GKE adds Wiz runtime sensor for Kubernetes threat detection

Google Cloud has introduced a managed runtime security integration for its Kubernetes service, aiming to reduce operational friction for platform and security teams. The Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE) is now available in preview, providing built-in eBPF-based threat detection for both Standard and Autopilot clusters.

How the integration works

The Wiz Runtime Sensor for GKE is deployed as a first-party managed add-on, eliminating the need for third-party agent installations across clusters. GKE handles sensor deployment, credential injection, and lifecycle updates through its control plane, while Wiz credentials are stored in Google Cloud’s Secret Manager rather than as Kubernetes Secrets. This approach reduces administrative overhead and credential sprawl, according to the announcement.

The integration supports fleet-wide governance through organization policy constraints, allowing platform teams to enforce runtime sensor enablement across all new clusters. This prevents the creation of unmonitored clusters that could evade detection. The sensor also includes fixed memory limits to maintain consistent performance, particularly for AI workloads and fluctuating web services.

Key features and operational benefits

The Wiz Runtime Sensor for GKE addresses several operational challenges highlighted in the announcement:

• Credential management: Native Secret Manager integration eliminates the need to distribute Wiz API keys across cluster namespaces. Credential updates in Secret Manager automatically sync to the sensor without requiring cluster restarts.
• Deployment automation: Platform operators can enable the sensor via gcloud CLI or GKE API, with the control plane managing pod lifecycle and node configuration.
• Egress security: The sensor supports HTTP and mTLS proxy configurations for environments with restricted public internet access, routing telemetry to Wiz without violating firewall policies.
• Independent updates: Sensor updates are decoupled from GKE cluster and node lifecycle, allowing new detection rules to roll out without requiring version bumps or node pool recreations.

The sensor monitors system calls, running processes, network connections, and file access to detect threats such as reverse shells, privilege escalations, and container escapes. Its fixed memory allocation ensures minimal performance impact even under heavy workloads.

AI security and threat correlation

When connected to the Wiz AI Application Protection Platform (AI-APP), the sensor’s runtime telemetry integrates with the Wiz Security Graph. This enables real-time risk assessment by verifying whether vulnerable code is actively running in memory, reducing false positives from static scans. Security teams can configure automated response rules to block or stop threats before they spread, while the sensor gathers diagnostic data for post-incident investigation.

The preview is available for both Standard and Autopilot GKE clusters. Prerequisites include enabling Workload Identity Federation for GKE and Secret Manager secret sync, as outlined in the setup documentation.