TL;DR
- Kubernetes clusters now run AI agents that pull packages, call tools, and reach new services at runtime, so deploy-time checks no longer describe what a workload does.
- A production cluster running agents without runtime detection is effectively unmonitored. Runtime is what catches that activity and shows which scan findings are actually loaded, reachable, or in use.
- Where you can’t install a sensor, Upwind still covers you with two agentless layers: a Kubernetes scanner inside the cluster and cloud scanners from outside.
- All three feed the same inventory and security graph. Connect agentlessly first, then add the Upwind Sensor on production clusters.
Kubernetes has taken on a second job.
Clusters still run the applications they always ran, but now they also run AI agents, model-serving workloads, and MCP servers alongside the applications those agents work on. These workloads do not behave like the applications Kubernetes was built to run. They call tools, reach external services, and pull code and packages while they run.
Until recently you could get a fair picture of what a workload would do in production from its config, image and permissions. A pod that passed every check in CI this morning can open a shell, resolve a hostname it has never resolved before, and pull an unfamiliar package this afternoon, because an agent decided that was the next step.
Nothing in the manifest changed. What the workload does changed.
Runtime is not optional in production
Scans are snapshots. Attacks are events. The only way to catch an event is to watch while it happens.
Runtime does two jobs. It catches what no scan can see, and it grades what every scan already found.
Job One: runtime catches what no scanner can see.
An unexpected shell in a container, a process that as never run on that image, a call to the cloud metadata service, or Service-to-service traffic that no deployment ever described. None of this exists in a manifest or an image layer. It exists only for the seconds it happens, then it is gone. Only runtime sees them at all.
Job two: runtime tells you which findings are real.
A scanner tells you a vulnerable package is present.
Runtime tells you whether it is loaded.
A scanner tells you a workload is configured for ingress.
Runtime tells you whether anything has reached it.
A scanner tells you a secret sits in an image.
Runtime tells you whether a process has read it.
Runtime does not replace the scan. It tells you which parts of it are real.
AI-driven applications decide what to do while they run, not when they are deployed, and security has to watch at that speed.
When a sensor is not an option
Some clusters cannot take a sensor yet: regulated environments under change freeze, managed clusters owned by another team, an acquired company’s estate, mid-integration, third-party and vendor-run clusters where you hold the risk but not the kubeconfig.
The risk in those clusters is the same. Only the access is different. “No sensor” cannot mean “no visibility,” which is why Upwind covers Kubernetes in two more layers that need nothing installed on your nodes.
Inside the cluster, nothing on the nodes
Upwind’s Kubernetes Agentless Scanner connects to a cluster, builds an inventory of what is running, and scans the container images those workloads actually run. No DaemonSet, no node install, no change to your deployment pipeline.
- Cluster inventory without an install. Deployments, DaemonSets, StatefulSets, services and the images behind them appear in Inventory under their own resource kinds, alongside everything else in your estate.
- Vulnerabilities in the images you are running. Upwind extracts an SBOM from each deployed image and matches it against vulnerability data, so the finding sits on the workload that runs the image.
- Secrets and malware in the image contents. The same scan analyzes image contents for exposed secrets and malicious files, surfaced in Threats alongside your other detections.
- Public and private clusters. One view across both, with nothing deployed in either.
The outside view: cloud scanners
Upwind’s agentless Cloud Scanners already cover AWS, Google Cloud and Azure across accounts. They build the cloud inventory and security graph, then overlay vulnerabilities, exposed secrets, internet exposure, and configuration findings.
For Kubernetes, this is the view from outside the cluster: the managed cluster resource, the node VMs and their operating systems, load balancers, IAM roles and the network paths around the cluster.
It is also how you find the clusters you did not know you had. Those become candidates for the agentless scanner, and then for the sensor.
Three Layers, One Security Graph
Put together, that is three ways of looking at a cluster: the sensor on the nodes, the agentless scanner inside the cluster, and the cloud scanners outside it.
Each layer adds breadth going outward. Only the Runtime layer sees attacks as they happen, and all three feed the same inventory, the same security graph and the same Containers & Kubernetes Focus Mode.
| Layer | What you deploy | What it sees | Real-time detection | AI security | Use it for |
| 1. Upwind Sensor | Sensor on the nodes | Live process, network and file activity | Yes | Yes | Production and mission-critical clusters |
| 2. Kubernetes Agentless Scanner | Nothing on the nodes | Inside the cluster: inventory, image vulnerabilities, secrets, malware | No | No | Every cluster, especially where a sensor cannot go yet |
| 3. Cloud Scanners | Nothing in the workloads | The whole cloud estate, clusters from the outside | No | No | Estate discovery and posture |
A cluster that carries AI activity has to be protected at runtime.
There is no agentless substitute for that, and no version of this where posture findings catch an agent acting on a poisoned instruction at 3 a.m. Every week a production cluster runs AI workloads without runtime coverage is a week you are reading yesterday’s configuration and calling it security.
Start agentless if that is where your access is today. Just do not stop there.
Upwind Sensor on the clusters that matter, connect the rest agentlessly in minutes.