Where the incident started and why it matters

• Tell me briefly about the production incident that triggered this evaluation.
• When did the incident first appear in production and how long did it take your team to detect it?
• How was the exploited container discovered, by external disclosure, runtime monitoring alert, or user-facing failure? Options: External disclosure or report, Runtime monitoring alert, Application failure observed by customers, Penetration test reported, Other
• What parts of your environment were affected, name clusters, namespaces, and the most critical services impacted.
• On a scale, how visible were east-west network flows and service identities during the incident? Options: Fully visible, Partially visible, Barely visible, Not visible at all
• Who first took ownership of the investigation and which teams needed to be pulled in to remediate? Options: Platform engineering, Cloud security architect, SRE, Application team, Incident response, Legal/compliance, Other
• State whether your CISO requires proof that mean-time-to-remediate is under 48 hours before approving a purchase, and if so who verifies that metric. Options: Yes, verification required and handled by security operations, Yes, verification required and handled by platform engineering, No strict requirement, Unsure

Where your current tooling left you exposed

• What single visibility gap most enabled the incident, image provenance, network path, identity mapping, or something else? Options: Image provenance and lineage, East-west network visibility, Identity and IAM mapping, Exploit-path correlation, Admission control gaps, Other
• How often do your image scanners miss vulnerabilities that later show up in runtime alerts? Options: Rarely, Occasionally, Often, Almost always, Unsure
• Which CI/CD gates are currently enforced as blockers and which run only as advisory checks? Options: Image vulnerability policy, SBOM checks, Signature verification, Policy-as-code checks, None are blockers
• Describe where exploit-path correlation is missing between cloud identities, network paths, and container images in your current workflows.
• If nothing changes, what is the likelihood of a repeat incident in the next six months? Options: Very likely, Somewhat likely, Unlikely, Highly unlikely, Unsure

Who decides, who blocks, and why

• Who ultimately signs off on any agent or admission control that could change pod startup time, and what criteria would make them veto the rollout?
• Quantify the pod startup latency your team considers acceptable, in milliseconds or as a percentage change from today. Options: Under 5 ms, 5 to 20 ms, 20 to 100 ms, Above 100 ms, Use percentage rather than milliseconds
• Which business impact would cause leadership to stop a rollout, higher CPU usage, increased deployment failures, or measurable developer velocity loss? Options: CPU or memory regression, Increased deployment failure rate, Developer velocity reduction, Customer-facing outages, Compliance or legal risk
• Identify the procurement and legal reviewers required for a pilot and the typical duration of their reviews. Options: No procurement/legal gate, Procurement only, Legal and procurement, Security/compliance review required, Unsure
• If the VP of platform engineering requires zero measurable impact on pod scheduling before any rollout, do you have a plan to demonstrate that constraint? Options: Yes, we can demonstrate in staging, No, this is a blocker, We can mitigate with phased rollout, Unsure

What success looks like for the proof-of-value

• Name the single metric that, if proven in the two-week proof-of-value, would end the debate. Options: Mean-time-to-remediate, False positive rate, CI/CD block rate for vulnerable images, Exploit-path detection coverage, Startup latency impact
• Specify the staging cluster, representative services, and CI/CD pipeline you expect to include in the bake-off.
• List the acceptance criteria you consider non-negotiable and the criteria you would treat as optional.
• Describe the process you will use to record false positives during the trial and who will adjudicate disagreements.
• Should the staging run demonstrate blocking of vulnerable images without measurable CI build time increase, would you commit to a production trial in one cluster within 30 days? Options: Yes, commit within 30 days, Yes, but need additional approvals, No, require more time, No, not at this time, Unsure

Other paths you are weighing

• Name the alternatives you are actively evaluating and the main reason each could win over an external platform. Options: Incumbent multi-tool in place, Single-purpose image scanner, In-house build effort, Open-source runtime agent, No change or postpone, Other
• List the conditions that would have to be true for you to stay with your current approach rather than switching vendors.
• Has anyone on your team proposed building this capability internally instead of buying, and if so who would lead that effort? Options: Yes, platform engineering, Yes, security engineering, Yes, a shared team, No internal build proposal, Unsure
• Indicate the option your VP of platform engineering prefers and whether that preference has veto power over vendor selection. Options: Prefers internal build with veto, Prefers incumbent vendor with veto, Open to third party with no veto, Preference but no veto, Unsure

Concrete readiness, dependencies, and gating approvals

• Identify the integrations, APIs, or permissions that if unavailable would stop the pilot before it begins.
• Estimate the dedicated engineering hours and named owners your team can commit during the two-week proof-of-value. Options: Under 40 hours, 40 to 80 hours, 80 to 160 hours, Over 160 hours, Cannot commit engineering time now
• Provide the list of clusters, cloud accounts, and CI/CD endpoints we must access and note any accounts requiring elevated approvals.
• Are there regulatory, compliance, or legal reviews that must finish before deployment and what is the typical timeline? Options: No regulatory gate, Requires security review only, Requires legal and compliance review, Requires external audit, Unsure
• State whether inability to grant required access within four weeks would pause the engagement or require scope adjustments. Options: Pause engagement until access granted, Adjust scope and proceed, Proceed with limited scope, Unsure

