{"slug": "announcing-wiz-runtime-sensor-add-on-for-gke-turnkey-threat-detection-for", "title": "Announcing Wiz Runtime Sensor add-on for GKE: Turnkey threat detection for Kubernetes", "summary": "Google Cloud and Wiz launched the Wiz Runtime Sensor add-on for Google Kubernetes Engine in preview, a first-party managed platform add-on that provides eBPF runtime threat detection for both Standard and Autopilot GKE clusters. The add-on has GKE handle sensor deployment, credential injection via Secret Manager secret sync, and lifecycle updates, and supports custom organization policy constraints that reject cluster creation when the Runtime Sensor is not enabled. The sensor monitors system calls, running processes, network connections, and file access to catch reverse shells, privilege escalations, container escapes, and unsafe outbound connections, with HTTP and mTLS proxy support for restricted-egress environments.", "body_md": "Everything is moving faster in the age of AI, and that includes security threats. What used to take attackers weeks to exploit can now happen in just a few minutes.\n\nStandard vulnerability scans that run on artifacts at rest can catch basic setup issues, but to detect an attack that's actively happening you need real-time runtime protection.\n\nToday, we’re introducing theWiz Runtime Sensor add-on for Google Kubernetes Engine (GKE), in preview. This built-in integration brings low-touch deployment, automated lifecycle management, enterprise credential security, and fleet-wide governance to Wiz's industry-leading eBPF runtime threat detection for both Standard and Autopilot GKE clusters.\n\nThe operational friction of runtime security\n\nSecurity and platform engineering teams share common dilemmas when deploying in-cluster runtime defenses:\n\nDeployment and lifecycle friction: Deploying runtime agents often requires managing installations from third-party sources across dozens or hundreds of clusters.\n\nCredential sprawl and security risks: Passing and rotating API keys as Kubernetes Secrets introduces administrative overhead and security risk.\n\nFleet-wide enforcement gaps: Platform teams lack built-in policy controls to enforce that every new cluster has runtime sensors enabled before workloads are deployed and start receiving traffic.\n\nPerformance and operational overhead: Without explicit and strategic resource limits, runtime agents can impact how much CPU and memory is available for your workloads and system functionality.\n\nWith the Wiz Runtime Sensor for GKE, Google Cloud and Wiz have minimized these operational barriers. The Runtime Sensor is now available in GKE as a first-party, managed platform add-on.\n\nBridging the gap with Wiz Runtime Sensor for GKE\n\nThe Wiz Runtime Sensor for GKE connects central security and platform engineering workflows by simplifying and automating the sensor lifecycle.\n\nWith the add-on, GKE manages the sensor deployment, credential injection, and lifecycle updates. Building runtime protection directly into the platform reduces administrative overhead and provides the following benefits for your Kubernetes fleet:\n\nNative Secret Manager integration: Security teams no longer need to distribute Wiz API keys across cluster namespaces. The add-on uses GKE's Secret Manager secret sync integration to store your Wiz credentials in an off-cluster, centralized credential vault that only a dedicated service account can access.\n\nGKE automatically retrieves the credentials and injects them directly into the Runtime Sensor pods. Updating a key in Secret Manager automatically syncs to the sensor without requiring cluster restarts or manual intervention.\n\nSimplified enablement: After you add your Wiz credentials to Secret Manager, platform operators can enable the Runtime Sensor add-on by using the gcloud CLI or the GKE API. The GKE control plane handles deploying the sensor components, managing the lifecycle of pods, and configuring the nodes.\n\nSecure egress and proxy support: For environments that restrict public internet access, the managed sensor supports standard HTTP and mTLS proxy configurations. Telemetry is routed back to Wiz without violating your egress firewall policies.\n\nFleet-wide governance with organization policy: Platform security leads can enforce compliance across their entire organization using custom organization policy constraints. You can use a constraint to reject any attempts to create a cluster that doesn't enable the Runtime Sensor add-on, which can prevent malicious actors from spinning up rogue infrastructure to evade runtime detection.