Kubernetes security explained: protecting clusters from build to runtime

Key insights

  • Kubernetes is not secure by default. Organizations must actively configure RBAC, network policies, secrets encryption, and audit logging. Clusters face attack attempts within minutes of creation.
  • Misconfigurations remain the leading cause of breaches. Over 50% of organizations cite misconfigurations as their top Kubernetes security concern, and 67% have delayed deployments due to security issues (Red Hat 2024).
  • Security must span the full lifecycle. The 4 Cs model (Cloud, Cluster, Container, Code) and build-deploy-runtime phases provide complementary frameworks for layered defense.
  • Prevention alone is insufficient. With 90% of organizations still experiencing incidents despite adopting best practices, behavioral threat detection and network-level visibility fill the critical gap between configuration hardening and active threat response.
  • The eBPF-based tooling stack is becoming the standard. Falco, Tetragon, and Cilium deliver runtime security with less than 1% CPU overhead, enabling detection without performance compromise.

When Tesla discovered attackers running cryptomining operations inside its Kubernetes clusters in 2018, the root cause was startlingly simple: an exposed dashboard with no password. Years later, the same category of misconfiguration continues to plague organizations at scale. Ninety percent of organizations experienced at least one Kubernetes security incident in the past 12 months (Red Hat 2024), and new clusters face their first attack attempt within 18 minutes of deployment (Wiz 2025). With the container and Kubernetes security market projected to grow from $1.7 billion in 2024 to $8-9 billion by 2030-2033, the urgency to secure these environments has never been greater. This guide covers the full spectrum of kubernetes security, from foundational models and lifecycle best practices to behavioral threat detection and cloud security strategies that address today's most sophisticated attacks.

What is Kubernetes security?

Kubernetes security is the set of practices, tools, and policies that protect containerized workloads and their orchestration infrastructure across the entire application lifecycle — from image building through deployment and runtime operation. It encompasses configuration hardening, access control (RBAC), network segmentation, secrets management, runtime threat detection, and compliance monitoring across the control plane, worker nodes, container images, network traffic, and configuration layers.

Why does this matter? Kubernetes is not secure by default. The platform prioritizes flexibility and developer velocity over hardened security in its default configuration. Organizations must actively configure role-based access control (RBAC), network policies, secrets encryption, Pod Security Standards, and audit logging before a cluster is production-ready. According to the Kubernetes security concepts documentation, the shared responsibility model places the burden of security configuration squarely on the operator.

The business impact of getting this wrong is severe. Sixty-seven percent of organizations delayed or slowed deployments due to Kubernetes security concerns, 46% experienced revenue or customer loss, and 30% were fined (Red Hat 2024). The expanding attack surface of a Kubernetes cluster spans the API server, etcd data store, kubelet, container runtime, network overlay, and every workload running within it.

How Kubernetes security differs from container security

Container security focuses on individual container images, runtimes, and isolation mechanisms. Kubernetes security adds orchestration-layer concerns that go beyond any single container. These include API server access controls, RBAC policies governing who can do what across the cluster, inter-pod and inter-namespace communication governed by network policies, secrets management and encryption at rest, admission controllers that validate workloads before deployment, and cluster-wide configuration such as audit logging and Pod Security Standards.

A hardened container image deployed into a misconfigured cluster remains vulnerable. Kubernetes security addresses the infrastructure that surrounds, connects, and orchestrates those containers.

The Kubernetes threat landscape

Misconfigurations cause most Kubernetes breaches, but targeted attacks using lateral movement and privilege escalation are rising sharply. Over 50% of respondents in the Red Hat 2024 report cited misconfigurations as the leading cause of Kubernetes security incidents. The breakdown of top security concerns tells a clear story: vulnerabilities (33%), misconfigurations and exposures (27%), active attacks (24%), and failing compliance audits (16%).

Compounding this, 81% of EKS clusters still rely on deprecated CONFIG_MAP authentication (Wiz 2025), creating a legacy risk that attackers actively exploit. Container-based lateral movement attacks increased 34% in 2025 (Tigera), reflecting a shift from opportunistic misconfiguration exploitation to deliberate post-compromise operations.

Real-world Kubernetes security incidents

These dated, sourced case studies demonstrate the consequences of inadequate kubernetes security and the lessons each incident provides.

