eBPF (Extended Berkeley Packet Filter)
Architecture allowing kernel observation programs to run in a sandboxed space, avoiding the crash risks associated with conventional kernel-level drivers.
On 19 July 2024 a CrowdStrike Falcon content update crashed about 8.5 million Windows machines: the vendor's driver runs in the kernel, and an error there stops the whole system. Extended Berkeley Packet Filter, or eBPF, is a software architecture that allows custom programs to run directly in the Linux kernel, or more recently the Windows kernel, after a verification step that precedes loading. Unlike traditional kernel drivers, which run with full privileges and whose errors can cause a complete system crash (blue screen on Windows), an eBPF program is first verified by the kernel to guarantee its safety before being allowed to execute. This architecture offers deep visibility into system behavior without sacrificing stability. It is already the dominant standard for security and observability on Linux, and Microsoft is pushing the endpoint security industry to migrate toward similar approaches on Windows following the CrowdStrike incident of July 2024, where a kernel driver update caused a global outage affecting 8.5 million machines. The insurance implication is direct: if migration to eBPF becomes widespread in endpoint security solutions, the severity distribution of claims related to defective software updates changes radically, reducing the probability of a large-scale CrowdStrike-type event. This alters the correlation parameters of cyber PML models.
After the CrowdStrike outage of July 19, 2024, Microsoft convened security vendors in September and then announced, under the Windows Resiliency Initiative, a platform that will let them run their products outside the kernel. Microsoft does not mandate eBPF, but the idea is the same: move third-party code out of kernel mode. A reinsurer can then revise its stress scenario for defective updates downward, taking as a model assumption a 60 percent out-of-kernel migration rate by 2027.
eBPF, extended Berkeley Packet Filter, BPF
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.