AI-powered Kubernetes network security & observability
Zero trust from the kernel up. One policy model for Linux and Windows.
Website · Docs · Blog · Get Started Free
Most Kubernetes network security tools work on Linux only. Your Windows nodes run unprotected — different tool, different policy model, no unified visibility.
Even on Linux, the default Kubernetes NetworkPolicy is limited. No deny rules. No FQDN-based egress control. No observability. No AI. Just basic allow rules and hope.
| Calico | Cilium | Nyx | |
|---|---|---|---|
| Linux enforcement | ✅ | ✅ | ✅ |
| Windows enforcement | Partial | ❌ | ✅ |
| FQDN egress filtering | ✅ | ✅ | ✅ |
| Unified Linux + Windows UI | ❌ | ❌ | ✅ |
| AI observability | ❌ | ❌ | ✅ |
| Natural language policy | ❌ | ❌ | ✅ |
Nyx enforces policy at the kernel level — eBPF on Linux, Windows Filtering Platform on Windows. No sidecars. No proxies. No Envoy dependency.
kubectl apply -f policy.yaml
│
▼
Nyx Control Plane (1 Deployment)
│
├──────────────────────────┐
▼ ▼
Linux Nodes Windows Nodes
eBPF / TC hooks WFP callout driver
Kernel-level enforcement Kernel-level enforcement
│ │
└──────────┬───────────────┘
▼
Tracenyx Cloud (your region)
Flow logs · AI analysis · Dashboard · Alerts
Two components run in your cluster — one DaemonSet for enforcement, one Deployment for the admission webhook. That's it.
- Kubernetes 1.26+
- Linux nodes: kernel 5.15+
- Windows nodes: Windows Server 2022+
helm repo add tracenyx https://charts.tracenyx.ai
helm repo update
helm install nyx \
oci://tracenyxpublic.azurecr.io/helm/nyx \
--version 0.1.0 \
--namespace nyx-system \
--create-namespace \
--set global.scout.key=<YOUR_SCOUT_KEY> \
--set global.image.registry=<YOUR_IMAGE_REGISTRY> \Go to app.tracenyx.ai/signup and sign up for Scout — the free tier built for individuals and first clusters. No credit card required.
kubectl get pods -n nyx-system
# Expected output:
# nyx-agent-xxxxx Running (one per node)
# nyx-admission-webhook-xxxxx Running (one deployment)apiVersion: nyx.tracenyx.io/v1alpha1
kind: NyxClusterNetworkPolicy
metadata:
name: deny-cross-namespace
spec:
priority: 50
policyTypes:
- Ingress
- Egress
ingress:
- decision: Deny
fromNamespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: NotIn
values: ["payment-ns"]
egress:
- decision: Deny
toNamespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: NotIn
values: ["payment-ns"]apiVersion: nyx.tracenyx.io/v1alpha1
kind: NyxNetworkPolicy
metadata:
name: allow-frontend-to-api
namespace: cloudmart
spec:
podSelector:
matchLabels:
app: api-gateway
priority: 100
policyTypes:
- Ingress
ingress:
- decision: Allow
fromPodSelector:
matchLabels:
app: frontend
ports:
port: 8080
protocol: TCPapiVersion: nyx.tracenyx.io/v1alpha1
kind: NyxNetworkPolicy
metadata:
name: payments-egress
namespace: cloudmart-payments
spec:
podSelector:
matchLabels:
app: payments
policyTypes:
- Egress
egress:
- decision: Allow
toFqdn:
matchName: api.stripe.com
ports:
- port: 8983
protocol: TCP
- decision: Allow
toFqdn:
- matchName: nyxdemoapp.blob.core.windows.net
ports:
- port: 443
protocol: TCP
- decision: Deny
toNamespaceSelector: {}Traditional firewalls see an IP address. Nyx sees a hostname. For services like Azure Blob Storage where multiple tenants share the same IP range, that difference is everything.
