A sweeping security gap has emerged across enterprise Kubernetes deployments, with 81% of Amazon EKS clusters still relying on a deprecated authentication method that AWS itself has warned against, according to a 2025 Kubernetes Security Report cited by The New Stack. The article, published by Nutanix, finds that roughly two-thirds of organizations have postponed or slowed application rollouts because of Kubernetes-related security worries. The central conclusion: migrating to Kubernetes creates a "dangerous security illusion" that leads platform teams to assume the infrastructure comes with built-in protections, when in reality it introduces layers of complexity that each demand dedicated security work.
The report identifies five recurring security failures across enterprise Kubernetes fleets. First, inconsistent security policies across clusters, driven by teams that provision clusters one at a time and apply protections manually rather than enforcing them centrally. Second, manual credential management and reliance on static secrets—Kubernetes Secrets are base64-encoded but not encrypted by default, making them visible to anyone with cluster access. Third, misunderstandings about multi-tenancy, with teams expecting Kubernetes to provide the same isolation VMs offer natively, when in fact it only delivers "soft multi-tenancy" through namespace-based separation that still allows cluster-scoped resources to be visible across boundaries if permissions are misconfigured. Fourth, insecure image delivery, with Sysdig's 2025 Cloud-Native Security and Usage Report showing that image bloat has roughly quintupled over the past year, attributed in part to the rush to deploy AI and machine learning packages that are far larger than traditional workloads. Fifth, compliance failures at scale, with most organizations reporting audit failures operating in environments where compliance state wasn't consistently maintained and couldn't be consistently demonstrated.
The report attributes the pattern to a fundamental mismatch between VM-era security models and Kubernetes architecture. In a VM environment, each virtual machine has a fixed IP address, runs a single application, and communicates over a predictable network, making security policies straightforward to create and enforce. Kubernetes, by contrast, operates dynamically: pods start and stop continuously, workloads shift across nodes, and clusters scale up or down based on demand. That dynamism is what makes Kubernetes powerful for running modern applications at scale, but it also renders VM-era security practices structurally inadequate because they weren't built to handle a constantly changing set of running processes. The report notes that while teams have carried over strong security discipline for the Code and Cloud layers from traditional development workflows, gaps almost always appear at the Container and Cluster layers, which operate under very different rules. At the Container layer, the challenge lies in the multifaceted image supply chain, which requires repeated verification and monitoring from initial code sourcing through runtime. At the Cluster layer, the challenge is configuration and lifecycle flexibility, which creates a large surface for misconfiguration, plus an East-West traffic dimension that catches teams off guard—by default, pods can communicate freely with any other pod in the cluster, meaning a compromise in one workload has a clear path to every other workload sharing the cluster without explicit network policies in place.
The report argues that all five common challenges stem from a cluster-management approach and can be resolved with a fleet-level strategy, where security policies are defined at the fleet level and automatically enforced at deployment time. Nutanix cites the 2025 CNCF survey, which found that GitOps adoption—the practice most closely associated with fleet-level policy governance—is now the clearest single indicator of cloud-native maturity, with 58% of "Innovator" organizations using it compared to close to zero among early-stage adopters. The Nutanix Kubernetes Platform is designed to provide security as a base framework rather than a bolt-on, with CIS Benchmark hardening applied at both the OS and Kubernetes layers before platform teams configure anything, FIPS-validated and STIG-compatible OS images available directly from the portal, Gatekeeper admission controls that reject workloads violating policy before deployment, Dex integration with enterprise identity providers for centralized authentication and RBAC, Istio service mesh that enforces mutual TLS to encrypt traffic between pods, and NKP Insights for continuous CIS benchmark scanning, runtime container image scanning, and anomaly detection across the entire fleet. The report warns that AI workloads, especially agentic AI that can autonomously invoke external tools and take action without human oversight, raise the stakes further by requiring clearly defined perimeters around what they're allowed to access, enforced at the platform level rather than left to individual application teams. For enterprises that want to keep pace with innovation while managing an expanding attack surface, the path forward depends on establishing a system that delivers security by default rather than asking developers to retrofit it after the fact.