Google Cloud, part of Alphabet Inc. (NASDAQ: GOOGL), has introduced a preview Wiz Runtime Sensor add-on for Google Kubernetes Engine that places deployment, credential handling and lifecycle updates for runtime threat detection under GKE management. The integration is designed to give platform teams a less manual way to apply runtime protection across Standard and Autopilot clusters.
The Wiz Runtime Sensor for GKE brings Wiz’s eBPF-based runtime detection into GKE as a managed platform add-on. Google Cloud said GKE handles sensor deployment, configures nodes and manages the lifecycle of the sensor pods, replacing the separate installation work that can otherwise be required across many clusters.
Runtime defenses address a different problem from artifact and configuration scans. Those tools can identify issues before a workload runs, but they do not by themselves show whether vulnerable code is active or whether a container is exhibiting suspicious behavior. According to the companies, the sensor monitors system calls, processes, network connections and file access to identify activity such as reverse shells, privilege escalation, container escapes and unsafe outbound connections.
The managed deployment is also meant to reduce a common Kubernetes security burden: distributing and rotating vendor credentials. The add-on uses GKE Secret Manager secret sync so a Wiz credential remains in a centralized vault rather than being placed as a Kubernetes Secret across cluster namespaces. GKE retrieves and injects the credential into sensor pods, and updates to the secret can be synchronized without restarting a cluster, the company said.
For security leaders, the more consequential feature may be organization-policy enforcement. Administrators can define a custom constraint that rejects creation or updates of clusters that do not have the sensor enabled. That allows a platform organization to make runtime detection a prerequisite for new clusters instead of relying on each development team to add it after deployment.
Google Cloud said the add-on can also operate through standard HTTP and mutual TLS proxy configurations for environments that limit direct internet access. It has a fixed memory limit per node, while the company said the sensor is intended to maintain low CPU use during active workloads. The sensor’s update cycle is separate from the GKE cluster and node lifecycle, so new sensor versions can roll out without a GKE version change, node-pool recreation or planned workload interruption.
The sensor sends runtime telemetry to Wiz’s Security Graph and AI Application Protection Platform. The companies said that combination can help determine whether vulnerable code is actually running, collect diagnostics after detection and support rules that block or stop threats. Those are vendor-described capabilities; Google Cloud did not publish independent detection or performance results for the preview.
The operational benefit for Kubernetes teams is a more standardized path to fleet-wide runtime protection, with policy controls and credential management embedded in the cluster platform. Teams still need to assess the preview’s prerequisites, resource requirements and integration fit, but the design reduces the number of separate controls needed to deploy and maintain a sensor estate as clusters and AI workloads expand. Organizations can phase the add-on into representative clusters before making the policy mandatory across every new environment.