Topic
Cloud Security
Cloud-native security spent a decade producing findings and comparatively little time producing enforcement. Scanners generate thousands of CVEs against images nobody can patch, policy engines run in audit mode indefinitely, and the control that would actually have stopped the last incident — verifying that a running artifact is the one your pipeline built — is still unimplemented in most clusters.
The focus here is on controls that change what can execute, not controls that describe what already did. Sigstore and keyless signing wired into admission control, including the rollout sequence that avoids taking production down on day one. eBPF-based runtime monitoring: what it genuinely sees at the syscall boundary, what it costs in CPU, and where the vendor demos are misleading. Service mesh security, evaluated honestly against its latency and operational overhead rather than its feature matrix. The recurring argument is that a control you cannot afford to enforce is not a control.
Articles in Cloud Security
-
A Service Mesh Costs About 15 Percent and Half an Engineer
The honest cost of running a service mesh: p99 latency, sidecar CPU and memory, ambient mode's actual savings, and the four situations where a mesh pays for itself.
-
What eBPF Actually Sees, and What It Costs You
A grounded look at eBPF for runtime security and observability: what the syscall boundary reveals, real CPU overhead numbers, kernel version constraints, and where the vendor demos mislead.
-
Signature Verification Only Counts at Admission Time
Wiring Sigstore keyless signing into Kubernetes admission control with cosign and policy-controller — the rollout sequence, the failure modes, and how to enforce without an outage.