KubeCon + CloudNativeCon Europe 2025

In the evolving cloud native landscape of software development, the paradigm of "shifting left" has championed embedding security, and its complexity into the development lifecycle (SDLC). A well-designed platform security threat model underpins this strategy. By mapping out potential attack surfaces such as API vulnerabilities, misconfigured RBAC, unscanned container images, and lack of runtime anomaly detection.
Platform Engineering promotes a "shift down" approach, embedding a robust security posture directly into the platform. By integrating governance and scalable security controls into the infrastructure, platform teams enable developers to focus on delivering code and business value without being burdened by security complexities or productivity blockers.
With this talk, attendees will walk away with real life examples based on successful implementations for regulated entities like financial companies, including actionable best practices for security controls and threat models.