# Hexes FAQ — enforcement, policy, deployment, licensing

> What Hexes enforces, how policy is learned from each workload, where it runs, what it does not replace, and the engine it is built on.

- Canonical: https://hexessecurity.com/faq
- Last updated: 2026-10-16
- Site index for agents: https://hexessecurity.com/llms.txt

_Questions_

# Questions, answered.

**What is Hexes?**

Hexes is commercial cloud-workload security for Kubernetes. It learns what each workload does — its connections, processes and files — and enforces that behaviour inline at layer 7, inside the cluster, so an out-of-policy request is blocked before it reaches the pod.

**What does Hexes enforce?**

**Network at layer 7** — per-connection protocol inspection (HTTP, gRPC, TLS, DNS, MySQL, PostgreSQL, Redis, Kafka and more), egress by FQDN, learned service-to-service policy, with inline WAF rules and DLP patterns applied to the payload in the same path. **Process** — a baseline of every process a container runs; in Enforcing mode anything new is blocked, from a shell spawned by a JVM to a tool an agent was never allowed to call. **File** — monitoring and blocking of writes to sensitive paths, binaries and configuration, with drift detection against the image the pod started from. **Admission** — gate deployments on image vulnerability, signature (Sigstore/OCI), registry, labels and privilege, in the same policy language as runtime. **Images and registries** — vulnerability and secret scanning in CI, registries and at runtime; SBOM and VEX output; Harbor pluggable scanner. **Compliance** — CIS Kubernetes and managed-Kubernetes benchmarks, DISA STIG, PCI / NIST / HIPAA / GDPR templates, continuous reports.

**Does Hexes replace my CNI, my CNAPP or my SIEM — and does it need a sidecar?**

No to all of it. The enforcer runs once per node: nothing is injected into your pods, your CNI stays in place and an existing service mesh keeps working. Hexes is **not a CNI** — Cilium and Calico keep the dataplane and identity policy; **not a CSPM or CIEM** — cloud posture and entitlements stay with the platform you use for them; **not a SIEM** — Hexes produces high-context events and your SIEM correlates them. It adds inline layer-7 enforcement on the workload and sends every event to the tools you already run.

**How is policy created?**

In Learning mode Hexes records the workload's real connections, processes and file activity and proposes an explicit allow policy. Watching mode alerts on deviations; Enforcing mode blocks them. Policy is exportable as CRDs so it lives with the application.

**Does Hexes handle AI agents and MCP traffic?**

Agent-to-tool, MCP and model-endpoint traffic is inspected and enforced as ordinary layer-7 flows, so an agent can only reach the tools and endpoints its policy allows. Some AI-specific capabilities are roadmap items and are labelled as such.

**Where does Hexes run?**

On any conformant Kubernetes — EKS, AKS, GKE, OpenShift, Rancher, air-gapped and sovereign environments — deployed with Helm or an Operator. Events go to the SOC and posture tools you already own.

**Is Hexes open source?**

No. Hexes is a commercial product. The engine it builds on is open source, and we publish the list of open-source components in every release.

**Is the engine proven?**

Yes. Inline L7 firewall, WAF and DLP on the request path has run in production for ten years, including in regulated and defence environments. Hexes keeps that architecture where it is right and rebuilds it where a decade has moved on.

**How is Hexes related to NeuVector and SUSE?**

Hexes is empowered by the NeuVector open-source project and respectful of it. NeuVector has been open source under the Apache License 2.0 since January 2022. Hexes builds on that code as an independent commercial product and follows the licence: we keep its licence text and copyright notices intact, mark what we change, credit the project, and publish the list of open-source components with each release. Hexes itself is not open source; the NeuVector source is on [GitHub](https://github.com/neuvector/neuvector). NeuVector is a trademark of SUSE. Hexes is an independent company and product — not affiliated with, sponsored by or endorsed by SUSE.

---

_About Hexes Security:_ Hexes Security builds commercial cloud-workload security for Kubernetes: inline zero-trust enforcement at layer 7 — network, process and file — from policy learned from each workload (Learning → Watching → Enforcing). It is empowered by the NeuVector open-source project (Apache-2.0), which Hexes credits and respects, and extends that engine for eBPF, AI-agent and MCP traffic, and the software supply chain. Hexes is not open source, not a CSPM/CIEM, not a SIEM and not a CNI. NeuVector is a trademark of SUSE; Hexes is independent and not affiliated with SUSE.