Security that respects the speed of the machine.

A monitoring agent that wakes on its own schedule desynchronises the whole machine.

Tightly-coupled jobs advance in lockstep through collective operations, an MPI_Allreduce or a barrier, and the slowest rank gates every other one. A host agent that steals a few microseconds on a single node, on its own cadence rather than the application's, ripples into idle time across thousands of ranks. The effect is worse at scale, not better: the per-node noise stays constant while the cost of staying synchronised grows. This is the OS-jitter problem the field has measured since the early 2000s, and it is the first reason you cannot simply push the enterprise endpoint agent down to every compute node.

Petrini, Kerbyson & Pakin, “The Case of the Missing Supercomputer Performance”, SC 2003.

The fast path never touches the kernel, so an inline appliance has nothing to stand in.

RDMA over InfiniBand, RoCE, or HPE Slingshot moves data from node to node without copying it through the host operating system. That kernel-bypass is the entire point: it is where the latency went. Put a stateful firewall, a TLS-inspection appliance, or deep packet inspection into that path and you are either inspecting traffic that routes around you or reintroducing exactly the overhead the fabric was designed to remove. Segmentation on a high-speed fabric is a design problem, solved in the topology and the scheduler, not a box you rack inline.

Encrypting every read and write taxes the exact path strong-scaling depends on.

A parallel filesystem exists to feed thousands of clients at once. Layer per-operation encryption or inline content inspection into that path and throughput is the first thing to go, on precisely the workloads that justify the cluster. The data still has to be protected. It just belongs where it does not sit between the compute and the bytes: at the storage controller, on self-encrypting media, and in a disciplined staging design rather than in the hot read-write loop.

An agent on every node is licence cost times the node count, and noise times the node count.

What is routine across a fleet of office laptops becomes a different proposition at thousands of identical nodes that exist to run at full tilt. The cost multiplies, the jitter multiplies, and the telemetry volume multiplies, until the monitoring is competing with the science for the machine it is meant to protect. Visibility on HPC has to be earned with a lighter footprint: out-of-band collection, sampled and eBPF-based instrumentation, and telemetry drawn from the fabric and the scheduler rather than a heavyweight agent fighting the kernel on every host.

One static key on a shared login node is the intrusion the sector has already lived through.

Hundreds of users share login nodes and a common filesystem, and for years they authenticated with static SSH keys that travelled freely between sites. In 2020 a wave of intrusions swept European academic supercomputing centres: stolen credentials, lateral movement across the shared estate, and clusters quietly turned to mining cryptocurrency. The lesson was not to add an agent. It was to move to short-lived SSH certificates, multi-factor on the access zone, and isolation designed on the assumption that a login account will eventually be compromised.