Recommended resources
The freely available resources this lesson will direct you to.
Hello! Welcome back to our course on designing security products.
In our last lesson, we contrasted inline (synchronous) and out-of-band (asynchronous) analysis, establishing when and where a security product makes its decisions. We saw that inline systems can prevent threats but add latency, while out-of-band systems provide deep detection without performance impact.
This naturally leads to our next architectural question: how do we collect the data for this analysis in the first place? This is a fundamental design choice that defines the relationship between your security product and the assets it protects.
This lesson directly addresses the learning outcome: Compare agent-based vs. agentless architectures for security data collection, identifying deployment and visibility trade-offs. We will explore these two dominant patterns from a first-principles perspective, helping you decide which architecture is right for the security product you are designing.
1. Two Fundamental Architectures for Data Collection
At its core, a security product can either place a piece of its own code onto the target system to gather information from the inside-out, or it can query the system remotely from the outside-in. These are the agent-based and agentless models.
Let's formally define them:
- Agent-Based Architecture: Involves deploying a software component—an "agent"—directly onto the endpoint (e.g., a virtual machine, container host, or laptop). This agent runs as a local process, collecting data and communicating with a central management server.
- Agentless Architecture: Involves a central management server that remotely connects to target systems or their management APIs to collect data. No persistent software from the security product is installed on the target workloads themselves.
To start, let's watch a short video that introduces these concepts and their primary functions.
What Is Agent-Based & Agentless Security?
This video from Prisma Cloud by Palo Alto Networks provides a great high-level overview of both models and introduces the idea of a hybrid approach.
Please watch the segment from 00:33 to 10:46. As you watch, focus on: The description of what an agent enables: in-depth scanning, real-time monitoring, and proactive prevention. The mechanism for agentless security: connecting directly to the cloud provider to gather data. The rationale for a hybrid approach: combining the broad visibility of agentless with the deep protection of agents for critical workloads.
The video provides a great conceptual foundation. Now, let's dive into the architectural specifics and trade-offs you, as a system designer, must evaluate.
2. Deep Dive: Architectural Trade-offs
The choice between agent-based and agentless is a classic engineering trade-off. There is no single "best" answer; the optimal choice depends entirely on the problem you are solving. We'll analyze this across two primary dimensions: Deployment & Operations and Visibility & Security.
A. Deployment & Operational Trade-offs
This dimension concerns the practicalities of getting your product running and keeping it running across a fleet of systems.
| Aspect | Agent-Based | Agentless |
|---|---|---|
| Initial Deployment | Complex. Requires a rollout process to install the agent on every target. Can be slow and disruptive. | Simple. Onboarding is fast. Typically just requires API credentials for the cloud or infrastructure provider. |
| Maintenance | High Overhead. Agents must be patched, updated, and monitored for health, creating lifecycle management complexity. | Low Overhead. The platform is managed centrally. No need to touch individual workloads for updates. |
| Resource Impact | Consumes CPU and memory on every host. Can impact application performance and increase operational costs. | Zero footprint on hosts. The computational load is shifted to the central analysis plane and the provider's APIs. |
| Network Architecture | Often uses a secure pull model. The agent makes egress-only connections to the central server. No inbound ports need to be opened on the target. | Typically uses a push model. The central server initiates connections to remote APIs, requiring centralized credential management and potentially complex network rules. |
The network architecture point is particularly critical from a security design perspective. An agent's egress-only "phone home" model is inherently more secure as it reduces the attack surface of the managed endpoints. To explore this further, let's look at a resource that breaks down this specific aspect.
Agentless vs. Agent-Based Kubernetes Management: A Deep Dive
The article 'Agentless vs. Agent-Based Kubernetes Management' from Plural.sh, while focused on Kubernetes, provides an excellent first-principles explanation of the network models and resource impacts that apply universally.
Please read the following two sections to solidify your understanding of the operational trade-offs: 'Comparing Network Models and Components': This section clearly explains the pull vs. push models and egress-only vs. inbound connections. 'Analyzing Performance and Resource Impact': Focus on the subsections 'System Overhead' and 'Network Bandwidth'. This details where the computational and network load resides in each model.
