The evidence layer that reads what actually runs.
Through memory analysis, Kodem reads running workloads to determine what code and AI capabilities are loaded, what executes, and which paths are reachable. That evidence grounds application risk, reconstructs agent architecture, and verifies remediation.
US Patent 11,989,572 B2
US Patent 12,645,568 B2
One foundation. Every security outcome.
The same runtime evidence grounds application security, runtime AI security, and verified remediation.
Loaded, reachable, exploitable
Is the vulnerable code loaded into memory?
Does a path reach it from real input?
Did the function actually execute?
What it determines: Which vulnerable code is loaded, reachable, and relevant in the running environment.
Agent-aware intelligence
Which agents, models, and tools are loaded?
What can each agent reach?
Where can data flow, and through which delegation?
What it determines: Loaded agents, models, tools, and delegation paths, attributed to their runtime origin.
Proof.
Not assumptions
Is the risky path still reachable after a fix?
Did the change hold in production?
Which risks can be safely deprioritized?
What it determines: Whether remediation removed the risky path, re-checked against runtime state.
The evidence model
Most tools stop at present. Runtime intelligence measures how real a finding is, across distinct evidence levels. They are not always a strict linear sequence.
How Runtime Intelligence works
Runtime intelligence is built on memory analysis. Kodem inspects the memory of running processes to reveal the code and capabilities loaded inside them, then correlates that state with execution and operating-system evidence to determine which functions run and how the application behaves in its deployed environment.
1
Read what is in memory
User-space memory analysis reads each running process to reveal the code and AI components actually loaded inside it, with kernel-level signals capturing load and execution events.
2
Correlate the evidence
Kodem joins memory state with execution, operating-system, and code evidence to see what is reachable and what runs.
3
Grade what's real
Each finding maps to the evidence levels above, so triage starts from what actually runs, not what is theoretically present.
4
Verify in runtime
After a change, runtime evidence shows whether the risky path still loads and executes, so a fix is confirmed against what runs, not assumed.
Deployed the way your environment allows
Because memory is the primary evidence source, Kodem is not limited to a single kernel mechanism. Runtime intelligence supports Linux and Windows and can operate through continuous in-host collection or sensorless analysis in restricted and air-gapped environments.
Runtime intelligence operates inside your environment. Where connectivity is used, communication is outbound only. Kodem analyzes memory inside the customer environment and sends only the metadata required to generate runtime intelligence. Source code, secrets, and raw memory contents are not transmitted.
Continuous collection
Runs alongside the workload, not inside the application process. Continuous, deep runtime intelligence across Linux and Windows, deployed in about five minutes.
For restricted environments
Analyzes what is running from process memory captured out of band, with no in-process sensor and no external connection. It operates below the OS for tamper resistance and runs fully air-gapped.
Cloud environments, on-premise environments, air-gapped environments, and highly regulated environments.
One runtime foundation for code, dependencies, and AI agents
Because runtime intelligence reads what is loaded in the running workload, the same foundation reveals both the software and the AI layer.
Runtime Bill of Materials
Your inventory enriched with runtime evidence, reflecting what actually loads and executes. It surfaces shadow dependencies that load at runtime but never appear in your manifest.
Kodem Score
A per-issue score that combines severity and exploit signals with runtime factors like whether the issue is in runtime, internet-exposed, and on an ingress application.
The AI layer
Reconstructs agents, models, tools, MCP servers, guardrails, and their delegation from runtime evidence, with reachable AI risk mapped to the OWASP LLM Top 10. Discovery and attribution ship today; enforcement is the direction.
Frequently Asked Questions
Runtime intelligence is continuous visibility into how an application behaves in production: which code and capabilities load, which functions execute, and which paths are reachable.
Kodem builds it from runtime evidence through memory analysis, and it is the patented foundation the rest of the platform runs on.
It removes the large share of findings that never load or run.
Static analysis describes what could happen from the code.
Runtime intelligence establishes what is real by reading the running process in memory and correlating it with execution and operating-system evidence, so findings that never load or run drop out.
Yes. The same foundation reconstructs the AI layer from runtime evidence: agents, sub-agents, models, tools, MCP servers, guardrails, and their delegation relationships, including loaded components that have not yet generated traffic. Reachable AI risk maps to the OWASP LLM Top 10.
- Discovery and attribution ship today.
- Agent-aware enforcement is the direction Kodem is building.
No. Kodem uses out-of-band memory analysis, and the in-host sensor runs alongside the workload, not inside your application process.
It does not modify code or add in-process instrumentation, and for restricted or air-gapped environments Kodem can run sensorless.
Kodem's core evidence source is memory analysis, not a single kernel mechanism. It can use kernel-level techniques where useful, but because memory analysis is the foundation, runtime intelligence is not limited to the Linux kernel: it supports Windows, reaches endpoints, and can run sensorless in air-gapped environments.
Function-level runtime execution is supported by language, including Python, Go, Java, JavaScript, Kotlin, Ruby, Scala, and TypeScript. Full language and package-manager coverage is documented separately.
Only the metadata required to generate runtime intelligence: package and function names, file paths, execution status, and component metadata. Source code, secrets, and raw memory contents are not transmitted.
Self-hosted solutions, do not require any data to leave your environment.
