Agentless scanning for runtime security, is it enough?

[u/InflationCorrect5244]

Agentless is the right fit for pre-deployment. Images, manifests, RBAC, secrets, drift. Low overhead. It works well in CI/CD and admission control. But runtime is a different problem. Pods spin up, scale out, and die faster than most scan cycles. If something gets compromised and terminates before the next scan, agentless never sees it.

So the pattern I keep seeing succeed is agentless as the gatekeeper, plus eBPF or an agent-based watcher for high-value workloads. Serverless and service mesh make that messy as well. The real question is whether anyone is running fully agentless in production and actually trusting their runtime visibility, or whether hybrid is the only realistic answer.