diff --git a/config/configStructs/tapConfig.go b/config/configStructs/tapConfig.go
index c6e6ea908..43dbfdec4 100644
--- a/config/configStructs/tapConfig.go
+++ b/config/configStructs/tapConfig.go
@@ -152,7 +152,7 @@ type TelemetryConfig struct {
 }
 
 type ResourceGuardConfig struct {
-	Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
+	Enabled bool `yaml:"enabled" json:"enabled" default:"true"`
 }
 
 type SentryConfig struct {
diff --git a/helm-chart/README.md b/helm-chart/README.md
index 3263fc5a4..e662beb48 100644
--- a/helm-chart/README.md
+++ b/helm-chart/README.md
@@ -172,7 +172,7 @@ Please refer to [metrics](./metrics.md) documentation for details.
 | `tap.kernelModule.image`                  | Container image containing PF_RING kernel module with supported kernel version([details](PF_RING.md))      | "kubeshark/pf-ring-module:all"                                                 |
 | `tap.kernelModule.unloadOnDestroy`        | Create additional container which watches for pod termination and unloads PF_RING kernel module. | `false`|
 | `tap.telemetry.enabled`                   | Enable anonymous usage statistics collection           | `true`                                                  |
-| `tap.resourceGuard.enabled`               | Enable resource guard worker process, which watches RAM/disk usage and enables/disables traffic capture based on available resources | `false` |
+| `tap.resourceGuard.enabled`               | Enable resource guard worker process, which watches RAM/disk usage and enables/disables traffic capture based on available resources. This means that for any specific node, if resource utilization (CPU, memory, disk) reaches 90% traffic capture will stop automatically. Traffic capture will restart once resources go back to below the 90% level. | `true` |
 | `tap.sentry.enabled`                      | Enable sending of error logs to Sentry          | `false`                                                  |
 | `tap.sentry.environment`                      | Sentry environment to label error logs with      | `production`                                                  |
 | `tap.defaultFilter`                       | Sets the default dashboard KFL filter (e.g. `http`). By default, this value is set to filter out noisy protocols such as DNS, UDP, ICMP and TCP. The user can easily change this in the Dashboard. You can also change this value to change this behavior.        | `"!dns and !tcp and !udp and !icmp"`                                                  |