Twistlock Runtime Defense uses machine learning to understand expected behavior from containers and hosts This model is then used to alert on or block activity when something happens outside the model