Skip to content

AI Gave Every Attacker a Kubernetes Playbook. Isovalent Takes It Away - PSOSEC-2345#

Cisco Live US 2026 (Las Vegas) digest Program Adjacent pick Las Vegas · 31 May – 4 June 2026

Abstract

Duffie Cooley (Cisco)

  • Why: A PSO product pitch, but the underlying pattern — identity-aware (not IP-aware) network policy in K8s — is core to where this PM's cloud-native-security interests are heading.
  • What: Demonstration of replacing IP-based K8s network policy with identity-aware enforcement via Cilium, plus process-level visibility and nano-segmentation via Isovalent Runtime Security, integrated with Splunk ES for ATT&CK-mapped detections (from abstract only).
  • How: eBPF-based enforcement keyed to workload identity rather than IP/pod-label matching, catching east-west traffic that IP policies miss in ephemeral environments.
  • Where applicable: Cilium/Isovalent-specific; the identity-based-policy concept generalizes, but the specific enforcement is tied to this stack.