In early 2025, attackers found a way into Commvault’s Metallic SaaS platform, a widely used backup solution for Microsoft 365. The vulnerability (CVE-2025-3928) was buried deep in its Azure-hosted infrastructure and gave attackers a way to extract customer credentials quietly.
No malware was dropped. No phishing involved. Just smart exploitation of trust between systems, followed by lateral movement and exfiltration of sensitive data from customer environments.
Here’s the thing: traditional tools didn’t catch it because they weren’t watching close enough, or close to the system. Endpoint logs came late, cloud scans showed no misconfigurations, and logs didn’t signal the credential theft at the kernel level.
What could have made the difference? System‑level visibility, in real time.
That’s exactly what eBPF delivers. Let’s get into the details.
So, What Is eBPF?
eBPF (Extended Berkeley Packet Filter) is a Linux technology that lets you run lightweight, sandboxed programs inside the operating system kernel, without modifying it.
These programs can safely observe and react to low-level system events like file reads, process launches, or network activity, all in real time.
Think of eBPF as a programmable sensor inside the Linux kernel. It lets you run lightweight code at critical system points like when a file is read, a process starts, or data leaves the network.
Before eBPF, the only way to monitor this kind of activity meant clunky kernel modules or intrusive agents. Now, with eBPF, you get deep observability without sacrificing performance or stability.
It’s like going from watching the parking lot to sitting in the driver’s seat, seeing exactly what’s happening under the hood, as it happens.
How does eBPF work?
When a system event occurs, like opening a file or sending a packet, eBPF can attach itself to that event, capture the details, and take action. That might mean logging it, alerting the security team, or feeding a live signal into a response system like DLP. All of this happens inside the kernel, with near-zero overhead. That means you get real-time insights without impacting performance, and without relying on post-facto logs.
What problems does eBPF solve?
Most security tools operate with some degree of delay. DSPM might tell you a sensitive file is exposed, and DLP might flag patterns that look risky, but neither catches the exact moment when something actually goes wrong. That gap is where damage happens. Imagine a developer pasting customer data into ChatGPT, or an employee forwarding a CSV to their personal Gmail, or an app syncing private information to a misconfigured cloud bucket. These actions often fly under the radar because traditional tools either can’t see them at the system level or react too late. What eBPF changes is the timing.
By running inside the kernel and observing system calls in real time, eBPF gives you live, low-level visibility into how data moves, right when it moves. It captures actual behavior, not just policy violations or delayed logs, which makes it a powerful tool for detecting insider risk, shadow data flow, and silent exfiltration before it becomes a headline.
Why this matters for compliance
Compliance today isn’t just about having the right policies in place; it’s about being able to prove, with precision, how sensitive data was accessed, by whom, and what they did with it. Regulators increasingly expect real-time accountability, not delayed alerts or vague logs. That’s where eBPF helps you stand apart.
Because it runs at the kernel level, eBPF can record exactly when a file was read, modified, or transmitted right as it happens, not after the fact. It captures this telemetry at the source, without relying on agents or delayed event pipelines. For auditors, this kind of syscall-level traceability means clear, defensible answers. For your team, it means fewer blind spots, better evidence, and a stronger posture when the questions start coming.
How Matters puts eBPF to work
A lot of platforms bolt on eBPF and call it innovation. But raw telemetry alone doesn’t solve problems. You don’t need more data; you need the right signal, at the right moment, with the context to act on it.
That’s where Matters is different.
We don’t just run eBPF at the kernel and stream events to a dashboard. We connect it to the rest of your data security stack—DSPM and DDR to create a live, intelligent feedback loop.
Let’s break it down.
An employee downloads a CSV of customer data from your CRM and opens it locally. So far, nothing’s wrong. But then they drag it into their personal Gmail.
Here’s what happens inside Matters:
- eBPF immediately sees the file read on disk, and the browser upload begins.
- The system identifies the file as sensitive; DSPM had already classified it last week.
- The Gmail domain isn’t sanctioned. That upload violates your policy.
- Behaviour model steps in. It knows this user has never done this before. It correlates the access pattern, flags it as high risk, and takes action.
Depending on your setup, that action could be:
- Blocking the upload in real time
- Masking the data in transit
- Alerting the SOC with full forensic context
- Or automatically removing access permissions from the endpoint
All of this happens before the email is ever sent.
No agent needed. No waiting for logs. No guesswork.
eBPF gives you the raw visibility.
Matters turn that into understanding and instant protection.
That’s what we mean by real-time, contextual data security.
It’s not about having more tools. It’s about using the right ones, in the right order, at the right depth.
What does this mean
Without eBPF, you’re always one layer removed from what’s happening. You’re relying on logs, retrospective alerts, and configuration scans. That leaves time for damage.
With eBPF, you’re seeing the moment data moves. You’re catching the exploit at the source.
That’s why we built Matters this way. To fill the blind spot. To secure not just data at rest or in the cloud, but data in motion.
Next Steps
Want to see eBPF in action? Let’s schedule a demo.
We’ll show you:
- Live eBPF-powered detection.
- How events trigger instant policy enforcement
- How it fits seamlessly into your existing stack. No system slowdown, no agent fatigue.
