What happens when traditional security boundaries are breached? In Part 2 of the SYSGO Techcast with Karamba Security, we explore how runtime protection, behavioral monitoring and container security can help embedded manufacturers strengthen their defenses against increasingly sophisticated cyber threats.

As embedded systems become more connected, software-driven and autonomous, cybersecurity is evolving from a product feature into a fundamental architectural requirement. Industrial controllers, medical devices, connected vehicles and robotic platforms increasingly operate in environments where vulnerabilities can have consequences far beyond data loss or service interruptions.

In the second episode, the discussion goes one step further: How can an embedded platform remain resilient when an attacker has already compromised part of the system?

Together with our partner Karamba Security, we examine how XGuard complements SYSGO's ELinOS industrial Linux distribution with additional runtime protection, monitoring and security controls designed for connected embedded environments.

When Root Access is no longer the End of the Story

In traditional Linux environments, gaining root privileges represents one of the most serious security compromises. Root access provides extensive administrative capabilities, allowing an attacker to modify system configurations, manipulate files, interfere with running processes or disable certain protective mechanisms.

But does gaining root access necessarily mean that every security control can be bypassed? Karamba Security approaches this challenge through a combination of cryptographically protected policies and self-protection mechanisms.

XGuard's security policies define which applications are trusted, which execution relationships are permitted and which processes may access sensitive resources. These policies are generated during system integration and are cryptographically signed using a private key that is not stored on the target device. As a result, an attacker who obtains root privileges cannot simply create a modified policy and have it accepted as legitimate without possessing the corresponding signing key.

XGuard also applies self-protection mechanisms to its own components. These controls are designed to prevent unauthorized modification of its executable files, services and running processes, including attempts to interfere with them at the memory level. This creates an additional security boundary beyond conventional Linux user permissions.

The underlying principle is important: Security should not depend exclusively on the assumption that privileged system accounts will never be compromised.

While no single security mechanism can guarantee protection against every possible attack, independently enforced runtime controls can make it significantly harder for attackers to manipulate a compromised environment.

From Prevention to Visibility: Why Behavioral Monitoring matters

Blocking unauthorized code execution is an important defense, but manufacturers also need to understand what is happening across their deployed devices.

Consider an OEM operating thousands of industrial controllers, networked medical devices or connected machines. Even with preventive security controls in place, unexpected activities can occur. An attacker may attempt to launch unauthorized processes, establish unusual network connections or access protected resources. Such attempts may be blocked successfully, but they can still provide valuable information about emerging threats.

This is where behavioral monitoring and observability become essential. XGuard supports the collection of security-relevant telemetry through a lightweight on-device agent. Depending on the configuration, this information can include:

• Network connections, incoming and outgoing traffic, and open sockets
• Process execution and command-line arguments
• File access and application crashes
• System time changes and other unusual activities
• CPU and memory resource consumption

These metrics help establish a baseline of normal system behavior. By analyzing deviations from that baseline, including through anomaly detection and machine learning techniques, manufacturers can identify activity that deserves further investigation. Importantly, this capability extends beyond cybersecurity. Unusual process behavior, unexpected resource consumption or repeated application crashes may also indicate operational problems rather than malicious activity.

For manufacturers managing large fleets of embedded devices, this creates a valuable combination of security monitoring and operational diagnostics. Instead of treating each device as an isolated system, observability enables a broader understanding of how deployed products behave throughout their operational lifetime.

Are Containers really secure?

Container technology has become increasingly important in embedded Linux development. Platforms such as Docker and Podman allow manufacturers to separate applications, simplify software deployment and update individual components without rebuilding an entire operating system. SYSGO's ELinOS supports container-based application architectures, making it possible to combine a purpose-built industrial Linux foundation with flexible application deployment.

However, a common misconception is that placing an application inside a container automatically makes it secure. Containers provide a degree of isolation between applications and the host environment. Yet they typically share the underlying Linux kernel, meaning that vulnerabilities in the kernel or container configuration can potentially affect the security of the entire platform.

Applications running inside containers can also remain vulnerable to malicious input, unauthorized execution and configuration manipulation. In certain scenarios, attackers may even exploit vulnerabilities that allow them to escape the container environment and compromise the host.

Karamba Security addresses these challenges by extending XGuard's runtime protection mechanisms into containerized environments. One recommended approach is to enforce security controls at the host level and extend those protections to the containers running on the system. This enables consistent security policies across the broader platform.

