Aqua Security has announced Aqua Compass, a Model Context Protocol (MCP) server that enables agentic investigation, containment and remediation of runtime incidents, and new runtime risk dashboards. These capabilities help security teams move beyond identifying risk and focus on containing threats in running applications.

The announcement builds on Aqua’s Secure AI capabilities, extending the company’s AI innovation from protecting AI applications to applying AI directly to runtime security operations.

Cloud native development and AI-generated code are dramatically increasing the number of vulnerabilities reaching production environments, while attackers are automating exploitation and compromising systems within minutes. Many organizations now face a growing problem: They can see the risk, but they cannot fix it fast enough.

Aqua Compass addresses this challenge by introducing an MCP server embedded directly within Aqua’s runtime security workflows. Through the MCP interface, customers can build AI agents that interact with Aqua’s runtime intelligence and enforcement controls without leaving the environments they already operate in. These agentic workflows enable teams to move from alert to action in seconds, as agents analyze activity, contain vulnerabilities, recommend remediation steps, and support execution with a human in the loop to oversee decisions and maintain control without slowing the response.

Aqua Compass is able to analyze live malware attacks inside a containerized workload, identify the malicious behavior, and recommend specific steps to isolate the compromised pod. The workflow then generates a hardened runtime policy scoped to the affected namespace, immediately blocking similar behavior. Compass enables teams to respond with the speed and precision typically associated with highly experienced analysts.

As security teams rapidly shift toward agentic automation to stay ahead of attackers, organizations can begin building security agents on top of Aqua Compass today.

“The industry spent the last decade building visibility into cloud environments, but visibility alone does not stop attacks,” said Mike Dube, CEO of Aqua Security.

“Vulnerabilities are being exploited faster than organizations can remediate them, which means the old model is becoming obsolete. The future of cloud is autonomous runtime security. With more than a decade of embedding enforcement directly inside production workloads and patented innovations in runtime security, Aqua is uniquely positioned to secure cloud native environments today and into the future,” Dube continued.

Alongside Compass, Aqua also introduced a new suite of runtime risk dashboards that convert vulnerabilities and misconfigurations into customer-quantified monetary exposure. As runtime controls are enforced, that exposure is continuously recalculated, allowing security teams to measure how risk is being reduced in production environments.

By correlating runtime activity, vulnerabilities, and enforcement outcomes, the dashboards translate Aqua’s runtime telemetry into operational metrics that show where risk exists and which controls are having the greatest impacts.

These capabilities are made possible by Aqua’s runtime visibility and enforcement architecture, developed over more than eleven years of securing containerized applications in production. Aqua’s agent-based enforcement operates directly inside running workloads, providing sophisticated runtime telemetry and enabling patented enforcement techniques that stop exploitation in real time.

Combined with adversary intelligence from Aqua’s Nautilus research team and telemetry from millions of protected workloads, this foundation allows Aqua to translate runtime activity into meaningful risk insights through its dashboards while enabling Compass to investigate attacks and generate containment policies that can be enforced immediately in production environments.