Field notes
Cover: rootless nodes shrink the blast radius of container breakouts by keeping node components out of host root. Kubernetes v1.37 promotes KubeletInUserNamespace—better known as rootless mode—to beta. For platform and security teams, that is more than…
Late 2026 vendor conversations increasingly include attestations: provenance for builds, signed artifacts, SBOMs, and response SLAs when a dependency is exploited. Buyers who cannot articulate requirements receive marketing PDFs instead of verifiable controls. This guide outlines…
Security metrics fail when they optimize for auditor comfort instead of executive decisions. Patch lag charts nobody reads, vulnerability counts without exposure context, and red/green compliance tiles create calm while risk concentrates in a few internet-facing…
Advanced detection stacks are useless if mundane authentication logs are missing, short-lived, or unqueryable. Most lateral movement still leaves footprints in identity systems: unusual logon types, impossible travel between VPN and cloud consoles, new MFA device…
Credential rotation at scale fails when it is treated as a heroic weekend project. Cloud keys, registry tokens, bot accounts, webhook secrets, and workload identities accumulate until a breach forces simultaneous rotation—and then production stalls because…
Internal developer platforms—artifact registries, webhook testers, preview environments, documentation importers, and MLOps-adjacent tools—often fetch URLs on behalf of users. That design convenience is also a classic server-side request forgery (SSRF) path to cloud metadata services and…
Build servers and CI control planes are crown jewels: they hold repository credentials, cloud deploy roles, signing keys, and the power to ship arbitrary artifacts into production. Critical remote-code-execution classes against CI products have repeatedly shown…
Cloud administrator workstations are high-value targets. A single phishing email on a daily-driver laptop can yield console cookies, API keys, and enough session material to alter IAM or plant persistence. Privileged Access Workstations (PAWs)—hardened, dedicated environments…
Machine-learning platforms grew up as research convenience layers: tracking servers, model registries, feature stores, and notebook hosts that made experimentation easy. That convenience often arrived with default network exposure, weak authentication, and service identities that can…
Internal platforms increasingly execute untrusted or lightly trusted code: plugin sandboxes, customer-submitted jobs, research notebooks with shell access, and automated evaluation harnesses. Isolation is no longer optional. This evergreen guide covers practical boundaries for compute, identity,…