  1. Tesla cryptomining breach (2018). Attackers discovered Tesla's Kubernetes dashboard exposed to the internet without password protection. They deployed cryptomining containers, throttled resource usage to avoid detection, and routed traffic through Cloudflare to mask their activity. Lesson: Never expose Kubernetes dashboards or API endpoints without authentication. Default-deny access policies prevent the most common initial access vector. (Aikido Security)
  2. Financial organization breach (July 2019). A firewall misconfiguration exposed a financial institution's Kubernetes clusters to the public internet. Attackers exfiltrated 30 GB of credit application data. Lesson: Network segmentation and strict firewall rules must be applied to clusters handling sensitive data, particularly under PCI DSS requirements. (CrowdStrike)
  3. 350-organization mass exposure (August 2023). Security researchers discovered Kubernetes clusters belonging to over 350 organizations, including Fortune 500 companies, were publicly accessible due to two common misconfigurations. Lesson: Automated scanning with tools like kube-bench catches exposed clusters before attackers find them. (CrowdStrike)
  4. RBAC Buster campaign (2023-2024). Attackers exploited misconfigured Kubernetes API servers accepting unauthenticated anonymous requests. They implemented malicious RBAC policies, created persistent backdoors, and deployed cryptocurrency mining operations. Lesson: Audit RBAC policies regularly, disable anonymous API access, and use admission controllers to prevent overly permissive role creation. (Picus Security)
  5. OpenMetadata exploitation (April 2024). Threat actors exploited critical vulnerabilities in OpenMetadata (SpEL injection combined with authentication bypass) to gain unauthorized access to Kubernetes workloads for cryptocurrency mining. Microsoft Threat Intelligence confirmed active exploitation. Lesson: Patch management must cover all workloads running on Kubernetes, not just Kubernetes itself. Third-party applications deployed in clusters can become entry points. (CheckRed)
  6. Dero cryptojacking campaign (2024). Attackers exploited anonymous access to internet-facing Kubernetes API servers to deploy malicious container images from Docker Hub for Dero cryptocurrency mining. Lesson: Disabling anonymous API access and implementing admission controllers to restrict image sources prevents unauthorized container deployment.
  7. TeamPCP worm (February 2026). The TeamPCP group deployed a Kubernetes-specific payload (kube.py) that enumerates pods and namespaces, executes commands across accessible workloads, and installs a privileged DaemonSet for persistent cluster-wide control. At least 185 servers were confirmed compromised. The campaign targets AWS and Azure environments for cryptocurrency mining, data theft, and ransomware deployment. Lesson: A single compromised pod can convert an entire cluster into a distributed botnet. Behavioral detection of anomalous DaemonSet deployments and east-west traffic patterns is essential. (The Hacker News, eSecurity Planet)

MITRE ATT&CK containers matrix mapping

The MITRE ATT&CK framework provides a shared language for mapping Kubernetes threats to security controls. The following table maps key tactics from the MITRE ATT&CK containers matrix to specific Kubernetes security controls.

Table 1: MITRE ATT&CK containers matrix mapped to Kubernetes security controls

Tactic Technique ID Key techniques Kubernetes security control
Initial Access TA0001 T1190 Exploit public-facing application, T1078 Valid accounts API server hardening, RBAC, network isolation
Execution TA0002 T1609 Container administration command, T1610 Deploy container Admission controllers, RBAC, audit logging
Persistence TA0003 T1525 Implant internal image, T1078 Valid accounts Image signing, registry security, token rotation
Privilege Escalation TA0004 T1611 Escape to host, T1068 Exploitation for privilege escalation Pod Security Standards, security contexts, patching
Defense Evasion TA0005 T1562 Impair defenses, T1036 Masquerading Admission controllers, audit logging, immutable containers
Credential Access TA0006 T1528 Steal application access token, T1552 Unsecured credentials Secrets encryption, token binding, OIDC
Discovery TA0007 T1613 Container and resource discovery RBAC, network policies, namespace isolation
Lateral Movement TA0008 T1550 Use alternate authentication material Network policies, microsegmentation, NDR
Impact TA0040 T1496 Resource hijacking, T1485 Data destruction Resource limits, monitoring, backup procedures

The 4 Cs of Kubernetes security

The 4 Cs model provides a layered defense framework where each security layer depends on the integrity of the layer below it. This model, widely adopted across the industry, organizes Kubernetes security into four nested layers.

