{"slug": "wiz-sensor-on-gke-1-click-runtime-protection-now-native", "title": "Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native.", "summary": "Google Cloud and Wiz released the Wiz Runtime Sensor add-on for Google Kubernetes Engine in Preview, available for both GKE Standard and GKE Autopilot clusters. The integration lets teams enable kernel-level eBPF runtime threat detection with a single gcloud flag (--addons=WizSensor=ENABLED) or through the Google Cloud Console, with GKE handling sensor deployment, credential injection via Secret Manager and Workload Identity Federation, and lifecycle updates through the control plane. Wiz said custom Google Cloud Organization Policies can mandate runtime protection across projects, folders or entire organizations, blocking unprotected cluster creation before workloads go live.", "body_md": "Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native.\n\nEnable native runtime protection for GKE in just one click. The Wiz Runtime Sensor add-on now automates deployment and credential management while delivering predictable, kernel-level eBPF threat detection for your GKE Kubernetes fleets.\n\nContainers have changed how modern applications are built and shipped, enabling rapid microservice deployments, agile CI/CD pipelines, and now high-performance AI workloads. But as clusters scale across environments, catching threats in production remains a major operational hurdle.\n\nStatic vulnerability scanners and pre-deployment image checks examine artifacts at rest. They are essential for catching setup flaws early, but they cannot stop active exploits, live reverse shells, privilege escalations, or zero-day execution paths unfolding in node memory.\n\nThe Wiz approach starts with agentless scanning, to build a continuous, full-stack view of your environment through the Security Graph. By correlating vulnerabilities with network exposure, identity permissions, and sensitive data access, Wiz maps critical attack paths and surfaces only the risks that truly matter, cutting through alert fatigue before a single line of runtime code runs.\n\nBut posture alone cannot stop active threats. You need runtime protection. Yet security and platform engineering teams have historically been caught in a frustrating trade-off:\n\nDeployment friction: Manually orchestrating third-party Helm charts and manifests across dozens or hundreds of clusters creates an ongoing administrative tax.\n\nCredential sprawl: Distributing and rotating registry tokens and API keys across individual namespaces introduces unnecessary risk and management overhead.\n\nGovernance blind spots: Newly provisioned clusters often go live without runtime coverage before security teams even realize they exist.\n\nPerformance anxiety: Platform leads worry that unbudgeted agent overhead will starve business-critical workloads of CPU and memory.\n\nTo eliminate this friction, runtime protection cannot be an afterthought. It must be native, platform-managed, and built directly into the cloud or hybrid environments’ fabric.\n\nAnnouncing Native Wiz Runtime Protection on GKE\n\nToday, Google Cloud and Wiz are excited to introduce the Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE) in Preview.\n\nAvailable directly within the GKE platform for both GKE Standard and GKE Autopilot clusters, this first-party integration transforms how teams deploy and manage in-cluster runtime security. Instead of manually managing third-party agents, GKE handles Wiz Sensor deployment, credential injection, and lifecycle updates automatically through the control plane.\n\nWhy This Integration Makes Runtime K8s Security Easier\n\nTurn it on with 1 click: Enable runtime protection at cluster creation or on existing clusters with a single gcloud flag (--addons=WizSensor=ENABLED) or through the Google Cloud Console.\n\nZero credential distribution: Leveraging GKE’s native Secret Manager integration and Workload Identity Federation, API keys and pull tokens are vaulted off-cluster. Secret rotations in Secret Manager automatically resynchronize without requiring cluster restarts or pod redeployments.\n\nFleet-wide governance with Organization Policy: Platform security leads can mandate runtime protection across projects, folders, or entire organizations using custom Google Cloud Organization Policies. Unprotected cluster creation attempts are automatically blocked before workloads go live.\n\nPredictable, kernel-level eBPF observability: Operating in kernel space via eBPF, the sensor monitors system calls, active processes, and network sockets with fixed per-node resource limits, safeguarding workload performance even under heavy traffic spikes.\n\nDecoupled security updates: Sensor detection rules and threat definitions update independently of GKE cluster patch versions, node pool recreations, or workload maintenance windows.\n\nThreat Detection in Action\n\nOnce active, the Wiz Sensor continuously monitors for high-risk runtime behaviors, including reverse shells, binary executions from /tmp, image drift, and privilege escalation attempts.