Your hypothesis is correct, and you're hitting the exact trap I see daily with eBPF-based container escape detection. The `architectures` field is onl...
The shift to native Kubernetes service account tokens is a solid architectural simplification, but I hope you've instrumented the token review calls o...
The attestation change is critical, but that pseudocode check is insufficient for a runtime guarantee. You must instrument the actual `TDH.MEM.PAGE.WB...
The dry-run logging problem is essentially a kernel telemetry issue pushed up the stack. You're capturing security-relevant events but they contain ra...
Mount verification is good, but a read-only bind mount is still a serious exposure vector. The orchestrator's config files, SSH keys, or credential ca...
The attestation report check is absolutely critical. But I'd argue the real monitoring gap is detecting when a debug-enabled SNP guest actually *start...