  1. Cloud — infrastructure-level controls including network firewalls, IAM policies, encryption in transit, and provider-specific hardening for AWS, Azure, or GCP
  2. Cluster — API server hardening, RBAC with least privilege, admission controllers (OPA/Gatekeeper, Kyverno), etcd encryption at rest, audit logging, and network security policies
  3. Container — image scanning with Trivy or Grype, base image hardening, rootless containers, security contexts, and Pod Security Standards enforcement
  4. Code — dependency scanning, secrets-in-code detection, SAST/DAST integration, and supply chain security verification with cosign/Sigstore

Each layer builds on the one beneath it. A perfectly hardened container image provides limited protection if the cluster it runs in allows anonymous API access. Similarly, rigorous cloud security configurations lose their value if the code running inside containers contains hardcoded secrets or vulnerable dependencies.

Kubernetes security best practices by lifecycle phase

Effective Kubernetes security requires controls at every lifecycle phase, with runtime detection filling the gaps that build-time scanning cannot address. The following practices, organized across build, deploy, and runtime phases, provide a comprehensive kubernetes security checklist aligned with the OWASP Kubernetes Security Cheat Sheet.

Build phase

  1. Scan container images continuously with Trivy or Grype in CI/CD pipelines
  2. Block deployments with known critical CVEs using admission controllers
  3. Use minimal, hardened base images (Docker now offers 1,000+ free hardened images under Apache 2.0)
  4. Sign and verify images with cosign/Sigstore for supply chain security
  5. Generate software bills of materials (SBOMs) for runtime environments

Deploy phase

  1. Enable RBAC with least privilege. RBAC (role-based access control) regulates access to Kubernetes resources based on assigned roles. Never use cluster-admin for default service accounts.
  2. Encrypt secrets at rest using etcd encryption or external secrets managers such as HashiCorp Vault or AWS Secrets Manager. Kubernetes etcd stores all cluster data, including secrets and configuration, making its encryption critical.
  3. Implement admission controllers. Admission controllers intercept API requests before objects are persisted, enabling validation and mutation of workload configurations. OPA/Gatekeeper and Kyverno are the leading policy engines.
  4. Enforce Pod Security Standards with the "Restricted" profile for production namespaces, replacing the deprecated Pod Security Policies removed in Kubernetes v1.25.
  5. Implement default-deny network policies for both ingress and egress traffic, enforcing zero trust security principles at the network layer.
  6. Keep Kubernetes updated. Fifty-four percent of clusters now run supported Kubernetes versions, up from 42% (Wiz 2025).

A Kubernetes security context defines privilege and access control settings for a pod or container. These settings include running as a non-root user, dropping Linux capabilities, setting read-only root filesystems, and defining seccomp profiles. Applying security contexts consistently across all workloads prevents many common privilege escalation paths.

Runtime phase

  1. Enable audit logging and stream logs to a SIEM for anomaly detection
  2. Deploy eBPF-based runtime security (Falco, Tetragon) for behavioral detection
  3. Secure the API server by disabling anonymous authentication, restricting network access, and enabling TLS
  4. Monitor east-west traffic for lateral movement indicators
  5. Implement resource limits to prevent resource hijacking such as cryptomining

Runtime security in Kubernetes is the practice of monitoring and protecting workloads after they are deployed. Unlike build-time scanning, which catches known vulnerabilities before deployment, runtime security detects active threats, anomalous behavior, and zero-day exploits in live clusters. Organizations with advanced DevSecOps initiatives (42% of respondents) complement build-time prevention with runtime detection (Red Hat 2024).

Key Kubernetes security tools and technologies

The eBPF-based security stack (Falco, Tetragon, Cilium) is becoming the standard for Kubernetes runtime detection with minimal performance impact. The following tools represent the leading open-source options across scanning, policy enforcement, and runtime detection categories.

