Kubernetes Runtime Detections
Path: /k8s-posture → Runtime · Sidebar: Testing → K8s Posture
Beyond static posture, apPosture surfaces runtime threat detections inside the cluster - what's actually happening, not just how it's configured.
What it detects
Suspicious in-cluster behaviour (Falco / eBPF-style signals):
- Shell in a container / unexpected
execinto a pod. - Sensitive file reads (
/etc/shadow, service-account tokens). - Outbound connections to unexpected destinations.
- Privilege escalation / writes to sensitive host paths.
- Crypto-mining / known-bad process patterns.
Posture vs Runtime
| Posture | Runtime | |
|---|---|---|
| Question | "Is the cluster configured securely?" (CIS) | "Is something malicious happening now?" |
| Source | Manifests, RBAC, network policies, images | Live syscall/behaviour signals |
| Output | Misconfiguration findings | Detection events with severity + context |
Together they give both the attack surface (posture) and active threats (runtime), correlated into the unified findings and the application's posture.
Why it matters
A cluster can be perfectly configured and still be compromised at runtime. Pairing posture with runtime closes the gap between "secure by design" and "secure right now" - and feeds real signals into prioritisation and the Attack Map.