What is included in Bitdefender GravityZone Security for Containers Add-On?

Container runtime protection – Antimalware and behavioural monitoring for running Docker and Kubernetes workloads.
Linux anti-exploit – Blocks container escape, process hijacking and malicious scripting techniques.
Kernel-independent agent – Runs without Linux kernel modules on multiple distributions.
Context-aware EDR – Records container events and maps them to MITRE ATT&CK.
Central management – Policies, inventory and reports in the GravityZone Control Center.
Important – Container image scanning is a separate GravityZone integration, not included.

What are the main benefits of Bitdefender GravityZone Security for Containers Add-On?

Security for Containers is an add-on for the GravityZone platform that protects Linux container workloads while they are running. It is managed centrally from the GravityZone Control Center, in the same console as the servers and endpoints already under management.

Faster distribution upgrades – No kernel module dependency delays your Linux upgrade schedule.
One console – Container alerts appear beside server and endpoint incidents.
Runtime attack coverage – Catches threats that pre-deployment image scanning cannot see.
Managed platform support – Covers EKS, AKS, GKE and Amazon ECS clusters.
Investigation context – ATT&CK mapping shortens triage of Linux-specific container alerts.

Which company size is Bitdefender GravityZone Security for Containers Add-On suitable for?

The decisive question is not headcount but whether you actually run containers in production. A twenty-person software firm operating a Kubernetes cluster has a stronger case for this add-on than a two-hundred-person company running only Windows file servers.

Does Bitdefender GravityZone Security for Containers Add-On meet the requirements of Swiss cybersecurity legislation?

No software product meets these requirements on its own, and this add-on is no exception. The revised Information Security Act obliges operators of critical infrastructure to report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery, which means the practical problem is detecting the incident early enough and describing it accurately enough to file within that window. Security for Containers supports that specific task on container workloads: it records process, file and network events inside running containers, maps detections to MITRE ATT&CK, and produces a timeline you can use to describe what happened and when. It does not tell you whether your organisation falls under the reporting obligation, it does not file the report, and it produces no evidence at all for assets outside its scope, meaning your Windows endpoints, mailboxes, network devices and any container images not yet deployed. If your container estate is only part of your infrastructure, the reporting gap sits in everything else. This information is not legal advice; assessing your own obligations belongs with your legal or compliance function.

Does Bitdefender GravityZone Security for Containers Add-On meet the requirements of European cybersecurity legislation?

No product creates NIS 2 compliance, because the Directive addresses organisational risk management rather than any single tool. NIS 2 requires categories of measure including risk analysis and security policies, incident handling, business continuity, supply chain security, security in the acquisition and maintenance of network and information systems, vulnerability handling, cryptography, access control, and multi-factor authentication. This add-on contributes to two of those categories in a narrow scope: incident handling, through runtime detection and response on container workloads, and security of network and information systems, for the container layer specifically. It contributes nothing to cryptography, access control, multi-factor authentication, business continuity or staff training, and its supply chain contribution is limited because it inspects containers at runtime rather than the images and dependencies they were built from. Treat it as one control in a much larger set, not as evidence of Directive-level coverage.

Does Bitdefender GravityZone Security for Containers Add-On help with security questionnaires from large customers?

Yes, for a specific and fairly narrow block of questions. It gives you a defensible answer to items on malware protection for Linux server and container workloads, on runtime threat detection and response, on centralised security policy management, and on whether security events are collected centrally and can be forwarded to a SIEM. Questions about detection methodology are also easier to answer because detections are mapped to a recognised framework rather than to vendor-internal categories.

It answers nothing on multi-factor authentication, disk or data encryption, patch and vulnerability management, mobile device management, email security, backup and recovery, identity and access governance, or endpoint coverage for Windows and macOS. It also does not answer container image and dependency scanning questions, which appear on most modern supplier questionnaires aimed at software vendors, because that scanning is a separate GravityZone integration.

Closing those gaps is usually cheaper and quicker inside the GravityZone family than by mixing vendors, because the answers then come from one console and one reporting model, which is what an auditor wants to see. Endpoint and EDR coverage comes from a GravityZone Business Security Premium or Business Security Enterprise base licence, patch management and full disk encryption are separate GravityZone add-ons, cloud configuration questions are addressed by CSPM+, and image scanning by the Bitdefender Container Image Scanner integration. Map your questionnaire to those components before buying, because the add-on alone will leave most of the form unanswered.

What is the difference between Security for Containers and Cloud and Server Security?

The decisive difference is what is being protected: Security for Containers protects the workloads running inside containers, while Cloud and Server Security protects the servers and virtual machines themselves. Bitdefender positions the two as complementary components of Cloud Workload Security rather than as alternatives, so a team running containers on its own Linux hosts generally needs both, not one. Buying only the container add-on leaves the underlying host unprotected, which is the mistake that most often triggers a follow-up purchase a few weeks later. Neither product performs container image scanning.

Which limitations should you know before buying?

This is an add-on, not a standalone product: it requires an existing GravityZone base licence and the GravityZone Control Center, and it cannot be operated on its own. Its scope is Linux and container workloads, so Windows and macOS endpoints in the same company still need endpoint licences from a GravityZone base product, and buyers protecting a mixed estate consistently underestimate this. Protection is applied at runtime, which means container images sitting in a registry before deployment are not examined; that work is done by the Bitdefender Container Image Scanner, a separate integration configured in the Integrations hub with its own command-line tool. Kubernetes and cloud configuration checks belong to KSPM and CSPM+ respectively and are also licensed separately, so a shopping list built only from this page will not cover posture management. Bitdefender adds container platforms regularly, so if you run an orchestration platform outside Docker, Podman, Kubernetes, Amazon ECS, EKS, AKS or GKE, confirm current support before ordering.

Frequently asked questions about Bitdefender GravityZone Security for Containers Add-On

Which container platforms are supported?

Bitdefender lists Docker, Podman, Kubernetes, Amazon Elastic Container Service (ECS), Amazon Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS) and Google Kubernetes Engine (GKE). The list is extended over time, so check the current position with Bitdefender or your partner if your platform is not named here.

How is the protection deployed onto container hosts?

There are native deployment options for both Linux-hosted and PaaS-hosted containers, using a host-based agent together with container-native telemetry and control. Because the Linux agent does not rely on kernel modules, you can move to a newer distribution without waiting for a matching security module to be released, which is the usual reason upgrade projects stall.