Most Kubernetes security work today happens before deployment. Teams scan images and secure their pipelines, but incidents usually happen after the container is already running. If someone gets access to a pod, many traditional tools provide very little visibility into what the workload actually does on the node.

In this session I introduce runtime security with eBPF, a Linux kernel capability that lets us observe system behavior in real time without modifying applications or containers. We will look at how real attacks appear in Kubernetes environments such as reverse shells, privilege escalation attempts, and unexpected process execution.

Using practical examples and open source tools, I will demonstrate how these activities can be detected and investigated, and how runtime detection complements preventive security controls. The goal is to give attendees a clear mental model of runtime threats and a practical starting point for adding detection to their production clusters.