Detect, Decide, Defend: Building Cloud Native Security That Fights Back - Matthias Bertschy, ARMO

Abstract

Let’s face it: most Kubernetes security tools surface alerts- but don’t help teams act. Incidents trigger noisy dashboards and virtual war rooms, with engineers stitching logs and manifests, unsure what’s safe to fix. Cloud Application Detection and Response (CADR) introduces a new approach: combining real-time detection with automated remediation to create a full lifecycle for runtime security. By correlating posture, configuration, and runtime behavior, CADR delivers high-confidence alerts with actionable context. RemOps then translates those signals into safe, automated responses using Kubernetes-native APIs and declared manifests. In this session, you’ll learn how CADR detects threats by analyzing manifests, metrics, and network policies, and how RemOps closes the loop, without manual toil. Real-world demos will show how to auto-rollback config drift, mitigate privilege escalation, and reconcile live and desired state using fully native Kubernetes constructs.