Check Point® Software Technologies Ltd.(link is external) announced major advancements to its family of Quantum Force Security Gateways(link is external).
eBPF is a technology that allows users to run custom programs inside the Linux kernel, which changes the behavior of the kernel and makes execution up to 10x faster(link is external) and more efficient for key parts of what makes our computing lives work. That includes observability, which enables engineers to see where a system is going wrong and find fixes faster; networking, which involves everything from how fast emails move to how fast computation occurs; to security, which keeps our digital lives and infrastructure safer from cyber threats.
The eBPF Foundation has released a publication titled The State of eBPF(link is external), a qualitative research report that covers the evolution of eBPF, the revolution it created, what's being built with it today, challenges, and where the technology is heading. The report provides valuable insight into how to make the most of what eBPF offers currently, plans for the future, and how stakeholders can get involved with the project to help eBPF continue to improve. Read on for key insights from the report to learn more about eBPF and how it can impact the way you develop applications.
About eBPF
The innovation of eBPF means companies need less hardware to achieve better performance and they consume less power to perform the same functionality. That makes operations more cost efficient, energy efficient, and sustainable, which is increasingly required to meet shareholder, consumer and community expectations.
eBPF was Linux only until recently. In 2021, Microsoft created the eBPF for Windows project to allow eBPF programs to run on top of the Windows OS. This laid the groundwork for eBPF to be standardized as an industry-wide infrastructure language. With a unified underlying infrastructure, companies can innovate however they want on top without risk of becoming locked in to one OS or the other.
This lack of vendor lock-in — from the browser to the database to the cloud — has historically spurred increased innovation, competition in terms of cost and performance, and is a bedrock tenet of the open source ethos that drives both Linux and eBPF.
eBPF is like a virtual machine in the Linux kernel. With eBPF, a developer writes eBPF instructions to run small specialized programs. They go to an eBPF "verifier," which checks to make sure the program is safe to add to the kernel and won't introduce bugs or crash the kernel. The program is JIT-compiled into machine code that gets executed and attached to event targets, which means the program is activated by an event, such as a file opening.
eBPF Adoption
For more than five years, eBPF has been operating on millions of devices and servers worldwide. Most people are already impacted by what companies do with it — and they probably don't know it.
Many of the US hyperscalers — Meta, Google, Netflix — use eBPF in production. Every Android phone uses eBPF to monitor traffic. Every single packet that goes in and out of a Facebook datacenter is touched by eBPF. Companies in myriad industries, including software, cloud services, financial services, telco, media and entertainment, ecommerce, consulting, and security, are increasingly using eBPF technology to do more, faster, saving time and money and increasing performance.
Of course hyperscalers and big companies have what most companies do not have: teams of software engineers. To spread eBPF into more enterprises, open source software projects arose to make the technology consumable out-of-the box.
Here's a breakdown of three major use cases, for eBPF in production:
eBPF Use Case 1: Observability
For many companies, observability is where eBPF first took off and has had its biggest impact. With greater observability in distributed systems that might involve tens, hundreds, or thousands of servers, companies can more easily and fully know where the system is spending its time. They can see for example, where bottlenecks are occurring, how fast CPUs are working, where they're spinning cycles, and where to find, more quickly, what piece of code may be malfunctioning. By attaching eBPF programs to events like a file opening, users get metrics that provide amazing visibility into what's happening in the system.
eBPF Use Case 2: Networking
Networking is a great example of how eBPF adds speed and performance. Many parts of the Linux networking stack were written decades ago when IPs and port ranges could be tracked on spreadsheets rather than changing with every container. eBPF enables programmers to rewrite the networking stack, only leverage the needed parts, or skip it completely to save time and processing power. By bypassing things that are not needed or rewriting functionality based on new methods of building software, networking performance dramatically improves.
eBPF Use Case 3: Security
eBPF enables enhanced observability making it easier to spot and prevent security attacks, including those within the kernel as well as throughout Kubernetes and cloud native environments. eBPF also pushes security enforcement policies into distributed environments so they get implemented in real time. If a vulnerability occurs in the kernel, for instance, fast fixes can occur via eBPF without altering the kernel code, allowing for security updates on the fly.
While eBPF is already widely deployed, it is still at the beginning of the large wave of innovation it will unlock.
No doubt, eBPF will become an essential layer in the new cloud native infrastructure stack, impacting the observability, performance, reliability, networking, and security of all applications. Platform engineers will cobble together eBPF-powered infrastructure building blocks to create platforms that developers then deploy software on. These platforms will add business logic to the mix, replacing aging Linux kernel internals that cannot keep up with today's digital and, increasingly, cloud native world.
Industry News
Sauce Labs announced the general availability of iOS 18 testing on its Virtual Device Cloud (VDC).
Infragistics announced the launch of Infragistics Ultimate 25.1, the company's flagship UX and UI product.
CIQ announced the creation of its Open Source Program Office (OSPO).
Check Point® Software Technologies Ltd.(link is external) announced the launch of its next generation Quantum(link is external) Smart-1 Management Appliances, delivering 2X increase in managed gateways and up to 70% higher log rate, with AI-powered security tools designed to meet the demands of hybrid enterprises.
Salesforce and Informatica have entered into an agreement for Salesforce to acquire Informatica.
Red Hat and Google Cloud announced an expanded collaboration to advance AI for enterprise applications by uniting Red Hat’s open source technologies with Google Cloud’s purpose-built infrastructure and Google’s family of open models, Gemma.
Mirantis announced Mirantis k0rdent Enterprise and Mirantis k0rdent Virtualization, unifying infrastructure for AI, containerized, and VM-based workloads through a Kubernetes-native model, streamlining operations for high-performance AI pipelines, modern microservices, and legacy applications alike.
Snyk launched the Snyk AI Trust Platform, an AI-native agentic platform specifically built to secure and govern software development in the AI Era.
Bit Cloud announced the general availability of Hope AI, its new AI-powered development agent that enables professional developers and organizations to build, share, deploy, and maintain complex applications using natural language prompts, specifications and design files.
AI-fueled attacks and hyperconnected IT environments have made threat exposure one of the most urgent cybersecurity challenges facing enterprises today. In response, Check Point® Software Technologies Ltd.(link is external) announced a definitive agreement to acquire Veriti Cybersecurity, the first fully automated, multi-vendor pre-emptive threat exposure and mitigation platform.
LambdaTest announced the launch of its Automation MCP Server, a solution designed to simplify and accelerate the process of triaging test failures.
DefectDojo announced the launch of their next-gen Security Operations Center (SOC) capabilities for DefectDojo Pro, which provides both SOC and AppSec professionals a unified platform for noise reduction and prioritization of SOC alerts and AppSec findings.
Check Point® Software Technologies Ltd.(link is external) has been recognized on Newsweek’s 2025 list of America’s Best Cybersecurity Companies(link is external).
Red Hat announced enhanced features to manage Red Hat Enterprise Linux.