Topic starter
15/05/2026 7:52 pm
TL;DR: Static scanners and build-time analysis can flag large volumes of theoretical issues, but they do not show what code actually executes in production, according to Oligo Security. Runtime inspection shifts the question from potential exposure to verifiable risk, making exploitability and live blocking the decisive controls.
Editorial analysis by NHI Mgmt Group, based on content published by Oligo Security: “Cloud Native Security Failures: Why Attackers Still Win”.
Key questions
Q: How should security teams prioritize vulnerabilities in cloud-native applications?
A: Prioritize vulnerabilities by whether they are reachable and exploitable in production, not by scanner volume alone.
Q: What breaks when security tools cannot see runtime execution?
A: When runtime execution is invisible, teams lose the ability to separate theoretical exposure from active risk.
Q: How do teams know if a vulnerability is truly exploitable?
A: They validate it in the live environment using safe testing that shows whether an attacker can reach the condition, trigger it, and move beyond it.
Practitioner guidance
- Prioritise reachable vulnerabilities Score findings by whether the affected function or dependency executes in production, then defer issues that lack runtime evidence until they become reachable.
- Instrument production execution paths Monitor library and function-level activity in live workloads so remediation decisions reflect actual code paths rather than image, manifest, or repo state.
- Use runtime exploit blocking Block malicious behaviour at execution time where the application is processing live requests, tokens, or data instead of waiting for patch cycles.
Bottom line: Static cloud-native scanning is not enough when production execution determines whether a weakness matters.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/05/2026 7:53 pm
Runtime truth is now a governance requirement, not a visibility enhancement. Static tools answer what might be wrong, but production teams need to know what is actually reachable, executable, and exploitable. That shifts the security programme from theoretical coverage to evidence-based prioritisation, which is the only defensible way to allocate remediation effort in cloud-native environments. The practitioner conclusion is that risk ownership belongs to runtime evidence, not scanner volume.
A few things that frame the scale:
- Kubernetes production adoption has surged from 66% in CNCF's 2023 survey to 82% in 2025.
A question worth separating out:
Q: What should teams do when runtime protection can only observe suspicious activity?
A: They should use observation for tuning, but move high-confidence malicious patterns into enforcement. If a threat family is built to survive and hide, passive visibility can arrive too late. The goal is to stop execution before the malware finishes setting up persistence and concealment.
👉 Read our full editorial: Runtime truth for cloud-native security: why scanners still miss risk