For environments where the host cannot be modified, XGuard can also be deployed within individual containers. The objective is to preserve the operational benefits of containerization while adding protection against threats that container isolation alone cannot prevent.

Containers simplify how software is developed, deployed and maintained. Runtime protection helps secure how that software behaves once it is running.

From Industrial Controllers to Robotics: Where Runtime Protection matters most

The need for proactive cybersecurity is not limited to a specific industry. Instead, it is primarily determined by a product's risk profile, connectivity and regulatory requirements.

Devices connected to public networks, wireless infrastructures or large enterprise networks are particularly exposed because potential attackers may have fewer barriers to reaching vulnerable services. For manufacturers, this makes runtime protection relevant across a wide range of embedded applications.

1. In industrial automation, connected controllers and machines increasingly exchange data with other systems, introducing additional communication interfaces and potential attack paths.
2. In medical technology, protecting sensitive system functions and maintaining dependable operation are essential, particularly where cybersecurity incidents could affect patient safety.
3. In automotive and defense applications, systems often combine sophisticated software architectures with demanding operational and security requirements.
4. An especially interesting emerging field is Physical AI and robotics.

As autonomous robots begin to operate in manufacturing environments, logistics facilities and other real-world applications, the relationship between cybersecurity and functional safety becomes increasingly important.

A cyberattack against a conventional information system may compromise data or interrupt a service. An attack against a connected robotic platform could potentially influence physical behavior, movement or interaction with its environment. This makes security an architectural concern rather than simply a software maintenance task.

Runtime protection, strict execution controls and continuous monitoring can therefore play an important role in reducing the risks associated with increasingly autonomous embedded systems.

Cyber Resilience and Observability: Two Priorities for the Future

Looking ahead, Karamba Security identifies two developments that are likely to shape the next generation of embedded cybersecurity: Resilience and observability.

Resilience describes the ability of a system to withstand attempted attacks and continue protecting its critical functions. Rather than assuming that every vulnerability can be eliminated before deployment, manufacturers need architectures capable of restricting unauthorized activities even when weaknesses are present.

Observability complements this approach by providing visibility into device behavior and potential security incidents.

This combination is particularly important as deployments grow from individual embedded products into large, distributed fleets of connected devices. At the same time, AI-assisted attack techniques are accelerating the discovery and exploitation of software vulnerabilities, while regulatory initiatives such as the EU Cyber Resilience Act are reinforcing the need for systematic cybersecurity practices throughout the product lifecycle.

For product manufacturers, this creates a clear requirement: Cybersecurity must become an integrated and continuously maintained part of embedded software engineering.

ELinOS and XGuard: Complementary Technologies with a shared Objective

The partnership between SYSGO and Karamba Security reflects a common engineering philosophy: Simplifying complex technology so that manufacturers can focus on developing their core applications.

ELinOS provides a configurable industrial Linux platform with capabilities for security hardening, vulnerability management, secure software updates and long-term maintainability. XGuard complements this foundation with dedicated runtime protection mechanisms, including execution controls, protected security policies, file and process protection, and behavioral monitoring. Together, the technologies support a layered security approach that addresses different stages of an embedded product's lifecycle.

For manufacturers, this can reduce the complexity of integrating cybersecurity measures into their platforms. Proactive protection may also help reduce the immediate operational pressure created by newly discovered vulnerabilities, giving product security teams additional flexibility while assessing and preparing appropriate updates.

Importantly, runtime protection does not replace patch management or vulnerability remediation. It adds preventive and monitoring capabilities to an existing security strategy.

This combination allows manufacturers to address cybersecurity as an integral part of their system architecture rather than an additional feature introduced late in development.

Security by Design starts with understanding the Risks

One of the central messages from the Techcast is that effective cybersecurity begins long before a product reaches the market. Manufacturers should evaluate the specific threats their devices may face, identify sensitive functions and resources, and integrate appropriate protections early in the development process.

Whenever possible, security mechanisms should also be automated and incorporated directly into the build and deployment workflow. This supports consistent enforcement and reduces the risk of security becoming an afterthought.

As embedded systems become more connected and autonomous, the ability to prevent unauthorized activities, understand system behavior and respond to emerging risks will become increasingly important.

A secure operating system establishes the foundation. Proactive runtime protection and observability help extend that foundation throughout the operational life of the device.