Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

What is a Kubernetes security dashboard? A visual interface showing your clusters’ security state—what’s vulnerable, what’s under attack, and what to fix first. Different from general dashboards like Lens or Rancher, which focus on cluster management rather than threat detection. Why do most security dashboards fail? They create more work. Alerts are siloed across tools, forcing hours of manual correlation.

What is the best Threat Detection & Response for cloud-native applications? Traditional EDR isn’t enough for Kubernetes enviorments. Security teams need CADR (Cloud Application Detection and Response), which unifies application, container, Kubernetes, and cloud detection into a single platform that builds complete attack stories instead of siloed alerts. Why doesn’t traditional EDR work for Cloud-Native Applications?

A newly disclosed MongoDB vulnerability, tracked as CVE-2025-14847 and informally referred to as MongoBleed, allows unauthenticated remote attackers to leak uninitialized memory from a MongoDB server. A public proof-of-concept exploit is already available, significantly increasing the risk for exposed MongoDB deployments. This post explains how the vulnerability works, what is required to exploit it, and how ARMO helps identify exposure and detect exploitation attempts at runtime.

In this article, we’ll break down the three most prevalent runtime threat vectors behind most modern cloud breaches – and why traditional cloud security tools fail to detect them. Let’s get one thing clear: the cloud itself hasn’t become more dangerous – but cloud-native architectures fundamentally changed the threat landscape. In the datacenter era, most threats targeted hosts, networks, and endpoints.

If you are dealing with securing cloud infrastructure, containers and applications, you probably have several security tools in place including cloud posture (CSPM/CNAPP), container security and runtime security. Tool coverage might look good on paper, but how can you know they work against real attacks? ARMO CTRL (Cloud Threat Readiness Lab) helps you test your cloud security tools by deploying a safe, controlled attack lab that mimics real attack behaviors end‑to‑end.

Within 24 hours, three new high-severity vulnerabilities were disclosed in runc, the low-level runtime that underpins most container platforms, including Docker, containerd, Kubernetes, and nearly every major cloud provider’s managed Kubernetes service. These vulnerabilities (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) allow a malicious container image to break out of the container boundary and affect the host machine directly.

Hi there, We’ve just dropped a fresh batch of updates to help you cut through the noise, stay in control, and secure your cloud-native environments with more precision. Here’s what’s new in the ARMO Platform this month.

The recently published 2025 Latio Cloud Security Market Report, authored by industry analyst James Berthoty, captures a major transformation: cloud security is leaving behind static visibility tools and moving toward runtime-driven risk reduction. The report traces five years of evolution – from dashboards full of misconfigurations to platforms that can detect, prioritize, and mitigate threats in real time. Six key insights define this new era.

Linux kernel v6.17 is on the horizon (expected release by the end of September 2025 – Canonical said to release 25.10 with the new kernel in early October), and it brings some interesting security-focused improvements. This release continues Linux’s trend of hardening the kernel against both hardware-level vulnerabilities and general attack vectors, while refining security subsystems for better performance and maintainability.

These days it seems everyone is obsessed with MCP servers, me included. After studying the topic and building a few MCP servers myself, I have decided to share the knowledge I have gained with a series of blogs on MCP servers and their security implications.