Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native.

The Runtime Gap That Slows Teams Down

Containers have changed how modern applications are built and shipped, enabling rapid microservice deployments, agile CI/CD pipelines, and now high-performance AI workloads. But as clusters scale across environments, catching threats in production remains a major operational hurdle.

Static vulnerability scanners and pre-deployment image checks examine artifacts at rest. They are essential for catching setup flaws early, but they cannot stop active exploits, live reverse shells, privilege escalations, or zero-day execution paths unfolding in node memory.

The Wiz approach starts with agentless scanning, to build a continuous, full-stack view of your environment through the Security Graph. By correlating vulnerabilities with network exposure, identity permissions, and sensitive data access, Wiz maps critical attack paths and surfaces only the risks that truly matter, cutting through alert fatigue before a single line of runtime code runs.

But posture alone cannot stop active threats. You need runtime protection. Yet security and platform engineering teams have historically been caught in a frustrating trade-off:

• Deployment friction: Manually orchestrating third-party Helm charts and manifests across dozens or hundreds of clusters creates an ongoing administrative tax.

Deployment friction: Manually orchestrating third-party Helm charts and manifests across dozens or hundreds of clusters creates an ongoing administrative tax.

• Credential sprawl: Distributing and rotating registry tokens and API keys across individual namespaces introduces unnecessary risk and management overhead.

Credential sprawl: Distributing and rotating registry tokens and API keys across individual namespaces introduces unnecessary risk and management overhead.

• Governance blind spots: Newly provisioned clusters often go live without runtime coverage before security teams even realize they exist.

Governance blind spots: Newly provisioned clusters often go live without runtime coverage before security teams even realize they exist.

• Performance anxiety: Platform leads worry that unbudgeted agent overhead will starve business-critical workloads of CPU and memory.

Performance anxiety: Platform leads worry that unbudgeted agent overhead will starve business-critical workloads of CPU and memory.

To eliminate this friction, runtime protection cannot be an afterthought. It must be native, platform-managed, and built directly into the cloud or hybrid environments’ fabric.

Announcing Native Wiz Runtime Protection on GKE

Today, Google Cloud and Wiz are excited to introduce the Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE) in Preview.

Available directly within the GKE platform for both GKE Standard and GKE Autopilot clusters, this first-party integration transforms how teams deploy and manage in-cluster runtime security. Instead of manually managing third-party agents, GKE handles Wiz Sensor deployment, credential injection, and lifecycle updates automatically through the control plane.

Why This Integration Makes Runtime K8s Security Easier

• Turn it on with 1 click: Enable runtime protection at cluster creation or on existing clusters with a single gcloud flag (--addons=WizSensor=ENABLED) or through the Google Cloud Console.

Turn it on with 1 click: Enable runtime protection at cluster creation or on existing clusters with a single gcloud flag (--addons=WizSensor=ENABLED) or through the Google Cloud Console.

• Zero credential distribution: Leveraging GKE’s native Secret Manager integration and Workload Identity Federation, API keys and pull tokens are vaulted off-cluster. Secret rotations in Secret Manager automatically resynchronize without requiring cluster restarts or pod redeployments.

Zero credential distribution: Leveraging GKE’s native Secret Manager integration and Workload Identity Federation, API keys and pull tokens are vaulted off-cluster. Secret rotations in Secret Manager automatically resynchronize without requiring cluster restarts or pod redeployments.

• Fleet-wide governance with Organization Policy: Platform security leads can mandate runtime protection across projects, folders, or entire organizations using custom Google Cloud Organization Policies. Unprotected cluster creation attempts are automatically blocked before workloads go live.

Fleet-wide governance with Organization Policy: Platform security leads can mandate runtime protection across projects, folders, or entire organizations using custom Google Cloud Organization Policies. Unprotected cluster creation attempts are automatically blocked before workloads go live.

• Predictable, kernel-level eBPF observability: Operating in kernel space via eBPF, the sensor monitors system calls, active processes, and network sockets with fixed per-node resource limits, safeguarding workload performance even under heavy traffic spikes.

Predictable, kernel-level eBPF observability: Operating in kernel space via eBPF, the sensor monitors system calls, active processes, and network sockets with fixed per-node resource limits, safeguarding workload performance even under heavy traffic spikes.

• Decoupled security updates: Sensor detection rules and threat definitions update independently of GKE cluster patch versions, node pool recreations, or workload maintenance windows.

Decoupled security updates: Sensor detection rules and threat definitions update independently of GKE cluster patch versions, node pool recreations, or workload maintenance windows.

Threat Detection in Action

Once active, the Wiz Sensor continuously monitors for high-risk runtime behaviors, including reverse shells, binary executions from /tmp, image drift, and privilege escalation attempts.

When an incident occurs, such as a container spawning an unauthorized interactive shell while modifying system files, the sensor flags the event instantly. Within seconds, a high-fidelity alert surfaces on the Threats page in the Wiz Portal, highlighting the exact pod, namespace, container image, and execution context.

