Aflevering 146: Kubernetes Is Insecure by Default

Recorded on the floor of KubeCon, this episode features Ofir Cohen from Wiz (now part of Google). She leads product management and engineering for container and Kubernetes security. Ronald and Jan dive into what modern cloud-native security looks like and why Kubernetes still needs a lot of help to be safe.

We cover:

• The agentless idea behind Wiz: why scanning through cloud APIs beat installing agents on every machine, and how the Log4j incident became the “aha moment” for the industry.
• Security graph and toxic combinations: modelling Kubernetes as its own cloud, so you can ask “if this pod is compromised, what can it reach?” Instead of drowning in findings, you get a curated feed of the issues that truly matter.
• Lessons from the Trivy supply chain attack: poorly separated GitHub organizations, static CI/CD tokens and what “blast radius” really means.
• Kubernetes is insecure by default: the flat network, namespaces that are not a hard security boundary, and Secrets that aren’t secret. Jan and Ofi agree it’s less about technology and more about discipline and culture.
• Identities as the most common mistake: long-lived tokens in Dockerfiles and .env files, and why short-lived, just-in-time credentials (SPIFFE, workload identities) are the way forward.
• Securing the AI era: agents with over-permissive service accounts, the security impact of vibe coding, and Wiz’s upcoming AI plugin for secure-by-default code generation.
• Fun detour: Ofir’s experience writing software for a satellite, from vibration testing to cosmic rays flipping bits.
• The crystal ball: the right level of abstraction on top of Kubernetes, with simple YAML for AI inference and training workloads, and less time spent debugging with kubectl.

A conversation packed with practical security insights for platform engineers, DevOps teams and everyone who runs containers in production.

Stuur ons een bericht.

ACC ICT Specialist in IT-CONTINUÏTEIT
Bedrijfskritische applicaties én data veilig beschikbaar, onafhankelijk van derden, altijd en overal

Dutch Cloud Native Day 2026

Two days of cloud native talks, workshops and community in Utrecht, exploring how AI is changing the way we build, run and scale modern platforms.

Like and subscribe! It helps out a lot.

You can also find us on:
De Nederlandse Kubernetes Podcast - YouTube
Nederlandse Kubernetes Podcast (@k8spodcast.nl) | TikTok
De Nederlandse Kubernetes Podcast

Where can you meet us:
Events

This Podcast is powered by:
ACC ICT - IT-Continuïteit voor Bedrijfskritische Applicaties | ACC ICT

Edit This Episode

Episode is Live

Published:Oct. 20, 2026 @10AMEdit

Transcript is ReadyAuto Generated • Edit or Add Custom

Add Chapter Markers

Create a Visual Soundbite

Mid-Roll Placements

Add Sponsors & Affiliates

Select a brand or affiliate to mentionACC ICT Specialist in IT-CONTINUÏTEIT  Kubernetes Community Days (KCD Utrecht) DEVWORLD CONFERENCE Dutch Cloud Native Day 2025 DevOps Conference

Add an Episode Guest

Select a guest for this episodeSelect Guest

or Create New Guest

Share Link to Episode

Episode Share URL

Copy

View in website

Direct Link to AudioCopy

Download MP3

Embed Audio Player

‍