Open-source tools

Table 2: Kubernetes security tools comparison

Tool Type CNCF status Key capability Overhead
Falco Runtime detection Graduated System call monitoring, threat detection via eBPF <1% CPU
Trivy Vulnerability scanner Community Image, filesystem, and Kubernetes scanning Build-time only
Kubescape Posture management Incubating Posture management, vulnerability scanning, eBPF detection <1% CPU
OPA/Gatekeeper Policy engine Graduated (OPA) Admission control, policy enforcement Minimal
Kyverno Policy engine Incubating Kubernetes-native policy management Minimal
kube-bench Compliance Community CIS Kubernetes Benchmark assessment On-demand

Kubescape has reached CNCF Incubating status and is used by over 25,000 companies across 100,000+ cloud environments (CNCF 2025), making it the first Kubernetes security scanner accepted into the CNCF.

eBPF-based runtime security

Extended Berkeley Packet Filter (eBPF) enables kernel-level observability and enforcement with less than 1% CPU overhead (Tetragon), transforming how organizations approach Kubernetes runtime security. Key eBPF-based tools include:

  • Tetragon (Cilium project) provides security observability and runtime enforcement at the kernel level
  • Cilium delivers network policy enforcement, microsegmentation, and service mesh capabilities using eBPF
  • Falco (with eBPF driver) performs system call monitoring for runtime threat detection

The recommended open-source stack of Kubescape, Falco, Trivy, and Cilium delivers comprehensive kubernetes security scanning and detection at 1-2.5% total CPU overhead. This efficiency makes eBPF-based security viable for production workloads where performance budgets are constrained. For organizations looking to evaluate their existing tooling, NDR tools and intrusion detection and prevention systems complement eBPF-based detection with network-level visibility.

Detecting and responding to Kubernetes threats

Behavioral threat detection and network-level visibility fill the critical gap between prevention-only tools and the active threats targeting Kubernetes clusters. Configuration scanning and policy enforcement are necessary but insufficient. They prevent known bad configurations but cannot detect active attackers who have bypassed prevention controls.

Lateral movement in Kubernetes

Kubernetes defaults to a flat network where any pod can communicate with any other pod. This makes lateral movement detection critical. Attackers exploit this by moving pod-to-pod within a namespace, escalating namespace-to-namespace across the cluster, and accessing cloud metadata services from within compromised pods.

The TeamPCP worm (February 2026) demonstrated this pattern at scale. A single pod foothold enabled the group to enumerate the entire cluster, execute commands across workloads, and deploy a privileged DaemonSet that converted the cluster into a distributed botnet, compromising at least 185 servers (eSecurity Planet). With container-based lateral movement attacks rising 34% in 2025, the ability to detect anomalous east-west traffic patterns is no longer optional.

Behavioral threat detection for Kubernetes

Behavioral threat detection focuses on identifying anomalous patterns rather than matching known signatures. In Kubernetes environments, these patterns include unusual API calls, unexpected pod-to-pod communication, credential access anomalies, and resource hijacking indicators.

The Kubernetes telemetry vulnerability disclosed in January 2026 illustrates why this approach matters. Researchers discovered that the nodes/proxy GET RBAC permission, commonly granted to monitoring tools, can be abused to execute arbitrary commands inside pods via the Kubelet API. Kubernetes classified this as "working as intended" and will not issue a patch. The only defense is detecting anomalous exec operations from monitoring service accounts (The New Stack) — a textbook use case for behavioral analysis and threat hunting.

Detection methods for Kubernetes threats include:

  • Behavioral analysis of API call patterns and workload behavior
  • East-west traffic monitoring for anomalous pod-to-pod communication
  • Anomalous API call detection for unauthorized resource access
  • Credential access pattern analysis for token theft or misuse
  • Resource hijacking indicators such as unexpected CPU or memory spikes

NDR and network visibility in Kubernetes

No top-ranking Kubernetes security guide discusses how network detection and response (NDR) integrates with Kubernetes security — a significant blind spot given that network-level visibility detects threats that configuration-based tools miss entirely.

NDR provides east-west traffic visibility inside Kubernetes clusters, identifying anomalous communication patterns such as pods reaching unexpected services, unusual data volumes between namespaces, and data exfiltration attempts through lateral channels. This complements configuration scanning and policy enforcement with active threat detection at the network level, addressing the detection gap that allows 90% of organizations to still experience incidents despite adopting kubernetes security best practices.

Kubernetes security posture management and compliance

KSPM provides continuous compliance visibility, and mapping Kubernetes controls to regulatory frameworks is now essential for enterprise adoption. Kubernetes security posture management (KSPM) continuously assesses cluster configurations against security baselines, identifying misconfigurations, policy violations, and compliance gaps in real time.

What is KSPM?

