We use it monitor production environment pods. The policies that we have applied allow us to avoid unwanted breaches. In case they happen, the pod is stopped/paused, and we can do forensics with captures taken when any breaches happen.