* [Blog](https://www.paloaltonetworks.com/blog) * [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/) * [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/) * Your Riskiest Kubernetes ... # Your Riskiest Kubernetes Workload Is Hiding in Plain Sight [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fyour-riskiest-kubernetes-workload-is-hiding-in-plain-sight%2F) [](https://twitter.com/share?text=Your+Riskiest+Kubernetes+Workload+Is+Hiding+in+Plain+Sight&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fyour-riskiest-kubernetes-workload-is-hiding-in-plain-sight%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fyour-riskiest-kubernetes-workload-is-hiding-in-plain-sight%2F&title=Your+Riskiest+Kubernetes+Workload+Is+Hiding+in+Plain+Sight&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/cloud-security/your-riskiest-kubernetes-workload-is-hiding-in-plain-sight/&ts=markdown) \[\](mailto:?subject=Your Riskiest Kubernetes Workload Is Hiding in Plain Sight) Link copied By [Mohit Bhasin](https://www.paloaltonetworks.com/blog/author/mbhasin/?ts=markdown "Posts by Mohit Bhasin") and [Noam Shterman](https://www.paloaltonetworks.com/blog/author/noam-shterman/?ts=markdown "Posts by Noam Shterman") Jul 21, 2026 6 minutes [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown) [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown) [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown) [CNAPP](https://www.paloaltonetworks.com/blog/cloud-security/category/cnapp/?ts=markdown) ## The real Kubernetes security problem is knowing where to start Most Kubernetes security tools excel at one thing: overwhelming your team with data. They surface thousands of vulnerabilities, malware findings, and open alerts through a visually appealing dashboard. Although the data is accurate, it does not tell you where to begin your remediation efforts. In Kubernetes, raw counts of vulnerabilities, secrets, and compliance issues do not tell the whole story. A cluster does not behave like a standard VM or a single container. Instead, a cluster is a stack of nested environments. Namespaces sit inside it. Applications run based on runtime images inside those namespaces. Workloads stand those images up, update them, and replace them. Thousands of relationships run through all of it, and the risk lives in those connections rather than in any single object. A static list only shows you what is broken; it cannot show you how those broken pieces connect or which ones actually matter. The question worth answering isn't how many misconfigurations you have. It is determining exactly which clusters, namespaces, and workloads put your environment at risk, and why. ## Meet KSPM Graph KSPM Graph is a visual map of your Kubernetes environment built into Cortex Cloud. We designed it to prioritize security risks using an interactive interface, without requiring you to write complex queries or deeply understand the underlying data model. This view starts with your cloud providers and lets you drill straight down into clusters, namespaces, workloads, and runtime images. The security context automatically accounts for associated vulnerabilities, misconfigurations, malware, secrets, and internet exposure. You see the full context of a risky Kubernetes resource immediately. It solves the primary problem of knowing where to begin. By prioritizing risks visually, you can see exactly which clusters and workloads to focus on and trace the specific issues that require attention. KSPM Graph is built for DevOps, platform engineers, security analysts, security architects, and anyone responsible for securing Kubernetes estates. ![KSPM Graph Overview](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/07/word-image-362818-1.png) Figure 1: KSPM Graph Overview ## Beyond Queries and Static Lists There are two primary ways to surface risk in Kubernetes. The first relies on a question you already have. For example: "Show me clusters with workloads that run a vulnerable image, above a high severity, matching the application's name." Because you know what you are hunting for, you write a query, and the search returns the matches. This is [Graph Search](https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Posture-Management-Release-Notes/Graph-Search). It is precise, repeatable, and scales across findings. However, it requires you to know the data model and phrase the query perfectly. It pays off heavily, but only when you already know what you are looking for. ![Top Riskiest Clusters Overview](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/07/word-image-362818-2.png) Figure 2: Top Riskiest Clusters Overview The second way is to assess risk without a specific starting question. You need to walk through your entire estate and figure out what requires immediate attention. This is the difference between querying a data model and using a visual map. The query approach is like standing outside your house and asking if the back window is locked. The visual map approach is walking in the front door because you smell smoke. You do not need to know the smoke is coming from the kitchen right away. You see the haze, you follow it, and you find the burning pan. Both methods have value, but when assessing overall risk, a visual map lets you follow the smoke immediately and get to the risk faster. ## How KSPM Graph Works ### Prioritize the riskiest assets When you open KSPM Graph, you land at the top of your environment: cloud providers first, then their clusters, laid out as a map rather than a table. The clusters are automatically prioritized by risk. The riskiest cluster sits in the top left, ranked by aggregated findings across internet exposure, malware, vulnerabilities, secrets, misconfigurations, and additional security issues. Icons flag immediate context at a glance, a globe for internet exposure, and a skull for malware. It also highlights unprotected clusters, helping you identify blind spots across your entire cloud footprint. Hovering over a cluster reveals its posture summary: the split between critical and high-risk issues, vulnerability totals, and specific flags. In one mouse movement, you know which cluster needs remediation. Contrast this