KSPM tools such as Kubescape, Wiz, Prisma Cloud, and Sysdig provide continuous assessment of Kubernetes cluster configurations against security baselines including CIS benchmarks, Pod Security Standards, and custom organizational policies. The CIS Kubernetes Benchmark, assessed by kube-bench, remains the most widely adopted baseline for cluster hardening. The OWASP Kubernetes Top 10 provides a prioritized risk framework covering insecure workload configuration (K01), supply chain vulnerabilities (K02), overly permissive RBAC (K03), policy enforcement gaps (K04), and inadequate logging (K05) through vulnerable components (K10). An updated version is currently in progress for 2025.

Compliance mapping for regulated industries

The NSA/CISA Kubernetes Hardening Guide v1.2 (August 2022) remains the authoritative government reference for Kubernetes security, covering supply chain risks, malicious threat actors, and insider threats. Compliance automation is intensifying in 2026, with organizations now required to demonstrate continuous compliance through automated evidence collection rather than periodic manual assessments (Veeam).

Table 3: Kubernetes security controls mapped to major regulatory frameworks

Control area HIPAA PCI DSS SOC 2 NIST 800-53
Access control (RBAC) Required (164.312(a)) Req 7 CC6.1 AC-2, AC-3
Encryption at rest Required (164.312(a)(2)(iv)) Req 3 CC6.1 SC-28
Encryption in transit Required (164.312(e)) Req 4 CC6.1 SC-8
Audit logging Required (164.312(b)) Req 10 CC7.2 AU-2, AU-3
Network segmentation Recommended Req 1 CC6.6 SC-7
Vulnerability management Required (164.308(a)(5)) Req 6 CC7.1 RA-5
Incident response Required (164.308(a)(6)) Req 12 CC7.3 IR-1, IR-4

SBOM requirements are evolving as OMB M-26-05 shifted to a risk-based approach in January 2026. Cloud service providers must now provide SBOMs of runtime production environments upon request, driving integration of SBOM generation into Kubernetes CI/CD pipelines.

Modern approaches to Kubernetes security

Kubernetes security is maturing rapidly with eBPF-based tooling, platform hardening, and the shift from prevention-only to detection-driven defense strategies. Several developments in 2025-2026 are reshaping how organizations approach kubernetes security architecture.

Platform hardening is accelerating. Six major security features reached stable status in Kubernetes v1.32-v1.35 during 2025, including Bound ServiceAccount Token Improvements, Sidecar Containers, Recursive Read-Only Mounts, Selector-Based Authorization, Anonymous Request Restrictions, and Ordered Namespace Deletion. Eight more features are expected to graduate in 2026, including user namespaces, Pod certificates for mTLS, and image pull authorization (CNCF 2025).

Critical infrastructure transitions demand attention. Ingress-NGINX reaches end-of-life in March 2026, with no further releases, bugfixes, or security patches after that date. The Kubernetes Security Response Committee recommends migrating to Gateway API (Kubernetes Blog). Organizations maintaining legacy Ingress-NGINX controllers face unpatched vulnerability exposure.

Market validation is at an all-time high. Google's $32 billion acquisition of Wiz, the largest-ever cybersecurity acquisition, validates the cloud-native security market and signals that kubernetes security tools and platforms are a strategic priority for the industry's largest players (The Register).

DevSecOps adoption is accelerating. Forty-two percent of organizations now report advanced DevSecOps initiatives, with 48% in early stages (Red Hat 2024). This shift from bolt-on security to integrated security practices is reducing the gap between development velocity and security coverage.

How Vectra AI approaches Kubernetes security

Vectra AI's approach to Kubernetes security centers on behavioral threat detection and Attack Signal Intelligence. Rather than relying solely on configuration scanning and policy enforcement, Vectra AI monitors network traffic patterns across hybrid cloud environments, including east-west traffic within Kubernetes clusters, to detect the behavioral indicators of active attacks. This approach is grounded in the assume-compromise philosophy: smart attackers will eventually bypass prevention controls, so detecting their post-compromise behavior — including lateral movement, privilege escalation, and data exfiltration — is what reduces actual risk. By delivering network detection and response that complements configuration-based tools, organizations gain the visibility needed to identify threats that prevention alone cannot stop.

Related cybersecurity fundamentals

FAQs

What is Kubernetes security?

Is Kubernetes secure by default?

What are the 4 Cs of Kubernetes security?

What tools are used for Kubernetes security?

What is KSPM?

How does Kubernetes handle network security?

What is the OWASP Kubernetes Top 10?