\n\nKernel-level observability with minimal overhead: The Wiz Runtime Sensor continuously monitors system calls, running processes, network connections, and file access. It catches suspicious activity, including reverse shells, unauthorized privilege escalations, container escapes, and unsafe outbound connections while keeping CPU usage low even under heavy workload activity.\n\nThe sensor uses a fixed memory limit on each node to ensure consistent performance as workload density changes. This is especially valuable for AI workloads and web services where application activity might fluctuate quickly.\n\nIndependent auto-updates: Security threats and zero-day vulnerabilities don’t wait for scheduled infrastructure maintenance windows. The lifecycle of the Wiz sensor add-on for GKE is independent of your GKE cluster and node lifecycle.\n\nThe sensor periodically rolls out updates of new sensor versions published by Wiz, to help ensure that your clusters always have the latest detection rules without requiring GKE version bumps, node pool recreations, or workload disruption.\n\nHow it works: Deploying and enforcing the sensor\n\nEnabling the Wiz sensor add-on follows the same process that platform administrators are already familiar with on GKE. Using standard gcloud commands, you can activate runtime protection during cluster creation, turn it on for existing clusters, and enforce it across your fleet while keeping credentials securely managed in Secret Manager.\n\nCheck the setup documentation for prerequisites, such as granting GKE access to Secret Manager.\n\nProvisioning a cluster with the Wiz Sensor add-on\n\nTo provision a new GKE cluster with the managed Wiz sensor enabled using credentials stored in Secret Manager:\n\nTo enable the sensor on an existing running cluster with Workload Identity Federation for GKE and Secret Manager secret sync enabled, run the following:\n\nEnforcing fleet-wide protection with organization policy\n\nYou can require all new GKE clusters across your organization to install the runtime sensor by deploying a custom constraint:\n\ncode_block\n\n)])]>\n\nIntelligent threat correlation for AI security\n\nThe true power of this integration emerges when the managed sensor connects to the broader Wiz AI Application Protection Platform (AI-APP). By feeding GKE runtime telemetry into the Wiz Security Graph, you unlock a security toolkit that goes beyond static alerting, with:\n\nReal-time risk assessment and threat verification: By pairing background security scans with live activity monitoring, you get a clear view of real risks. The sensor checks whether vulnerable code is actually running in memory, so you can focus on active security threats and ignore inactive ones.\n\nReal-time threat detection and response: Identify suspicious activity like malware, unauthorized access attempts, and software vulnerabilities in real time. Security teams can set rules to automatically block or stop threats before they can spread.\n\nNetwork activity and detailed security insights: Track system activity, network connections, and data flows to uncover hidden risks and unauthorized software usage. If a threat is detected, the sensor automatically gathers diagnostic data to help teams quickly investigate what happened.\n\nTogether, these capabilities ensure that mission-critical applications and AI agents deployed on GKE are monitored for attacks and data exfiltration without compromising developer velocity.\n\nGet started today\n\nThe Wiz Runtime Sensor add-on for GKE delivers a standard for container security: deep, kernel-level eBPF protection without operational complexity or deployment friction.\n\nBy combining GKE's managed platform automation with Wiz's comprehensive security intelligence, platform and security teams can innovate at cloud speed while maintaining strong runtime defense. Check out the Wiz Sensor for GKE documentation to learn more.", "url": "https://wpnews.pro/news/announcing-wiz-runtime-sensor-add-on-for-gke-turnkey-threat-detection-for", "canonical_source": "https://cloud.google.com/blog/products/identity-security/wiz-sensor-for-gke-turnkey-threat-detection-for-kubernetes/", "published_at": "2026-10-16 16:00:00+00:00", "updated_at": "2026-10-16 16:19:00.826317+00:00", "lang": "en", "topics": ["ai-infrastructure", "developer-tools"], "entities": ["Wiz", "Google Cloud", "Google Kubernetes Engine", "Wiz Runtime Sensor", "Secret Manager", "gcloud CLI", "GKE API"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/announcing-wiz-runtime-sensor-add-on-for-gke-turnkey-threat-detection-for", "markdown": "https://wpnews.pro/news/announcing-wiz-runtime-sensor-add-on-for-gke-turnkey-threat-detection-for.md", "text": "https://wpnews.pro/news/announcing-wiz-runtime-sensor-add-on-for-gke-turnkey-threat-detection-for.txt", "jsonld": "https://wpnews.pro/news/announcing-wiz-runtime-sensor-add-on-for-gke-turnkey-threat-detection-for.jsonld"}}