Runtime & Kubernetes Protection

Now pick what to compare Linkerd against.

Linkerd clear

Open a name for its full profile

Red Hat Advanced Cluster Security for Kubernetes
Capabilities only
Red Hat · Commercial · 4 capabilities in this domain
Compare →
Aqua Platform
Capabilities only
Aqua Security · Commercial · 3 capabilities in this domain
Compare →
KubeArmor
Capabilities only
AccuKnox · Open Source · 3 capabilities in this domain
Compare →
Kubescape
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 3 capabilities in this domain
Compare →
SUSE Security
Capabilities only
SUSE · Freemium · 3 capabilities in this domain
Compare →
Sysdig Secure
Capabilities only
Sysdig · Commercial · 3 capabilities in this domain
Compare →
Tetragon
Capabilities only
Isovalent · Open Source · 3 capabilities in this domain
Compare →
AWS WAF
Capabilities only
Amazon Web Services · Commercial · 2 capabilities in this domain
Compare →
Cilium
Capabilities only
Isovalent · Open Source · 2 capabilities in this domain
Compare →
Cloudflare WAF
Capabilities only
Cloudflare · Freemium · 2 capabilities in this domain
Compare →
Contrast Protect
Capabilities only
Contrast Security · Commercial · 2 capabilities in this domain
Compare →
Fastly Next-Gen WAF
Capabilities only
Fastly · Commercial · 2 capabilities in this domain
Compare →
Istio
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 2 capabilities in this domain
Compare →
Kyverno
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 2 capabilities in this domain
Compare →
OWASP Coraza
Capabilities only
OWASP Foundation · Open Source · 2 capabilities in this domain
Compare →
Datadog App and API Protection
Capabilities only
Datadog · Commercial · 1 capabilities in this domain
Compare →
Falco
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 1 capabilities in this domain
Compare →
Kata Containers
Capabilities only
OpenInfra Foundation · Open Source · 1 capabilities in this domain
Compare →
Kubewarden
Capabilities only
SUSE · Open Source · 1 capabilities in this domain
Compare →
Linkerd
Capabilities only
Buoyant · Open Source · 1 capabilities in this domain
selected

In Runtime & Kubernetes Protection

AWS WAF

Amazon Web Services · Runtime & Kubernetes Protection

Close ×

CommercialCompany

AWS WAF applies managed and custom rule groups, rate-based rules and bot control.

What it does3 capabilities · 2 at full coverage

2 of 3 at full coverage.

API Rate Limiting & Abuse PreventionFullAPI · level 2 · 6 providers
Virtual PatchingPartialK8S · level 3 · 4 providers
Web Application FirewallFullK8S · level 2 · 5 providers

What it proves9 controls across 6 frameworks

Satisfied through its capabilities, not claimed by the vendor.

API Top 102 / 10API4:2023 API6:2023
ASVS 5.02 / 17V2 V3
CSF 2.02 / 106PR.IR-01 RS.MI-01
CRA1 / 41Annex I Part I (2)(h)
LLM Top 101 / 10LLM10:2025
SSDF 1.11 / 42RV.2.2

What it stops5 techniques

5 techniques countered, 5 of them common

Brute ForceT1110Very Common
Exploit Public-Facing ApplicationT1190Very Common
Exploitation of Known Vulnerable ComponentVery Common
Injection ExploitationVery Common
Denial of AI ServiceAML.T0029Common

Where it runs2 phases · 1 way to deploy

Capabilities per lifecycle phase

Deploy1
Operate3

How it is delivered

Cloud provider native service

What it unlocks1 activity · reaches level 2

Program activities its capabilities support, reaching level 2. Supporting an activity is not completing it.

Level 2

Govern API specifications and rate limitsLow effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsPer billable cloud resource

LicensingPer billable cloud resource

Priced perresource per month

BillingConsumption

Scales withBillable cloud resources such as servers, databases and storage accounts

Total cost

Low entry cost, but costs grow silently with cloud estate; plan resource tagging and budgets.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13