Last week, we published the scoring rules for this soak before we had any results. The run has closed. Here are the numbers, graded against that post.
7 days, 94 protected pods, 14 namespaces, 0 attacks deployed. 1 signed evidence record. 0 detector trips, 0 isolations, 0 terminations. Against the pre-registered bars: drift-plan evidence at 0.0000637 per pod-hour against a ceiling of 0.1, isolations and terminations at true zero, not rounded. All four bars passed, the evidence bar with roughly 1,570x margin.
The denominator is 15,690 online pod-hours out of 15,792 gross. We threw away 101 pod-hours of cold start and post-churn relearn, exactly as promised, because counting hours in which the sidecar deliberately cannot act inflates the denominator and flatters the rate. Churn was scored by observed effect rather than job success: pods recreated, pods killed, sidecars restarted on a 12-hour rotation, confirmed by counting distinct container ids instead of trusting that the cron reported healthy.
The single detection is worth reproducing. A redis pod tripped cumulative drift at 0.0792 against a learned threshold of 0.0351. It stayed inside the long-scale envelope, the ML plane returned normal, and the event was capped at alert: evidence emitted, no response chain, no trip counted. That is the two-factor gate doing on benign traffic exactly what it exists for.
Cohorts stayed separate, as promised. The out-of-the-box group logged 8,346 pod-hours with zero trips, the integrity-armed group 7,178, also zero. Of the six armed workloads, three needed a uid0 and SYS_PTRACE grant some customers will not make, so “armed” should not be read as “default”. The wrong-zero check also came back clean: every trip was claimed by a named event class and the residual was zero, meaning no events were hiding from the count under an unrecognized label.
One finding constrains all of it. Only 23 of 94 pods carried all five process-level signals live, and in the out-of-the-box configuration the executable-link signal was dark on every pod. Fewer live signals means fewer opportunities to fire, so reduced coverage biases the false positive rate downward. The zero is real, but it was measured on a fleet where most pods could not see much at the process layer.
Provenance is the same story in stronger form: it contributed zero because it was blind, not because it was quiet. Manifest presence and maps readability both read zero on all 14 workloads for the entire window, so that plane cannot be cited as a clean result at all. And as flagged in advance, the terminate zero is partly structural, since statistical events are capped below termination by design.
Two more things we said we would not bury. Sidecar CPU ran a median near 110 millicores per pod with memory around 5 MiB. And the one evidence record we produced has no durable storage anywhere in the product today: it was captured by hand before teardown, and its Kubernetes event aged out within the hour. A campaign that emits evidence it cannot keep has a numerator it cannot audit. That is now a work item.
The next run closes these in order: signal coverage first, then evidence durability. The numbers above are what a strict denominator and a partly blind fleet produced, and the definitions they were scored against were published before anyone here had seen them.
Top comments (0)