Field notes
Cover: rootless nodes shrink the blast radius of container breakouts by keeping node components out of host root. Kubernetes v1.37 promotes KubeletInUserNamespace—better known as rootless mode—to beta. For platform and security teams, that is more than…
Late 2026 vendor conversations increasingly include attestations: provenance for builds, signed artifacts, SBOMs, and response SLAs when a dependency is exploited. Buyers who cannot articulate requirements receive marketing PDFs instead of verifiable controls. This guide outlines…
Security metrics fail when they optimize for auditor comfort instead of executive decisions. Patch lag charts nobody reads, vulnerability counts without exposure context, and red/green compliance tiles create calm while risk concentrates in a few internet-facing…
Kubernetes security conversations in 2026 increasingly emphasize stronger node isolation: pod user namespaces, rootless-friendly node designs, tighter kubelet authorization, and workload identity that does not lean on overly powerful node roles. Operators do not need to…
Advanced detection stacks are useless if mundane authentication logs are missing, short-lived, or unqueryable. Most lateral movement still leaves footprints in identity systems: unusual logon types, impossible travel between VPN and cloud consoles, new MFA device…
September Patch Tuesday arrives while many teams are still clearing August debt and preparing for autumn freezes. Mixed Windows and Linux estates make prioritization harder: domain controllers, browser engines, container runtimes, and kernel CVEs compete for…
Credential rotation at scale fails when it is treated as a heroic weekend project. Cloud keys, registry tokens, bot accounts, webhook secrets, and workload identities accumulate until a breach forces simultaneous rotation—and then production stalls because…
Build agents and data-science hosts are prolific network clients. They pull packages, container images, datasets, and model weights—and they often run with credentials that can reach production object storage or cloud APIs. Without egress controls, a…
Internal developer platforms—artifact registries, webhook testers, preview environments, documentation importers, and MLOps-adjacent tools—often fetch URLs on behalf of users. That design convenience is also a classic server-side request forgery (SSRF) path to cloud metadata services and…
Build servers and CI control planes are crown jewels: they hold repository credentials, cloud deploy roles, signing keys, and the power to ship arbitrary artifacts into production. Critical remote-code-execution classes against CI products have repeatedly shown…