Cloud Security Operations

Articles about cloud security operations from security operations practitioners.

Kubernetes security best practices that actually move the needle

I run the SOC that consumes Kubernetes telemetry, and nearly every best-practices list I read is written from the cluster admin's chair rather than mine. So I worked through the standard checklist with our platform lead and separated the controls that change our breach exposure from the ones that only change our audit score. Four of them earn budget from me, and I defer the rest.

DCDaniel C. · Jul 25, 2026

CSPM in 2026: what it catches, what it misses, what comes next

A CSPM renewal is worth signing, but not for the reason the vendor's deck claims. Posture tooling reads configuration state, which means credentialed attacks against correctly configured resources read clean.

DCDaniel C. · Jul 17, 2026

Cloud Security Operations

Container security: SOC practitioner’s guide

Most container security programs invest in image scanning and call it done, leaving the runtime layer where active threats actually execute underbuilt and unowned. This is the four-layer split, the ownership seams where incidents fall through, and what to press vendors on before you buy.

DCDaniel C. · Jun 26, 2026

Cloud Security Operations

What CNAPP is, and what the category actually delivers

CNAPP bundles four components at very different maturity levels, and the detection piece, CDR, is the one that consistently disappoints. This breaks down what CSPM, CIEM, CWPP, and CDR actually deliver, plus the three questions that expose a weak CDR before you sign.

DCDaniel C. · Jun 19, 2026

Cloud Security Operations

Multi-cloud security without a mountain of tooling

At some point, the security stack stops being a solution and starts being a liability. Daniel Carter counted eleven tools spread across AWS, GCP, and Azure — none retired, all justified at purchase, none obviously redundant until you saw them together. This piece covers the consolidation principle he built from that exercise, and why coverage depth usually beats tool count.

DCDaniel C. · Jun 15, 2026

Cloud Security Operations

Runtime security is where cloud attacks actually get caught

The CNAPP dashboard stayed green while an attacker with a stolen access key moved through three AWS accounts and touched 19 IAM principals. Prevention had nothing to flag because the login was legitimate, the permissions were real, and the only signal was runtime behavior.

DCDaniel C. · Jun 5, 2026

Cloud Security Operations

What cloud security monitoring actually looks like in a mid-market SOC

Cloud security monitoring for 3-5 person SOC teams: four pillars, co-managed MDR, telemetry strategy, and where most stacks fail.

MKMarta K. · Jun 2, 2026

Cloud Security Operations

Most Cloud-Native Security Is Rebadged Cloud Hygiene

Most CNAPPs and CSPMs are sold as cloud-native security but deliver cloud hygiene. Here's the structural gap and how to spot it in a vendor demo.

DCDaniel C. · May 14, 2026

Stay sharp on security operations

Practitioner takes on SOC modernization, detection engineering, threat hunting, and more. No fluff. No product pitches.

Cloud Security Operations | Future of SecOps