with a traditional investigation, where locating the highest risk requires dozens of clicks through nested tabs. ![Hovering Over a Risky Cluster to Show Aggregated Findings](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/07/word-image-362818-3.png) Figure 3: Hovering Over a Risky Cluster to Show Aggregated Findings ### Drill in and investigate Clicking into a cluster reveals its internal structure, instantly highlighting the specific namespace demanding your focus. The investigation flows naturally downward, mapping the relationship between the workload layer and the underlying runtime images. Because every layer is risk-prioritized, you are guided directly toward the most critical threats without losing your navigational context. Selecting an asset opens its card, displaying vulnerabilities, misconfigurations, identity details, and environmental connections. You can open multiple asset cards as stacked tabs for deeper cross-referencing. When finished, simply close them to return to your exact place in the graph. ![Relationship Between Risky Workloads and Runtime Images](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/07/word-image-362818-4.png) Figure 4: Relationship Between Risky Workloads and Runtime Images ### Fix the risk at its source KSPM Graph separates risk into two distinct levels: what is in the workload and what is in the image. * Workload-level risk concerns how that workload runs and its exposure, such as a workload being directly reachable from the public internet. * Image-level risk involves what is baked in, such as vulnerable packages and known CVEs. These are different problems requiring different fixes. You can patch every CVE in an image, but if the workload exposes it to the internet, you remain at risk. With clear visibility into both, KSPM Graph provides recommendations for fixing the root cause rather than chasing symptoms. If the source is the image, you update the image. If the source is the workload, you fix the workload configuration, and every image running under it immediately stops carrying that exposure risk. By adding the Kubernetes orchestration layer to the visual context, teams can stop repeatedly patching the same images and start optimizing their remediation strategy. ## Simplifying Kubernetes Security with Cortex Cloud Kubernetes is a highly complex infrastructure. The standard industry reflex has been to add more data, more dashboards, and more reports. A more effective approach is to prioritize risks in a visual graph, enabling teams to focus immediately on critical issues rather than searching for them. [Kubernetes security](https://www.paloaltonetworks.com/cortex/cloud/kubernetes-and-container-security?ts=markdown) has traditionally carried a heavy operational tax. To get value, teams had to learn complex data models, memorize query languages, and sift through static lists. We are removing that tax with KSPM Graph by turning posture management into a visual, graphical navigation for risk prioritization. This answers the simple problem of where to start, your teams can load the graph, immediately spot the riskiest assets in a sprawling multi-cloud environment, and focus on the security concerns that matter. For existing customers, this capability is included in C1 and C3 cloud security licenses. [Take a demo today](https://www.paloaltonetworks.com/cortex/cloud/demo?ts=markdown) to uncover what's hidden in your builds. *** ** * ** *** ## Related Blogs ### [Cloud Detection and Response](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-detection-and-response/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Cloud Workload Protection](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection/?ts=markdown), [CNAPP](https://www.paloaltonetworks.com/blog/cloud-security/category/cnapp/?ts=markdown) [#### Taking Cloud Security from Visibility to Prevention with eBPF](https://www.paloaltonetworks.com/blog/cloud-security/ebpf-cloud-security-real-time-protection/) ### [CDR](https://www.paloaltonetworks.com/blog/cloud-security/category/cdr/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown) [#### MCP Servers Are the New Unmanaged API. Start Treating Them That Way.](https://www.paloaltonetworks.com/blog/cloud-security/mcp-servers-ai-attack-surface-security/) ### [CDR](https://www.paloaltonetworks.com/blog/cloud-security/category/cdr/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown) [#### How the Latest Frontier AI Models Are Driving the Need for Real-Time Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/frontier-ai-models-real-time-cloud-security/) ### [ASPM](https://www.paloaltonetworks.com/blog/cloud-security/category/aspm/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security/?ts=markdown), [CNAPP](https://www.paloaltonetworks.com/blog/cloud-security/category/cnapp/?ts=markdown) [#### Container Security: A Layer-by-Layer Guide for Security Engineers](https://www.paloaltonetworks.com/blog/cloud-security/container-security-defense-in-depth-guide/) ### [Announcement](https://www.paloaltonetworks.com/blog/cloud-security/category/announcement/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Cloud Security Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-platform/?ts=markdown), [CNAPP](https://www.paloaltonetworks.com/blog/cloud-security/category/cnapp/?ts=markdown), [Code to Cloud to SOC](https://www.paloaltonetworks.com/blog/cloud-security/category/code-to-cloud-to-soc/?ts=markdown) [#### Why the Future of Cloud Security Is Agentic](https://www.paloaltonetworks.com/blog/cloud-security/agentic-cloud-security-future-autonomous-defense/) ### [Announcement](https://www.paloaltonetworks.com/blog/cloud-security/category/announcement/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Cloud Security Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-platform/?ts=markdown), [CNAPP](https://www.paloaltonetworks.com/blog/cloud-security/category/cnapp/?ts=markdown) [#### Closing the Gap Between Cloud Visibility and Network Security](https://www.paloaltonetworks.com/blog/cloud-security/cloud-visibility-network-security-context-exposure-management/) ### Subscribe to Cloud Security Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language