Agentless + Sensor = Better Together

Runtime alerts in isolation often trigger alert fatigue for SOC teams. A process anomaly on an isolated development pod shouldn't carry the same urgency as an exploit on a production service with access to sensitive cloud data.

By combining Agentless Snapshot Scanning with the runtime Sensor for GKE clusters, Wiz delivers powerful capabilities across two dimensions:

Dimension 1: Active risks

Agentless scanning tells you what could be exploited. The Runtime Sensor tells you what is. Together, they eliminate noise across three layers:

Vulnerabilities actively executing in memory. Examples: 45 CVEs → only 2 libraries loaded and running.

Co-existing risk factors on the same workload. Examples: Executing CVE + hardcoded secret + overprivileged IAM + sensitive data access.

Live workload behavior the sensor observes. Examples: Active network communication to sensitive GCS bucket, unexpected outbound IP, credential access never seen before.

Dimension 2: Full container context

Second, when a runtime threat fires on a GKE workload, Wiz doesn't hand you a bare alert. Because agentless scanning has already mapped the entire container estate, every detection arrives pre-enriched with the full Kubernetes blast radius:

Image-level posture enriching the alert. Examples: Vulnerabilities, loaded libraries, running processes, exposed secrets.

Workload identity and privilege context. Examples: Privileged namespace, network exposure, workload identity.

Kubernetes-level security posture. Examples: KSPM misconfigs, RBAC posture, audit log anomalies.

Cloud-level blast radius. Examples: Node pool IAM permissions, sensitive data reachability, lateral movement paths

A SOC analyst responding to a suspicious process on a GKE pod immediately sees whether that pod runs in a privileged namespace, whether its service account has broad GCP project permissions, and whether there's a live path to sensitive data, all without pivoting across tools.

The Bigger Picture: Full Lifecycle Container Protection

The 1-click GKE sensor delivers runtime defense as part of a unified, code-to-cloud container security stack across Google Cloud:

• Start in CI/CD: Scan Dockerfiles, application code, and IaC templates in Google Cloud Build pipelines using the Wiz CLI. Passing images get cryptographically tagged into Wiz’s Trusted Image Database.

Start in CI/CD: Scan Dockerfiles, application code, and IaC templates in Google Cloud Build pipelines using the Wiz CLI. Passing images get cryptographically tagged into Wiz’s Trusted Image Database.

• Artifact Registry Visibility and Scans: Automatically discover and continuously scan Google Artifact Registry (GAR) images for newly disclosed CVEs, even behind VPC Service Controls.

Artifact Registry Visibility and Scans: Automatically discover and continuously scan Google Artifact Registry (GAR) images for newly disclosed CVEs, even behind VPC Service Controls.

• Deploy-Time Gatekeeping: The Wiz Admission Controller intercepts GKE deployment requests to verify image signatures and enforce immutable digest pinning, stopping unverified or vulnerable images before pods launch.

Deploy-Time Gatekeeping: The Wiz Admission Controller intercepts GKE deployment requests to verify image signatures and enforce immutable digest pinning, stopping unverified or vulnerable images before pods launch.

• Posture & Toxic Attack Paths: Kubernetes Security Posture Management (KSPM) evaluates GKE clusters against CIS Benchmarks. The Wiz Security Graph correlates risk factors, such as an internet-facing GKE pod bound via Workload Identity to an over-permissioned GCP Service Account (roles/storage.admin).

Posture & Toxic Attack Paths: Kubernetes Security Posture Management (KSPM) evaluates GKE clusters against CIS Benchmarks. The Wiz Security Graph correlates risk factors, such as an internet-facing GKE pod bound via Workload Identity to an over-permissioned GCP Service Account (roles/storage.admin).

• Control Plane & Cloud Audit Logs: Ingest GCP Admin Activity Logs and GKE Control Plane Audit Logs via GCP Pub/Sub to catch control-plane threats, such as unauthorized kubectl exec commands or unexpected node pool creations.

Control Plane & Cloud Audit Logs: Ingest GCP Admin Activity Logs and GKE Control Plane Audit Logs via GCP Pub/Sub to catch control-plane threats, such as unauthorized kubectl exec commands or unexpected node pool creations.

What's Next

Together, Google Cloud and Wiz are committed to making security turnkey across every compute form factor by extending 1-click sensor deployment and Organization Policy governance to serverless workloads in Google Cloud Run and virtual machines (GCE), offering WizOS Hardened Images for pre-installed container and Helm chart security, and delivering optimized telemetry for short-lived, high-density AI and ephemeral workloads on GKE.

Get Started Today

Security should enable cloud innovation, not slow it down. By integrating eBPF runtime threat detection directly into GKE as a managed platform add-on, Google Cloud and Wiz have eliminated traditional deployment complexity.

Explore the Google Cloud GKE Documentation and Wiz Documentation (login required) to enable the Wiz Sensor add-on on your clusters today.