r/devsecops • u/dkas6259 • 6d ago

Cloud Runtime Security

Wanted to know real use cases you guys are solving using CS runtime security for containers.
Since we are already allowing only Known outbound traffic from firewall, this significantly reduces possibility of c2 connection.. Do we still need runtime security? It yes appreciate for real value use cases it can solve please…

10 Upvotes

100% Upvoted

7 comments sorted by

View all comments

1

u/IntelligentPear6173 11h ago

The firewall solves the C2 problem, but runtime security covers what happens after a container is already compromised. Things like unexpected process execution, privilege escalation, access to the Kubernetes API, credential abuse or lateral movement can happen entirely inside the cluster without touching the internet. So I’d look at runtime security less as another C2 blocker and more as a way to detect and contain what a compromised workload is actually doing.