Respond to Zero-Day Vulnerabilities with Aqua (2026)

Aqua Security’s platform allows you to respond to zero-day vulnerabilities by detecting and mitigating them early in the software development lifecycle (SDLC) and in runtime environments.

Let’s see Aqua in action. Imagine a new, unpatched vulnerability (a zero-day) is discovered in a popular open-source library, libxml2, used in your containerized applications.

# Example Dockerfile
FROM ubuntu:latest
RUN apt-get update && apt-get install -y libxml2
COPY my-app /app
CMD ["/app/my-app"]

Without Aqua, this vulnerability might go unnoticed until it’s exploited in production. With Aqua, the process looks different.

First, Aqua integrates into your CI/CD pipeline. As soon as you build this image, Aqua’s vulnerability scanner kicks in. It’s not just looking for known CVEs; Aqua also employs behavioral analysis and drift detection.

# Aqua CLI scan command during CI/CD
aqua scan image my-app:latest --output-format json > scan_results.json

The scan results will show libxml2 is present. If a known CVE for libxml2 exists, Aqua flags it with its CVE ID, severity, and affected versions. For a true zero-day, the immediate CVE ID might not be available. This is where Aqua’s advanced capabilities shine.

Aqua’s runtime protection uses a combination of static and dynamic analysis. In runtime, it monitors the actual behavior of your applications. If libxml2 suddenly starts making unexpected network connections, attempting to access sensitive files, or executing shell commands it shouldn’t, Aqua’s runtime security detects this anomaly.

// Example of Aqua's runtime alert for anomalous behavior
{
  "alertId": "runtime-anomaly-12345",
  "resource": {
    "type": "container",
    "name": "my-app-container",
    "image": "my-app:latest"
  },
  "rule": {
    "name": "Anomalous libxml2 behavior detected",
    "description": "libxml2 process attempted to execute 'rm -rf /' which is outside its normal operational profile."
  },
  "severity": "CRITICAL",
  "timestamp": "2023-10-27T10:30:00Z"
}

The mental model here is layered security. Aqua doesn’t rely solely on CVE databases. It builds an understanding of what "normal" looks like for your applications and their components.

1. Shift Left Scanning: Aqua scans images during build. It identifies known vulnerabilities and misconfigurations before they reach production. For zero-days, this means it can flag components that are historically associated with vulnerabilities or have suspicious characteristics, even without a specific CVE.
2. Runtime Behavioral Analysis: This is Aqua’s critical defense against true zero-days. It observes processes, network activity, file access, and system calls made by your applications. If a component, like libxml2, starts exhibiting malicious behavior (e.g., attempting privilege escalation, exfiltrating data), Aqua detects and can block it.
3. Policy Enforcement: You define policies in Aqua that dictate acceptable behavior. For instance, you can create a policy that restricts libxml2 from executing shell commands or making outbound network connections. If the zero-day exploit tries to do this, Aqua enforces the policy and stops the action.
4. Continuous Monitoring and Auditing: Aqua continuously monitors your running workloads, providing visibility into any suspicious activities and generating alerts for immediate investigation.

The levers you control are primarily within Aqua’s policy engine and integration points. You configure the scanning depth, the runtime detection sensitivity, and the specific rules your applications must adhere to. For example, you can create a policy that states: "No container running the libxml2 library is allowed to execute execve system calls."

# Example Aqua policy snippet
apiVersion: aqua.security/v2
kind: Policy
metadata:
  name: restrict-libxml2-execution
spec:
  rules:
    - name: "Prevent libxml2 shell execution"
      description: "Deny any process using libxml2 from executing shell commands."
      selectors:
        - "image.labels.maintainer=myteam" # Or other image identifiers
      enforcement:
        mode: "deny"
      conditions:
        - "process.name IN ('libxml2', 'xml2-config')" # Example process names
          "syscall.name = 'execve'"

When a zero-day exploit attempts to use libxml2 to spawn a shell or execute arbitrary code via execve, Aqua’s runtime enforcement engine, seeing the libxml2 process attempting this forbidden syscall, will block the operation. This prevents the exploit from succeeding, even though no CVE was publicly available for it yet.

The one thing most people don’t know is that Aqua’s runtime security doesn’t just rely on detecting known malicious patterns. It builds a "fingerprint" of your application’s normal behavior during an initial learning phase. This fingerprint includes expected system calls, network destinations, file accesses, and command executions for each process. When a zero-day exploit triggers an action that deviates significantly from this learned "normal," it’s flagged as suspicious, allowing Aqua to react even when the exploit’s specific payload is novel. This is achieved by analyzing the execution context and comparing it against a dynamic, context-aware baseline rather than a static signature.

After successfully responding to this libxml2 zero-day, your next concern will be managing the inevitable drift in your containerized environments and ensuring your runtime policies remain aligned with your evolving application needs.