Wiz AMA Recap: Key Container and Kubernetes Security Challenges
Summary
Wiz’s container security AMA recap recommends scanning images before deployment, enforcing trusted-image controls, and securing Kubernetes permissions, runtime, control planes, and tenant isolation. It also discusses risks to AI workloads and cloud visibility.
Key points
- Scan container images before deployment for vulnerabilities, malware, and exposed secrets.
- Use signed and verified images or restrict deployments to approved registries with deny-by-default controls.
- Misconfigured Kubernetes RBAC, limited control-plane visibility, and weak namespace isolation can create security gaps.
- Ephemeral workloads make runtime monitoring challenging; the article recommends continuous protection across development, deployment, and runtime.
- The AMA highlights AI workload risks, including vendor multi-tenancy issues and malicious models, and references several Wiz-reported vulnerabilities and exposures.
- For cloud visibility, the article recommends agentless API-driven monitoring alongside agent-based coverage and runtime controls where appropriate.
Article Details
- Topic
- Container security challenges and guidance, including Kubernetes security, AI workloads, and cloud visibility.
CVE
People
Vendors
Hugging FaceOur work with AI-as-a-service providers Hugging Face and Replicate revealed that malicious models pose a major risk to AI systems and customer data in particular.NvidiaA critical NVIDIA AI vulnerability that affected containers using NVIDIA GPUs, including over 35% of cloud environments.ReplicateOur work with AI-as-a-service providers Hugging Face and Replicate revealed that malicious models pose a major risk to AI systems and customer data in particular.SAPSAPwned, vulnerabilities in SAP AI Core that would allow malicious actors to take over the services and access customer data by exposing cloud environments and private AI artifacts.WizWiz recommends a multi-layered approach here. All container images should be scanned before deployment to detect CVEs, malware, and exposed secrets. Organizations should enforce deployment controls by using signed and
Products
DeepSeekDeepLeak, an exposed DeepSeek database leaking sensitive information – including chat history and over a million lines of log streams – and allowing full control over database operations. (Note that we found this afterKubernetessubreddit for a container security AMA and wow, what great questions from the community! We talked Kubernetes, cloud misconfigurations, AI, and IAM. It was clear that as more and more workloads move to KubernetesOllamaProbllama, an easy-to-exploit Remote Code Execution vulnerability in the open-source AI infrastructure project Ollama.SAP AI CoreSAPwned, vulnerabilities in SAP AI Core that would allow malicious actors to take over the services and access customer data by exposing cloud environments and private AI artifacts.Wiz Cloudemphasized both agentless and agent-based coverage. The former is where Wiz has its roots, and how our Wiz Cloud offering matured into what is now a near real-time CSPM via agentless scanning. Agent-based coverage is