Challenge
Exploited vulnerabilities are now the most common way attackers get into an organisation, at 31% of the breaches in Verizon's 2026 Data Breach Investigations Report, ahead of stolen credentials. Attackers are using AI to find weaknesses faster, while the median time to fully fix a known exploited vulnerability has grown to 43 days. If any of the problems below sounds like yours, a review of your platform is the place to start.
More CVEs than anyone can triage
Your scanners report hundreds of CVEs across images, nodes, and add-ons, and nobody can say which are being exploited or can even be reached in your clusters, so everything waits.
Exposed from the outside
Ingress rules, load balancers, and admin dashboards have been added over the years, and nobody has a current list of what the internet can reach, or whether the Kubernetes API is one of them.
Access nobody has reviewed
Cluster-admin was granted to get a project moving and never taken back, service accounts can read every secret, and some of those secrets sit in plain text in Git.
An audit with no evidence
A customer questionnaire, or a SOC 2 or ISO 27001 auditor, asks how the clusters are secured, and the answer is spread across a few engineers' heads.
Approach
Engagements start with an intro call, where we hear what you run and tell you whether a review is worth it. Nobody has to hand over credentials before you decide.
The review looks at your platform from two sides. From inside, we check Kubernetes versions, images, and add-ons against the CVEs being exploited now, along with access, secrets, and how workloads are isolated. From outside, we look at what the internet can reach, the way someone probing you would: ingress, public endpoints, the Kubernetes API, dashboards, TLS, and authentication. We scope the review and its length with you after the call, and give you an estimate before you commit.
You get a report with every finding ranked by severity and the effort to fix it, an executive summary for management, and a note of the findings an auditor would ask about, and we walk your team through it. Afterwards, we can fix the findings as a defined project, or we hand the work to Managed Kubernetes Support or Engineers in Your Team.
- 11+ Years
- running production container platforms
- 0
- changes to production during the review
- 1 hour
- Intro call
What does a Kubernetes security review cover?
A review usually covers the following:
Versions and exploited CVEs
Kubernetes versions, node images, add-ons, and container images checked against the CVEs known to be exploited, and against whether each one can be reached in your clusters.
External exposure
What the internet can reach: ingress rules, load balancers, the Kubernetes API endpoint, admin dashboards, TLS, authentication on anything public, and the cloud firewall rules in front of them.
Access and identity
RBAC roles and bindings, service accounts, cloud IAM, and workload identity, looking for access which was granted to get something working and never taken back.
Secrets
Where secrets are stored, who and what can read them, whether any sit in plain text in Git or in container images, and how they are rotated.
Workload isolation
Network policies, privileged and root containers, Pod Security Standards, and admission policies with tools such as Kyverno or OPA Gatekeeper.
Audit evidence
Findings noted against the CIS Kubernetes Benchmark and the controls SOC 2 and ISO 27001 auditors ask about, so the report can support your next audit.
Not always the right first step
If your own security team already reviews the clusters regularly, or a recent penetration test covered them, a review may only repeat what you know, and we will tell you that in the intro call.
Kubernetes Security and Compliance Roadmap
A review moves through four stages, and you decide after the report what to fix and who fixes it.
Talk
What happens:
- Tell us what you run
- Tell us what worries you
- Agree the scope of the review
What you leave with:
- Whether a review is worth it
- Scope and estimate
Review
What happens:
- Check versions and exploited CVEs
- Map what the internet can reach
- Review access, secrets, and isolation
What you leave with:
- Critical findings reported the same day
Report
What happens:
- Rank each finding by severity and effort
- Note what an auditor would ask about
- Walk your team through it
What you leave with:
- Prioritised findings
- Executive summary
Fix
What happens:
- Fix them as a defined project
- Automate patching for new CVEs
- Or hand over to support or your backlog
What you leave with:
- Findings closed
- Patching that keeps pace
Kubernetes Security and Compliance FAQ
Andrew Shaw, Head of Security
Is this a penetration test?
LiveWyer
No, it is a review
We review how your platform is built and configured, including everything it exposes to the internet, but we do not attempt to break in. If you need a penetration test as well, the report shows where one would be most useful.
Lucy Harper, Platform Engineering Manager
Will you change anything in production?
LiveWyer
No, the review is read-only
We work with read-only access to your clusters and cloud accounts. If we find something critical, we tell you the same day, so your team can act on it straight away.
Nina Kaur, Chief Technology Officer
What does a review cost?
LiveWyer
We scope it after the intro call
The length depends on how many clusters and cloud accounts you run and how much of the platform you want covered, so we agree the scope after the intro call, and give you an estimate before you commit.
Paul Fraser, Head of Infrastructure
What do you need from us?
LiveWyer
Read-only access and a list of what is public
Read-only access to the clusters and cloud accounts in scope, a list of the domains and endpoints you expose, and time with the people who run the platform at the start of the review and at the walkthrough.
Zara Ahmed, Engineering Director
Can you fix what you find?
LiveWyer
Yes, if you want us to
We can fix the findings as a defined project and build an automated patching process for new CVEs, keep the platform patched through Managed Kubernetes Support, or add engineers to your team to work through them from your own backlog.
Ellie Grant, Compliance Lead
Does it help with SOC 2 or ISO 27001?
LiveWyer
It helps with the evidence
The report notes which findings relate to the CIS Kubernetes Benchmark and to the controls SOC 2 and ISO 27001 auditors ask about. It is not a certification audit, and we do not certify you against either standard.
Rob Walsh, Director of Engineering
How do we buy it?
LiveWyer
Through a statement of work or G-Cloud
We agree the scope and the estimate in a statement of work. Public bodies can also buy through G-Cloud 15 and Digital Outcomes and Specialists 7.
Book an intro call
Not sure how exposed your clusters are? Book an intro call of up to an hour with one of our senior engineers, and we will tell you what a review should cover.
Book an intro call