Announcing Wiz Runtime Sensor add-on for GKE: Turnkey threat detection for Kubernetes

Google Cloud and Wiz launched the Wiz Runtime Sensor add-on for Google Kubernetes Engine in preview, a first-party managed platform add-on that provides eBPF runtime threat detection for both Standard and Autopilot GKE clusters. The add-on has GKE handle sensor deployment, credential injection via Secret Manager secret sync, and lifecycle updates, and supports custom organization policy constraints that reject cluster creation when the Runtime Sensor is not enabled. The sensor monitors system calls, running processes, network connections, and file access to catch reverse shells, privilege escalations, container escapes, and unsafe outbound connections, with HTTP and mTLS proxy support for restricted-egress environments.

Everything is moving faster in the age of AI, and that includes security threats. What used to take attackers weeks to exploit can now happen in just a few minutes. Standard vulnerability scans that run on artifacts at rest can catch basic setup issues, but to detect an attack that's actively happening you need real-time runtime protection. Today, we’re introducing theWiz Runtime Sensor add-on for Google Kubernetes Engine GKE , in preview. This built-in integration brings low-touch deployment, automated lifecycle management, enterprise credential security, and fleet-wide governance to Wiz's industry-leading eBPF runtime threat detection for both Standard and Autopilot GKE clusters. The operational friction of runtime security Security and platform engineering teams share common dilemmas when deploying in-cluster runtime defenses: Deployment and lifecycle friction: Deploying runtime agents often requires managing installations from third-party sources across dozens or hundreds of clusters. Credential sprawl and security risks: Passing and rotating API keys as Kubernetes Secrets introduces administrative overhead and security risk. Fleet-wide enforcement gaps: Platform teams lack built-in policy controls to enforce that every new cluster has runtime sensors enabled before workloads are deployed and start receiving traffic. Performance and operational overhead: Without explicit and strategic resource limits, runtime agents can impact how much CPU and memory is available for your workloads and system functionality. With the Wiz Runtime Sensor for GKE, Google Cloud and Wiz have minimized these operational barriers. The Runtime Sensor is now available in GKE as a first-party, managed platform add-on. Bridging the gap with Wiz Runtime Sensor for GKE The Wiz Runtime Sensor for GKE connects central security and platform engineering workflows by simplifying and automating the sensor lifecycle. With the add-on, GKE manages the sensor deployment, credential injection, and lifecycle updates. Building runtime protection directly into the platform reduces administrative overhead and provides the following benefits for your Kubernetes fleet: Native Secret Manager integration: Security teams no longer need to distribute Wiz API keys across cluster namespaces. The add-on uses GKE's Secret Manager secret sync integration to store your Wiz credentials in an off-cluster, centralized credential vault that only a dedicated service account can access. GKE automatically retrieves the credentials and injects them directly into the Runtime Sensor pods. Updating a key in Secret Manager automatically syncs to the sensor without requiring cluster restarts or manual intervention. Simplified enablement: After you add your Wiz credentials to Secret Manager, platform operators can enable the Runtime Sensor add-on by using the gcloud CLI or the GKE API. The GKE control plane handles deploying the sensor components, managing the lifecycle of pods, and configuring the nodes. Secure egress and proxy support: For environments that restrict public internet access, the managed sensor supports standard HTTP and mTLS proxy configurations. Telemetry is routed back to Wiz without violating your egress firewall policies. Fleet-wide governance with organization policy: Platform security leads can enforce compliance across their entire organization using custom organization policy constraints. You can use a constraint to reject any attempts to create a cluster that doesn't enable the Runtime Sensor add-on, which can prevent malicious actors from spinning up rogue infrastructure to evade runtime detection. Kernel-level observability with minimal overhead: The Wiz Runtime Sensor continuously monitors system calls, running processes, network connections, and file access. It catches suspicious activity, including reverse shells, unauthorized privilege escalations, container escapes, and unsafe outbound connections while keeping CPU usage low even under heavy workload activity. The sensor uses a fixed memory limit on each node to ensure consistent performance as workload density changes. This is especially valuable for AI workloads and web services where application activity might fluctuate quickly. Independent auto-updates: Security threats and zero-day vulnerabilities don’t wait for scheduled infrastructure maintenance windows. The lifecycle of the Wiz sensor add-on for GKE is independent of your GKE cluster and node lifecycle. The sensor periodically rolls out updates of new sensor versions published by Wiz, to help ensure that your clusters always have the latest detection rules without requiring GKE version bumps, node pool recreations, or workload disruption. How it works: Deploying and enforcing the sensor Enabling the Wiz sensor add-on follows the same process that platform administrators are already familiar with on GKE. Using standard gcloud commands, you can activate runtime protection during cluster creation, turn it on for existing clusters, and enforce it across your fleet while keeping credentials securely managed in Secret Manager. Check the setup documentation for prerequisites, such as granting GKE access to Secret Manager. Provisioning a cluster with the Wiz Sensor add-on To provision a new GKE cluster with the managed Wiz sensor enabled using credentials stored in Secret Manager: To enable the sensor on an existing running cluster with Workload Identity Federation for GKE and Secret Manager secret sync enabled, run the following: Enforcing fleet-wide protection with organization policy You can require all new GKE clusters across your organization to install the runtime sensor by deploying a custom constraint: code block <ListValue: StructValue 'code', 'name: organizations/123456789012/customConstraints/custom.GKEWizSensorEnforced\r\nresource types:\r\n - container.googleapis.com/Cluster\r\nmethod types:\r\n - CREATE\r\n - UPDATE\r\ncondition: resource.addonsConfig.wizSensorConfig.enabled == true\r\naction type: ALLOW\r\ndisplay name: Enforce Wiz Sensor on All GKE Clusters\r\ndescription: Mandates that all GKE clusters enable the managed Wiz Runtime Sensor backed by the corporate Secret Manager vault.' , 'language', '' , 'caption', <wagtail.rich text.RichText object at 0x7eff492d9450 Intelligent threat correlation for AI security The true power of this integration emerges when the managed sensor connects to the broader Wiz AI Application Protection Platform AI-APP . By feeding GKE runtime telemetry into the Wiz Security Graph, you unlock a security toolkit that goes beyond static alerting, with: Real-time risk assessment and threat verification: By pairing background security scans with live activity monitoring, you get a clear view of real risks. The sensor checks whether vulnerable code is actually running in memory, so you can focus on active security threats and ignore inactive ones. Real-time threat detection and response: Identify suspicious activity like malware, unauthorized access attempts, and software vulnerabilities in real time. Security teams can set rules to automatically block or stop threats before they can spread. Network activity and detailed security insights: Track system activity, network connections, and data flows to uncover hidden risks and unauthorized software usage. If a threat is detected, the sensor automatically gathers diagnostic data to help teams quickly investigate what happened. Together, these capabilities ensure that mission-critical applications and AI agents deployed on GKE are monitored for attacks and data exfiltration without compromising developer velocity. Get started today The Wiz Runtime Sensor add-on for GKE delivers a standard for container security: deep, kernel-level eBPF protection without operational complexity or deployment friction. By combining GKE's managed platform automation with Wiz's comprehensive security intelligence, platform and security teams can innovate at cloud speed while maintaining strong runtime defense. Check out the Wiz Sensor for GKE documentation to learn more.