Enforce it automatically, then watch for what slips through.

Admission controllers reject non-compliant resources before creation; Falco watches running containers for behavior that shouldn't happen at all.

OPA Gatekeeper, blocking :latest

kubectl applyDeployment using image:myapp:latest

Admission controller checks policy":latest" tag disallowed by ConstraintTemplate

❌ RejectedBefore the object is ever created

falco rule

- rule: Unexpected shell in production
  condition: spawned_process and container
    and k8s.ns.name = "production"
    and proc.name in (bash, sh, zsh)
  priority: WARNING

Full Kubernetes security checklist

✓Images scanned, minimal, non-root

✓RBAC least-privilege, no stray admin

✓Restricted pod security enforced

✓Default-deny network policies

✓Admission policy on every deploy

✓Secrets externally managed

✓Runtime monitoring (Falco) active

Prevention (policy, RBAC, scanning) and detection (Falco) are complementary — a genuinely novel attack can still get through prevention alone.