Why Kernel-Level eBPF Is Replacing User-Space Agents for Security Observability

I was working on running a SLM on windows, testing both ring 0 and ring -1... I gave up after like 50k LOC. It was a really interesting project for sure.