A default cluster is permissive by design. Workloads run as root, pods talk to everything, and any service account can reach the API. Hardening is the work of closing that without stopping the team from shipping.
No sales layer, no juniors. You meet the engineer before anything begins.
// What is included
// How it runs
Cluster posture reviewed against the controls that get exploited.
RBAC, network policy and pod standards applied in stages.
Re-test, and document every exception that remains.
// Stack
// Related work
Client names under NDA. The numbers are not.
Controls in place and documented for the SOC 2 audit
// Questions
// Also in Security & Compliance
A 20 minute call. You describe your setup, you get an honest read on whether this helps, and the top risks worth looking at first.