Notifications
Clear all
Topic starter
18/08/2026 2:50 pm
TL;DR: Kubernetes runtime security is shaped less by detection volume than by where enforcement happens, according to ARMO’s comparison with Sweet Security. ARMO’s in-cluster model can turn observed workload behaviour into NetworkPolicies and seccomp profiles, which makes least privilege evidence-based rather than guessed.
NHIMG editorial — based on content published by ARMO: ARMO vs Sweet Security: Why the Cluster Beats the Gateway for Runtime Security
By the numbers:
- 45% of organisations, otation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
Questions worth separating out
Q: How should security teams enforce least privilege for Kubernetes workloads?
A: Security teams should enforce least privilege at the point where the workload actually runs, not only at a gateway or perimeter checkpoint.
Q: Why does gateway-based control fall short for runtime security?
A: Gateway-based control is useful for inspecting traffic, prompts, and routed operations, but it cannot fully govern actions that occur inside the cluster after the request is accepted.
Q: What breaks when runtime policies are guessed instead of observed?
A: Guessed policies often block legitimate periodic jobs, miss unusual but valid service flows, or leave overbroad permissions in place because they were written without behavioural evidence.
Practitioner guidance
- Map enforcement to the workload runtime Decide whether your control point must constrain prompt flow, network flow, or the kernel-level actions of the workload.
- Validate generated policy in audit mode first Run observe-to-enforce tooling in a non-blocking mode long enough to capture low-frequency jobs, batch tasks, and reconciliation workflows.
- Reduce standing runtime permissions Review service accounts and application identities that have access they do not exercise during normal operation.
What's in the full article
ARMO's full blog covers the operational detail this post intentionally leaves for the source:
- A side-by-side breakdown of in-cluster eBPF enforcement versus gateway-based AI enforcement, including where each control point sees workload behaviour.
- Detailed runtime comparison data on 250+ Kubernetes controls, generated NetworkPolicies, and seccomp profile creation from observed behaviour.
- Implementation notes on the observe-to-enforce workflow, including audit mode validation before active blocking.
- How the open-source Kubescape foundation and admission controls fit into production Kubernetes hardening.
👉 Read ARMO's comparison of Kubernetes runtime enforcement models →
Cluster enforcement vs gateway enforcement in Kubernetes runtime?
Explore further
