cyber.hendryadrian.com
Security News · wiz.io

Wiz Runtime Sensor Add-On for GKE Brings Managed Runtime Protection to Preview

· Original article ↗

Summary

Wiz and Google Cloud announced a Preview GKE add-on that manages Wiz Sensor deployment, credentials, and updates, with eBPF runtime monitoring, organization-wide policy controls, and alerts enriched with Kubernetes and cloud context.

Key points

  • The Wiz Runtime Sensor add-on is in Preview for GKE Standard and GKE Autopilot clusters.
  • GKE manages sensor deployment, credential injection, and lifecycle updates; teams can enable it through the console or a gcloud flag.
  • The integration uses Secret Manager and Workload Identity Federation to keep API keys and pull tokens off-cluster and resynchronize rotated secrets.
  • Custom Google Cloud Organization Policies can require runtime protection and block creation of unprotected clusters.
  • The sensor uses eBPF to monitor system calls, processes, and network sockets, with stated fixed per-node resource limits.
  • Wiz says runtime alerts include pod, namespace, image, and execution context, enriched with container, Kubernetes, and GCP security posture.

Article Details

Event Type
Preview launch of the Wiz Runtime Sensor add-on as a native, managed integration for Google Kubernetes Engine (GKE).
Impact
The integration enables runtime threat monitoring on GKE Standard and Autopilot clusters, with GKE-managed deployment, credential injection, and lifecycle updates. It detects behaviors such as reverse shells, privilege escalation attempts, and suspicious binary execution, and surfaces alerts enriched with workload and cloud context. The article describes product capabilities and does not report a specific security incident or victim impact.

Vendors

Google CloudToday, Google Cloud and Wiz are excited to introduce the Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE) in Preview.WizThe Wiz approach starts with agentless scanning, to build a continuous, full-stack view of your environment through the Security Graph. By correlating vulnerabilities with network exposure, identity permissions, and

Products

GCEand Organization Policy governance to serverless workloads in Google Cloud Run and virtual machines (GCE), offering WizOS Hardened Images for pre-installed container and Helm chart security, and deliveringGoogle Artifact RegistryArtifact Registry Visibility and Scans: Automatically discover and continuously scan Google Artifact Registry (GAR) images for newly disclosed CVEs, even behind VPC Service Controls.Google Cloud BuildFull Lifecycle Container ProtectionStart in CI/CD: Scan Dockerfiles, application code, and IaC templates in Google Cloud Build pipelines using the Wiz CLI.Google Cloud Runby extending 1-click sensor deployment and Organization Policy governance to serverless workloads in Google Cloud Run and virtual machines (GCE), offering WizOS Hardened Images for pre-installed container and HelmGoogle Kubernetes EngineToday, Google Cloud and Wiz are excited to introduce the Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE) in Preview.Wiz Admission ControllerDeploy-Time Gatekeeping: The Wiz Admission Controller intercepts GKE deployment requests to verify image signatures and enforce immutable digest pinning, stopping unverified or vulnerable images before pods launch.Wiz CLIFull Lifecycle Container ProtectionStart in CI/CD: Scan Dockerfiles, application code, and IaC templates in Google Cloud Build pipelines using the Wiz CLI.Wiz Portalflags the event instantly. Within seconds, a high-fidelity alert surfaces on the Threats page in the Wiz Portal, highlighting the exact pod, namespace, container image, and execution context.Wiz Runtime SensorToday, Google Cloud and Wiz are excited to introduce the Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE) in Preview.Wiz Security GraphThe Wiz Security Graph correlates risk factors, such as an internet-facing GKE pod bound via Workload Identity to an over-permissioned GCP Service Account (roles/storage.admin).

Related Articles