B. Visibility & Security Trade-offs
This dimension concerns the quality, depth, and timeliness of the data you can collect, which directly impacts the security capabilities you can build.
| Aspect | Agent-Based | Agentless |
|---|---|---|
| Data Depth & Granularity | Deep. Unparalleled visibility into the OS and applications: system calls, process execution, file integrity, memory, etc. | Shallow. Limited to what the remote APIs expose. Excellent for configuration data, but lacks deep runtime context. |
| Timeliness | Real-time & Continuous. Data is streamed as events happen, enabling immediate detection and response. | Periodic & Snapshot-based. Data is collected at intervals (e.g., every hour), creating potential visibility gaps. |
| Ephemeral Workloads | Struggles. Agents may not have time to initialize on short-lived resources like serverless functions or containers, creating blind spots. | Excellent Coverage. Discovers resources the moment they are created via API, regardless of their lifespan. |
| Offline Assets | No Coverage. The agent must be running on a powered-on host to collect data. | Full Coverage. Can analyze powered-off VMs and stored disk images via snapshot analysis. |
| Security Function | Prevention & Detection. Can actively block malicious activity (e.g., kill a process, block a network connection). This is an inline capability. | Detection Only. Can only report on findings after the fact. This is an out-of-band capability. |
The challenge agents face with ephemeral, cloud-native workloads is a primary driver for the adoption of agentless architectures. The following reading makes a strong case for an "agentless-first" approach in modern cloud environments.
Agentless-First vs. Agent-Based Security: How do they compare? - Wiz
The article 'Agentless vs. Agent-Based Security' from Wiz clearly articulates why traditional agent models struggle at cloud scale and how agentless approaches are designed to overcome these challenges.
Please read these three key sections: 'Why agentless-first matters in modern cloud environments': This explains how ephemeral infrastructure breaks the agent model. 'Disadvantages of agent-based security (magnified at cloud scale)': This summarizes the key operational and coverage gaps. 'Advantages of agentless security': This highlights the benefits of API-driven discovery for scale and coverage.
3. Synthesis: The Hybrid Model and Use Cases
As we've seen, neither model is strictly superior. The industry has converged on using each for what it does best, often within a single, unified platform. This is the hybrid model.
From an architect's perspective, you would choose an architecture based on the problem:
-
Choose Agent-Based when you need depth and control:
- Endpoint Detection and Response (EDR): Requires deep, real-time visibility into process execution, network connections, and file system activity.
- Runtime Application Self-Protection (RASP): Must instrument the application's runtime directly to monitor and block attacks within the application itself.
- Host-based Prevention (HIPS/NGAV): Needs to be able to kill processes or quarantine files in real-time.
-
Choose Agentless when you need breadth and scale:
- Cloud Security Posture Management (CSPM): Needs to inventory all cloud resources and check their configurations against best practices via cloud provider APIs.
- Vulnerability Scanning (of cloud workloads): Can use snapshot scanning to analyze the filesystems of hundreds of VMs for vulnerabilities without any performance impact on the running workloads.
- External Attack Surface Management (EASM): Discovers and inventories externally facing assets without needing any internal access.
Modern platforms, often called Cloud-Native Application Protection Platforms (CNAPPs), combine these approaches. They use an agentless approach to provide a complete, wide-angle view of the entire cloud estate and then offer the option to deploy lightweight agents or sensors on critical workloads that require deep, real-time runtime protection. This gives customers the best of both worlds: 100% visibility with zero friction, and deep protection where it matters most.
Conclusion
In this lesson, we dissected the two primary architectures for security data collection. Understanding these trade-offs is essential for designing effective security products.
Key Takeaways:
- Agent-Based Architecture excels at providing depth and control. It offers deep, real-time visibility and the ability to prevent attacks, but at the cost of high operational overhead and potential performance impact. It is the foundation for products like EDR and RASP.
- Agentless Architecture excels at providing breadth and scale, especially in the cloud. It offers fast, complete coverage of dynamic environments with no performance impact, but provides only periodic, configuration-level visibility. It is the foundation for CSPM and modern vulnerability management.
- The Core Trade-off is between the deep, real-time visibility of an agent and the scalable, non-intrusive breadth of an agentless approach.
- Hybrid Models (CNAPPs) represent the modern solution, combining a broad agentless foundation with optional, deep agent-based analysis for critical assets, offering a comprehensive security strategy.
Preview of the Next Lesson
We noted that agent-based systems are often used for prevention, which means they operate inline. This makes them a critical point of failure. If your inline security agent crashes, what should happen to the traffic it's supposed to be inspecting?
In our next lesson, we will explore this crucial architectural decision: Evaluate fail-open vs. fail-close strategies for inline security products and their availability implications. This choice forces you to balance the fundamental security principles of availability and confidentiality.