

    Documentation, runbooks and a walkthrough, so the teams who own it can run it without us.

    WithSpecialtyDevOps