\n\nWhen an incident occurs, such as a container spawning an unauthorized interactive shell while modifying system files, the sensor flags the event instantly. Within seconds, a high-fidelity alert surfaces on the Threats page in the Wiz Portal, highlighting the exact pod, namespace, container image, and execution context.\n\nAgentless + Sensor = Better Together\n\nRuntime alerts in isolation often trigger alert fatigue for SOC teams. A process anomaly on an isolated development pod shouldn't carry the same urgency as an exploit on a production service with access to sensitive cloud data.\n\nBy combining Agentless Snapshot Scanning with the runtime Sensor for GKE clusters, Wiz delivers powerful capabilities across two dimensions:\n\nDimension 1: Active risks\n\nAgentless scanning tells you what could be exploited. The Runtime Sensor tells you what is. Together, they eliminate noise across three layers:\n\nLayer\n\nWhat Wiz Detects\n\nSCA with Runtime Validation\n\nVulnerabilities actively executing in memory.\nExamples: 45 CVEs → only 2 libraries loaded and running.\n\nToxic Combinations of Risks\n\nCo-existing risk factors on the same workload.\nExamples: Executing CVE + hardcoded secret + overprivileged IAM + sensitive data access.\n\nRuntime Risks\n\nLive workload behavior the sensor observes.\nExamples: Active network communication to sensitive GCS bucket, unexpected outbound IP, credential access never seen before.\n\nDimension 2: Full container context\n\nSecond, when a runtime threat fires on a GKE workload, Wiz doesn't hand you a bare alert. Because agentless scanning has already mapped the entire container estate, every detection arrives pre-enriched with the full Kubernetes blast radius:\n\nCloud-level blast radius.\nExamples: Node pool IAM permissions, sensitive data reachability, lateral movement paths\n\nA SOC analyst responding to a suspicious process on a GKE pod immediately sees whether that pod runs in a privileged namespace, whether its service account has broad GCP project permissions, and whether there's a live path to sensitive data, all without pivoting across tools.\n\nThe Bigger Picture: Full Lifecycle Container Protection\n\nThe 1-click GKE sensor delivers runtime defense as part of a unified, code-to-cloud container security stack across Google Cloud:\n\nStart in CI/CD: Scan Dockerfiles, application code, and IaC templates in Google Cloud Build pipelines using the Wiz CLI. Passing images get cryptographically tagged into Wiz’s Trusted Image Database.\n\nArtifact Registry Visibility and Scans: Automatically discover and continuously scan Google Artifact Registry (GAR) images for newly disclosed CVEs, even behind VPC Service Controls.\n\nDeploy-Time Gatekeeping: The Wiz Admission Controller intercepts GKE deployment requests to verify image signatures and enforce immutable digest pinning, stopping unverified or vulnerable images before pods launch.\n\nPosture & Toxic Attack Paths:Kubernetes Security Posture Management (KSPM) evaluates GKE clusters against CIS Benchmarks. The Wiz Security Graph correlates risk factors, such as an internet-facing GKE pod bound via Workload Identity to an over-permissioned GCP Service Account (roles/storage.admin).\n\nControl Plane & Cloud Audit Logs: Ingest GCP Admin Activity Logs and GKE Control Plane Audit Logs via GCP Pub/Sub to catch control-plane threats, such as unauthorized kubectl exec commands or unexpected node pool creations.\n\nWhat's Next\n\nTogether, Google Cloud and Wiz are committed to making security turnkey across every compute form factor by extending 1-click sensor deployment and Organization Policy governance to serverless workloads in Google Cloud Run and virtual machines (GCE), offering WizOS Hardened Images for pre-installed container and Helm chart security, and delivering optimized telemetry for short-lived, high-density AI and ephemeral workloads on GKE.\n\nGet Started Today\n\nSecurity should enable cloud innovation, not slow it down. By integrating eBPF runtime threat detection directly into GKE as a managed platform add-on, Google Cloud and Wiz have eliminated traditional deployment complexity.\n\nHow a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage\n\nWhen trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published", "url": "https://wpnews.pro/news/wiz-sensor-on-gke-1-click-runtime-protection-now-native", "canonical_source": "https://www.wiz.io/blog/wiz-sensor-on-gke-1-click-runtime-protection-now-native", "published_at": "2026-10-20 22:02:42+00:00", "updated_at": "2026-10-20 23:17:43.808131+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-infrastructure", "ai-safety", "developer-tools"], "entities": ["Wiz", "Google Cloud", "Google Kubernetes Engine", "GKE Standard", "GKE Autopilot", "Secret Manager", "Workload Identity Federation"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/wiz-sensor-on-gke-1-click-runtime-protection-now-native", "markdown": "https://wpnews.pro/news/wiz-sensor-on-gke-1-click-runtime-protection-now-native.md", "text": "https://wpnews.pro/news/wiz-sensor-on-gke-1-click-runtime-protection-now-native.txt", "jsonld": "https://wpnews.pro/news/wiz-sensor-on-gke-1-click-runtime-protection-now-native.jsonld"}}