Runtime security

Build-time checks describe what you intended to run. Runtime monitoring observes what is actually happening.

The gap between those matters because containers are frequently modified after deployment, images drift from their manifests, and a compromised workload behaves differently from the one you scanned. Both are needed, and organisations usually have the build side because it fits into a pipeline.