NEMESIS uncovers 47 runtime findings in Kubernetes cluster

Le Beltagy released NEMESIS, a Kubernetes-native purple-team platform that runs as a DaemonSet and surfaced 47 runtime findings in a three-node homelab where Trivy, kube-bench, and Polaris reported clean [Dev.to]. NEMESIS consists of a Python controller and a Go attack agent, which executed primitives such as service-account token abuse, lateral movement, and egress probing.

During three weeks of continuous testing, the platform logged 47 unique findings across five categories: lateral-movement paths (12), token-abuse (9), network-exfiltration (8), policy bypass (6), and runtime container escape (3) [Dev.to]. By contrast, traditional scanners caught only 20 of those, missing 100% of lateral-movement and egress-exfiltration gaps. One notable gap involved a default-deny NetworkPolicy that blocked inbound traffic but left egress unrestricted, allowing the attack agent to resolve an external DNS name and exfiltrate data.

NEMESIS proves that runtime visibility is essential for detecting insider-threat scenarios. By tapping Cilium's eBPF probes, NEMESIS captures each packet at the kernel layer, enabling precise attribution such as “DNS leak on step 4 originated from pod backend-api-7d9f4b8c5-x2k9m at 14:23:07 UTC” [Dev.to]. This level of proof is impossible for static analysis alone. Integrating a purple-team platform like NEMESIS closes the gap between “what we think is secure” and “what an attacker can actually do”.