A BPF map is a kernel data structure used by eBPF programs to store and exchange state. Think of it as a shared key-value store that can be read or updated from kernel space and, in many cases, from user space. Maps let eBPF code remember counters, flags, process IDs, trust lists, or event history without hard-coding that data into the program itself.
BPF maps matter in security because they sit inside the trust model of telemetry and enforcement. Defenders use them to coordinate filters, suppress duplicate events, or keep allowlists for approved processes. Attackers may try to tamper with that state if they gain sufficient privilege, because changing a map can alter what the eBPF program sees or reports. In practice, that can mean hiding activity, weakening detection, or bypassing alert logic. For that reason, security teams treat BPF maps as sensitive kernel state and monitor unexpected eBPF activity, map updates, and any sign that telemetry is being filtered at the source.