Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Regulation is doing more to shape backup strategy right now than almost anything else. NIS2 requires organizations to document their risk management measures, keep an incident response plan on file, and report breaches within 24 hours, with fines that can reach €10 million or 2% of global turnover. DORA goes further for financial entities, requiring documented recovery objectives, regular resilience testing, and an audit trail that holds up to a regulator’s questions.

Have you ever tried to answer “Is this container safe to run?” If yes, then you know how tricky that question is. Securing containers is one of the toughest jobs in security, and hunting vulnerabilities across an estate of them gives security folks the same vibe as hunting in the fifth domain. Container vulnerabilities can live almost anywhere, from the image layers down to the kernel, and every week, a new base image, a new dependency, or a new manifest change opens a fresh gap.

Somewhere right now, someone is spinning up a fresh Kubernetes cluster, feeling pretty good with a basic firewall, skimmed a hardening guide, and maybe even applied a few CIS benchmarks. What could possibly go wrong? Roughly 18 minutes. That’s the average time before a newly exposed Kubernetes cluster receives its first malicious probe or attack attempt. So there’s zero room for error when it comes to securing Kubernetes.

Kubernetes trusts everything inside the cluster by default. Any pod can reach any other pod, IPs change with every rolling deployment, and one compromised container gives an attacker a path across your entire environment. Kubernetes zero trust replaces that default with a simple rule: Never trust, always verify, regardless of where a request comes from.

One of the blockers to moving VMs off vSphere and onto Kubernetes is losing NSX and the protection it provides. Security teams that have spent years building out distributed firewall policy look at Kubernetes and are, quite understandably, alarmed by the flat network and the fact that any workload can reach any other by default. How will they enforce east-west traffic controls? Will they be able to replicate NSX distributed firewall rules with the same granularity?

On June 1, 2026, the Kubernetes Security Response Committee updated the records for four older CVEs that remain unfixed. The corrections may cause vulnerability scanners to report these CVEs in clusters where they weren’t previously detected. But an affected version doesn’t necessarily mean that a cluster is exposed. Each unfixed Kubernetes CVE depends on a particular combination of permissions, cluster features, and network access.

Run any mature scanner against a container image you built yesterday, and you will likely see dozens — sometimes hundreds — of CVEs. Most of them sit in code you never wrote. That is the uncomfortable reality container image scanning exists to deal with: modern images are assembled from layers of inherited software, and every layer carries someone else’s vulnerabilities into your production environment.

EU regulations are putting real pressure on how organizations protect and recover their data. If you run Kubernetes workloads in financial services, insurance, healthcare, energy, telco, and public administration, your backup strategy is no longer just an IT concern. It is something regulators and auditors can examine directly. Most Kubernetes environments were set up for operational convenience rather than compliance.

In short, the MCP 2026-07-28 release candidate is getting attention for going stateless. The quieter story is a package of six SEPs that harden the protocol’s OAuth layer: issuer validation, credential binding, client type declaration, and cleanups around refresh tokens, scopes, and discovery. All six are worth shipping, and all six fix real failure modes. But they harden how a client authenticates to a server, and that was never the whole problem.