Evaluate Tetragon as a NeuVector replacement

[mjnagel]

https://tetragon.io/

Evaluate:

• Community adoption
• Chainguard/Ironbank support
• Feature parity with NeuVector
• Out of the box experience and alignment with deployment methodology (helm, config as code)

Definition of done: A scorecard evaluating the above criteria.

[rjferguson21]

Criteria	Tetragon	NeuVector
Pros	- Minimalistic	- Full end-to-end security, including runtime, network, and vulnerability protection
	- Supported by Cisco/Isovalent	- Network segmentation with zero-trust enforcement
	- Performance	- Enterprise-ready with compliance, vulnerability scanning, and firewall features
	- Kubernetes Native	- Integrated enforcement, blocking malicious behavior in real-time
Cons	- No visual UI	- Heavier resource consumption due to the extensive feature set
	- Would require education on crafting policies	- Complexity may overwhelm smaller deployments
	- Missing L7 network security	- Full enterprise features require a commercial version
Community Adoption	Popular on GitHub with 3600 stars but unclear about enterprise adoption	Enterprise focus, strong post-acquisition support by SUSE; less adoption in the general open-source community
Chainguard / IronBank Support	IronBank images exist, Chainguard images not published	NeuVector is supported in IronBank (DoD-approved hardened container registry), suitable for government use
Runtime Detection	Provides runtime detection via eBPF	Behavioral learning with runtime detection for container processes, files, and network traffic
Network Security	Provides network security via eBPF, significantly lower level than Neuvector (using kprobes / tracepoints)	Provides network-layer security, including segmentation, DPI (Deep Packet Inspection), and zero-trust policies
Compliance & Vulnerability Scanning	N/A	Built-in vulnerability scanning, compliance checks for PCI-DSS, GDPR, NIST, HIPAA
Enforcement	Tetragon allows enforcing events in the kernel inline, either via SIGKILL or overriding return value of function	Native enforcement engine to block network, process, and container-level threats in real-time
Out-of-the-Box Experience	Much more primitive tool compared to Neuvector, easy to setup. Not a lot of policy examples.	Comprehensive out-of-the-box security, with network policies, vulnerability scans, and compliance reports pre-configured
Helm / Config as Code Alignment	Official Helm chart available, supports configuration via Kubernetes CRDs	Helm chart available, configuration-as-code support with advanced controls; more complex due to the breadth of features
Ease of Use / Learning Curve	Very steep learning curve, no UI	Steeper learning curve due to the full feature set (network, compliance, runtime) but offers behavioral learning to automate setup
Resource Consumption	Seems very performant and resource conscious	Resource-intensive, especially with network security, DPI, and multi-layer enforcement
Integration with CI/CD	N/A	Integrates well with CI/CD tools, can block non-compliant containers at runtime and during image scans
Policy Management	Requires authoring custom policies using Tetragon CRDs	Automated policy learning with ability to create manual policies, suitable for both network and runtime security
Enterprise Support / Features	No specific enterprise version for Tetragon, might have enhanced functionality with Cillium	Full enterprise support, including multi-cloud deployments, built-in compliance management, and security dashboards
Service Mesh Compatibility	Service Mesh compatible but no direct integration	Provides strong integration with service meshes, enforcing network security and segmentation policies within service mesh traffic
Logging and Reporting	Supports prometheus metrics and logging of Tetragon events.	Built-in real-time dashboards for network and runtime events; advanced reporting for compliance and threat detection
Cloud Provider Compatibility	Works across all major cloud providers (AWS, GCP, Azure) in any Kubernetes environment (self-managed or managed)	Optimized for multi-cloud (AWS, GCP, Azure) and hybrid environments; certified for key public cloud providers and supports multi-cluster setups