AI
Why Runtime Monitoring Catches What Audits Miss
Security audits check manifests, Helm charts, and CVEs at a point in time. That snapshot tells you nothing about what runs in production an hour later. Berroubache frames it plainly: declarative files are the map, runtime events are the real world. At Orange, legacy stacks hide behind “cloud native” claims, and audits still surface clean results while attackers probe live containers. Full-stack observability already exists; the gap is automatic detection and immediate remediation once something moves.
The Signal Overload Problem in Security Operations
Logs, metrics, and alarms fire constantly across a large Kubernetes environment. When everything fires, nothing signals danger. Operations teams mute alerts. Real threats stay invisible inside the noise. Berroubache’s answer: use AI to silence that noise, surface real signals, and automate response. The goal is not replacing human judgment but giving teams context fast enough to act. Manual fixes slow response, and that lag directly raises risk for customers and infrastructure.
Four-Agent Architecture: Coordinator, Threat, Remediation, Notify
Falco events and application logs feed an isolation forest anomaly model. Confirmed abnormal behavior routes to a coordinator agent. That agent sends the event to a threat analysis agent over A2A, which classifies whether the finding is real and adds MITRE ATT&CK context. Confirmed threats pass to a remediation agent deployed across clusters, which selects tools already present in the environment. A notify agent then pushes the full picture to Mattermost, Slack, or Teams so operators can approve or reject each remediation before anything applies.
Live Demo: Command Injection to Crypto Miner in One Container
A purpose-built vulnerable shop application accepted injected shell commands through its order form. The demo listed /etc/passwd and /etc/shadow, then downloaded a crypto miner. Falco produced two chained alarms. The pipeline correlated them, identified the full attack path, and presented a remediation with impact details for human approval. After approval, the agent applied three controls: a threat-detected pod label, a Cilium network policy blocking ingress so the miner could not phone home, and a Kyverno policy blocking future deployments of the vulnerable image.
Human-in-the-Loop as a Hard Requirement
Hallucination, cascading errors, model drift, and overconfidence are real failure modes for any agentic system acting on production infrastructure. Berroubache lists human oversight as a non-optional safeguard, not a fallback. Operators see the attack path, the proposed fix, and the expected impact before anything deploys. That approval step also feeds a training pipeline that improves detection signals over time. Orange is still finalizing the system and plans to test it in more sensitive environments before wider rollout.
Notable Quotes
Runtime events are the real world general. Willem Berroubache · ▶ 04:03
the audit say okay you’re secure with this release in this version. But you need to prove you’re real you’re really secure in production. Willem Berroubache · ▶ 03:19
keep human in the loop and approve it. Willem Berroubache · ▶ 13:09
Hallucination, cascading errors model drift, overconfidence effect and we have human safeguard. Willem Berroubache · ▶ 15:34
Key Takeaways
- Falco events correlated with an isolation forest model feed a four-agent detection and remediation pipeline.
- Three automated controls applied after demo: pod label, Cilium ingress block, Kyverno image block.
- Human approval of every remediation guards against hallucination and cascading failures in production.
About the Speaker(s)
Willem Berroubache leads 5G security monitoring at Orange, a global telecommunications company. He previously managed 5G Edge Computing projects with Kubernetes in collaboration with Google and trains Orange Group staff on Kubernetes and cloud native solutions. His current focus is adding AI-driven security features to the monitoring architecture protecting Orange customer infrastructure.