Kubernetes Security Essentials: Network Misconfigurations - The Invisible Attack Surface
Dynatrace, Thursday, November 5th, 2026
Dynatrace shows how Kubernetes network misconfigurations enable attacks and how NetworkPolicy, Kimera and KSPM detect and block them.
By default a Kubernetes cluster lets any pod reach any other pod, and NetworkPolicy objects only restrict traffic if they are defined and enforced by the CNI.
This part of the Kubernetes Security Essentials series moves from container hardening to network reachability, noting that predictable CoreDNS names make topology easy to discover.
Using Kimera, Dynatrace's open-source Kubernetes security testing toolkit, and the deliberately vulnerable Unguard application, it demonstrates how one compromised workload can lead to a stolen user session.
Dynatrace KSPM flags the missing network policies, Smartscape shows the service calls in the attack path, and Kimera then applies NetworkPolicy controls and tests whether they block it.