Runtime-level tenant isolation for SaaS — lightweight sandboxes (WASM / eBPF)

Executive Summary

Many multi-tenant SaaS vendors — roughly 40,000 in the target segment — struggle to scale secure tenant separation without incurring high infra costs or complex architecture changes. They contend with noisy neighbors, regulatory SLAs and customer demands for isolation, which today often lead to cluster-per-tenant deployments or 2–5x overprovisioning. A pragmatic product would provide runtime-level tenant isolation via lightweight sandboxes built on WASM and eBPF, implemented as an in-process enforcement layer with a managed control plane for policy, observability and audit logs. The offering would include language-agnostic SDKs and migration tools so teams can adopt per-tenant policies with minimal code changes and measurable latency overhead under 1–2%. This is an attractive time: the market is about $9.6B (40,000 vendors × $240K ACV), cloud cost pressure is forcing engineering teams to avoid wasteful architectures, and maturing WASM/eBPF primitives make low-overhead production sandboxes feasible. Compliance and zero-trust requirements also mean customers are willing to pay for auditable, runtime-enforced tenant separation. You can differentiate by focusing on low overhead and operational friction — deployability to existing clusters, strong observability, policy-as-code and verifiable audit trails — instead of heavyweight VM isolation or purely network-based controls. The main challenges will be proving security guarantees against a broad threat model, maintaining compatibility with complex language runtimes and overcoming a longer sales cycle to platform engineering and security teams, but the potential cost and compliance ROI make this a concept worth validating.