Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Why do traditional intrusion detection systems fail in Kubernetes? Legacy IDS tools were built for static servers with fixed IPs and clear network perimeters—Kubernetes breaks all of those assumptions. Ephemeral pods, east-west traffic, encrypted service mesh communication, and dynamic IP addresses make perimeter-focused, signature-based detection effectively blind inside clusters.

Why do traditional incident response playbooks break in Kubernetes? Pods spin up and disappear in seconds, destroying forensic evidence before you can investigate. Attackers exploit service account tokens and move laterally through east-west traffic that perimeter tools never see—over 50% of ransomware deploys within 24 hours of initial access, leaving no time for manual investigation methods built for static servers.

Do open source tools give you full Kubernetes attack coverage? Kubescape, Trivy, and Falco each excel in their lane—posture, vulnerabilities, and runtime—but none of them builds a complete attack narrative on its own. Deploying all three still leaves you with evidence fragments rather than a connected incident story. Why can’t siloed alerts keep up with real attacks?

Proactive instead of reactive. Are you tired of hearing that already? This phrase seems to appear in almost every elevator pitch. But when it comes to cybersecurity, anticipating threats is essential. Attackers are more professional, automated, and faster than ever. The damage they cause keeps growing, and the window you have after the first alarm to protect your organization is shrinking.

As more services, communication, and daily activities move online, the amount of personal data being collected continues to grow. So what can we do to make sure that protecting our privacy doesn’t become unmanageable?

As I wrote in my recent book, How AI and Quantum Impacts Cyber Threats and Defenses, as we humans use AI more and more, AI will begin to communicate with itself using new AI-only communication methods that humans cannot easily see or read. If there is no human-readable audit trail or code, this is a very, very bad thing. It must be stopped at all costs. Humans are absolutely beginning to use AI more and more to do things they used to do manually. Soon, we will all be using multiple AI agents.

More than 90% of successful cyberattacks start with email, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). That’s not because security teams lack tools, but because attackers target human decision-making. For years, organizations treated email security as a filtering problem: block enough malicious messages, and risk goes down. That assumption no longer holds.

On May 21, 2019, LinkedIn’s URL shortener went down. The certificate had expired. Millions of people cried out in terror when they couldn’t click on AI link bait. The interesting part: LinkedIn had renewed the certificate ten days earlier. The renewal succeeded. The certificate just never made it to the server. The renewed cert existed somewhere, but the server still served the old one. Most certificate automation is built to prevent the “I forgot to renew” problem.

AI pentesting has been making waves and rivals the power of human hackers in ways we weren’t expecting. But frequently, companies are looking for pentesting to achieve and support their compliance certifications.

Read the takeaways from ConFoo 2026, including putting guardrails where requests happen, auditing tool calls, treat dependency updates like production access.