This article is based on reporting originally published by Container Journal.
Overview
Trend Micro has integrated its Deep Security platform with Kubernetes, enabling security teams to use Kubernetes itself to orchestrate container image scanning. The move is aimed at helping organizations adopt DevSecOps practices by embedding automated security checks directly into the container lifecycle—without requiring a separate, siloed security toolchain.
What Deep Security’s Kubernetes Integration Does
Trend Micro Deep Security is a multi-layered security suite that uses deep packet inspection to protect workloads through a combination of firewalls, intrusion prevention systems (IPS), and log and file integrity monitoring. The Kubernetes integration extends these capabilities to containerized environments in several key ways:
- Container image scanning at scale: Security scans of container images can now be orchestrated by Kubernetes itself, making it practical to run scans as part of a high-throughput CI/CD pipeline.
- East-west and north-south traffic inspection: The integration allows simultaneous inspection of traffic flowing between containers (east-west) as well as traffic entering and leaving the cluster (north-south).
- Helm Chart deployment: The solution is packaged as a Helm Chart, simplifying installation and configuration across different environments.
- Multi-cloud and hybrid support: The approach is designed to work consistently across hybrid environments, including managed Kubernetes services such as Google Kubernetes Engine (GKE), Azure Kubernetes Service (AKS), and Amazon Elastic Kubernetes Service (Amazon EKS).
The Case for a Unified Security Framework
According to Mark Nunnikhoven, then Vice President of Cloud Research at Trend Micro, a central motivation for this integration is reducing the total cost and complexity of enterprise security. Rather than deploying a dedicated container security tool alongside existing virtual machine (VM) security tooling, Trend Micro’s approach extends the same cybersecurity framework organizations already use for VMs to cover containers.
This matters operationally because most organizations are running containers and VMs side by side. A unified framework avoids policy drift between the two environments and reduces the overhead of managing multiple security products with overlapping responsibilities.
How This Supports DevSecOps Workflows
The integration addresses a common tension in DevSecOps: responsibility for security shifts depending on where an application is in its lifecycle.
- Pre-deployment: Developers are primarily responsible for scanning container images before they reach production. Integrating scanning into the CI/CD pipeline—rather than treating it as a separate gate—makes this step faster and less disruptive to development velocity.
- Post-deployment: Once an application runs in production, the security team takes on responsibility for ensuring images are kept current as new vulnerabilities are discovered. When a new CVE is identified, the security team triggers an image update request, which is then delivered through the next CI/CD cycle.
This handoff model has a meaningful architectural advantage over traditional monolithic applications: replacing a vulnerable container image is significantly faster and less risky than patching a monolithic application in place. It also means security professionals do not need to be embedded in every individual development sprint, which would slow down delivery cycles.
Container Security and the Shift to Microservices
Developments like this Kubernetes integration reflect a broader shift in how application security is approached. Microservices architectures built on containers and Kubernetes offer inherent security advantages over monolithic applications—smaller blast radius per component, easier image replacement, and clearer service boundaries that make policy enforcement more tractable.
Migrating away from legacy monolithic applications is a multi-year undertaking for most enterprises. However, the argument that containerized, immutable infrastructure is fundamentally easier to secure is gaining traction and is likely to accelerate adoption of microservices patterns over time.
Key Takeaways for DevOps and Security Teams
- Kubernetes can be used not only as an application orchestrator but as the orchestration layer for security scanning workflows.
- Deploying container security as a Helm Chart lowers the barrier to adoption and keeps security configuration version-controlled alongside application manifests.
- A unified security platform that covers both VMs and containers reduces operational complexity during the transition period when both workload types coexist.
- Embedding image scanning in CI/CD pipelines shifts security left without requiring security engineers to participate in every sprint.
- The immutable nature of container images makes post-deployment vulnerability remediation faster than patching traditional monolithic applications.