Runtime detection is the monitoring of active workloads for suspicious behavior after they start running. In cloud and container environments, it watches live processes, system calls, file access, network connections, and privilege changes to spot actions that look like exploitation, malware, or policy abuse.
This matters because many threats are invisible at build time. A clean image can still be used in a hostile way once deployed, especially if an attacker gains code execution, abuses a vulnerable service, or tries to move laterally inside a cluster. Runtime sensors help defenders detect shell spawning, unexpected crypto-mining, credential theft, and unusual outbound traffic, then trigger alerts or automated containment. Tools such as kernel- or eBPF-based monitors are often used for this layer because they can observe behavior with low overhead. Runtime detection complements scanning and posture checks by covering what only happens after the workload is live.