See more examples → github.com/tracenyx/nyx-examples
| Platform | Enforcement | Status |
|---|---|---|
| Linux (eBPF / TC) | Kernel-level | ✅ GA |
| Windows Server 2022 (WFP) | Kernel-level | ✅ GA |
| AKS (Azure) | ✅ | Tested |
| EKS (AWS) | ✅ | Tested |
| GKE (Google Cloud) | ✅ | In validation |
| On-premise | ✅ | In validation |
| Mixed Linux + Windows | ✅ | Tested |
| Mode | Behaviour | Use case |
|---|---|---|
enforce |
Blocks traffic, writes to kernel | Production enforcement |
audit |
Allows traffic, logs violations | Compliance validation |
dry-run |
No blocking, logs what would be denied | Safe policy testing |
| Feature | Scout | Sentinel | Aegis |
|---|---|---|---|
| Price | Free | Talk to us | Custom |
| Best for | Individuals & first clusters | Teams on Kubernetes | Regulated, multi-cluster estates |
| Namespaces | 3 | 25–50 | Unlimited |
| Clusters | 1 | 5–10 | Unlimited |
| Enforcement | |||
| Linux eBPF enforcement | ✅ | ✅ | ✅ |
| Windows WFP enforcement | ✅ | ✅ | ✅ |
| Dry-run / audit / enforce modes | ✅ | ✅ | ✅ |
| AI | |||
| AI anomaly detection | Limited | More | Unlimited |
| AI policy generation | Limited | More | Unlimited |
| Private AI (no third-party processing) | — | — | ✅ |
| Platform | |||
| Observability dashboard | Core | Full | Full |
| Flow log retention | 7 days | 90 days | 180 days |
| SSO / RBAC | — | ✅ | ✅ |
| Guided rollout | — | — | ✅ |
| Git policy integration | — | — | Roadmap |
| Support & compliance | |||
| Support | GitHub Issues | Dedicated SLA | |
| Data region | Auto (AU East) | Auto | Preferred |
Nyx analyses your actual flow logs and Kubernetes metadata — not generic security advice.
- Anomaly detection — surfaces unusual traffic patterns before they become incidents
- Natural language policy — describe what you want in plain English, Nyx generates the YAML
- Policy conflict detection — flags contradictions before you apply them
- Compliance gap analysis — maps your policy coverage against SOC2, PCI-DSS, HIPAA (Aegis)
- "Why was this blocked?" — AI explains any policy decision in plain language
- FQDN egress interrogation — ask in plain English: "Has any pod attempted egress to sfrclak.com in the last 24 hours?" "Which pods are making unexpected calls to blob.core.windows.net?" "Show me all egress to domains not on our approved list" Nyx queries your flow logs and returns precise, actionable answers
All AI processing happens within Tracenyx infrastructure. We send only anonymised, aggregated traffic patterns to our AI provider — never pod names, IP addresses, or raw flow records. Aegis customers can enable Private AI mode for fully isolated processing.
CloudMart is a sample microservices application (Linux + Windows) that demonstrates what your cluster looks like without proper network security — and how Nyx fixes it step by step.
helm install cloudmart tracenyx/nyx-demoFollow the tutorial → github.com/tracenyx/nyx-demo
- Zero trust policy enforcement (Linux + Windows)
- FQDN-based egress filtering
- AI anomaly detection and observability dashboard
- Natural language policy generation
- Scout free tier
- Sentinel paid tier
- ARM64 support
- Extended AI history and trend analysis
- Private AI mode (Aegis)
- Pod-to-pod traffic encryption Transparent encryption between pods — no application changes required. Works across Linux and Windows nodes in the same cluster.
- Process-level visibility See which process inside a pod made a network call. Detect shell spawns, unexpected binaries, and lateral movement attempts at the process level — on both Linux and Windows nodes.
- Git-based policy management (Aegis) Policy-as-code via GitHub, GitLab, or Azure DevOps. PR-based review workflow, drift detection, and audit trail tied to Git commits.
- Security validation suite Test whether your policies actually block what you think they block. Built-in attack simulation covering lateral movement, data exfiltration, and privilege escalation — mapped to MITRE ATT&CK for Kubernetes.
- Ingress protection Rate limiting and connection throttling per namespace and per pod — enforced at the kernel level. Protect your services without additional infrastructure.
- L7 observability HTTP status code tracking, error rate analysis, and latency percentiles per service — with no sidecar required.
- Fine-tuned Nyx Security Model (trained on Kubernetes network patterns)
- Bring-your-own-model for air-gapped environments
- Full on-premise deployment option
- SPIFFE/SPIRE workload identity integration
Found a vulnerability? Please do not open a public GitHub issue.
→ Email: security@tracenyx.ai
We aim to respond to all security disclosures within 24 hours.
Nyx is proprietary software. The Scout tier is free to use under the Scout License Terms. Commercial use requires a license key.
© 2026 Tracenyx Pty Ltd. All rights reserved.
Built in Melbourne, Australia 🇦🇺