The runtime-based vulnerability prioritization has been the biggest improvement for us.

Instead of a flat CVE list per image, ARMO shows which vulnerable packages are actually

loaded and in use at runtime, which cut the list we have to act on down to something a

small team can realistically handle. The eBPF sensor gives that visibility without us

having to change our deployments or add sidecars.

We also get a lot of value out of the generated network policies and the way ARMO builds

them from observed traffic rather than asking us to write them from scratch — it turns

network segmentation from a project into a review step. Compliance reporting against

frameworks like NSA-CISA and CIS has been useful for demonstrating posture to customers

without maintaining our own spreadsheets.

Onboarding remains genuinely fast: a single Helm install per cluster, and the Slack

integration keeps new findings visible in the channels the team already works in. The

combination of posture, vulnerability and runtime data in one platform means we're not

stitching together three tools to answer one question. Review collected by and hosted on G2.com.

Multi-cluster reporting. Once you're running more than a handful of clusters, the

per-cluster views are strong but the roll-up across all of them is thinner. A single

trend view — "is our overall exposure going up or down this quarter" — would help a lot

when reporting to management.

Documentation for the less common paths. The happy-path setup is well documented; the

edges — custom control tuning, exceptions at scale, CI integration in less common

pipelines — take more trial and error than they should. Review collected by and hosted on G2.com.