Hard metrics, acceptable tradeoffs, and rollback rules

• Assume the platform cannot reduce mean-time-to-remediate below 48 hours, describe the consequences for this project.
• Rank the evaluation metrics you care about most, choose up to three. Options: Mean-time-to-remediate, False positive rate, CI/CD build time impact, Pod startup latency, Exploit-path coverage, Breadth of cloud misconfiguration detection
• Indicate the maximum false-positive rate during the two-week trial you would accept, in percent. Options: 0%, 0-1%, 1-5%, 5-10%, Above 10%
• Provide the rollback criteria you expect during cluster rollout, including tolerances for CPU, memory, or failed deployments.
• Should a single performance regression above your threshold appear in the pilot, would you require remediation before proceeding or accept a mitigation plan? Options: Require remediation before proceeding, Accept mitigation plan with timeline, Delay rollout for deeper analysis, Unsure

Decision triggers, timeline, and next steps

• Tell the individual or role who can approve a pilot purchase within 30 days if the proof-of-value meets the agreed metrics. Options: Cloud security architect, VP of platform engineering, CISO, Procurement manager, Other
• Estimate the earliest date you could begin the two-week staging run assuming approvals and access are provided this week. Options: Within 1 week, 2 weeks, 3 to 4 weeks, More than 4 weeks, Unsure
• Detail the internal reports or dashboards you will share during the trial to demonstrate outcomes and who will own those artifacts.
• Specify the single outcome during the pilot that would cause you to sign a 12 month license within the next quarter.
• Are there budget windows or fiscal constraints that would affect the timing of a purchase decision after the trial? Options: Yes, tied to current quarter budget, Yes, tied to next quarter, No major budget constraints, Unsure

• Provision platform console and tenant
• Onboard first Kubernetes cluster
• Integrate cloud provider APIs for posture
• Connect container registry for image scanning
• Enforce CI/CD pipeline image blocking
• Deploy sidecar-free runtime instrumentation
• Deploy runtime workload protection policies
• Attack path mapping and security graph correlation
• Prioritize exploitable findings and alerts
• Generate remediation playbooks and runbooks
• Roll out policies cluster-by-cluster
• Measure and tune pod startup performance

Provision platform console and tenant

• Provide the preferred tenant identifier (console namespace or account label) you want us to provision
• List the cloud region(s) where the platform console should be hosted and retained for telemetry Options: Single region, Multi-region (specify regions in comments)
• Identify the administrative contact email and the primary platform operator who will receive onboarding access
• Specify your single sign-on (SSO) provider type or method for console authentication (SAML, OIDC, or local accounts) Options: SAML, OpenID Connect (OIDC), Local platform accounts
• Confirm the data retention window for logs and image scan metadata we should provision for this tenant Options: 30 days, 90 days, 1 year, Custom (describe)
• Describe any regulatory or compliance constraints that must be enforced for this tenant (example artifacts: SOC2 log retention, GDPR data residency)

Onboard first Kubernetes cluster

• Enter the cluster name and kubeconfig access method (upload kubeconfig, provide a short-lived token, or install agent via Helm) for the first cluster Options: Upload kubeconfig, Short-lived token, Install via Helm chart
• Attach the Kubernetes cluster type: managed control plane, self-managed control plane, or air-gapped cluster Options: Managed control plane, Self-managed control plane, Air-gapped / isolated
• State which namespaces and workloads should be included in the initial staging scope (enter namespace names or 'all')
• Name the node OS and kernel baseline (example: Linux distribution and kernel version) we must support for sidecar-free instrumentation
• Assign the owner who will approve cluster onboarding and be the point of contact for RBAC and network access
• Specify the acceptance criteria for the two-week staging proof-of-value run on this cluster including detection fidelity thresholds, false-positive ceiling, and prioritized findings coverage Options: Provide quantitative thresholds (open text)

Integrate cloud provider APIs for posture

• Indicate the cloud accounts and account IDs you want connected for cloud posture scanning and attack-graph correlation
• Report which cloud services must be covered by posture scanning (examples: IAM roles and policies, VPC/network ACLs, storage buckets, KMS keys) Options: IAM/identity, Network/VPC, Storage (buckets/objects), Key management, Other (describe)
• Detail the API permission model you can grant for posture integration (examples: read-only org-level role, individual account service principal, or delegated auditor role)
• Outline any regions or projects that must be excluded from posture scanning for compliance or cost reasons
• Supply the expected cadence for posture scans and asset inventory refresh (daily, hourly, on-change) Options: Hourly, Daily, On resource change / event-driven
• Quantify the number of accounts and active regions the platform will need to inventory on day one Options: 1, 2-5, 6-20, More than 20

Connect container registry for image scanning

• Estimate the container registries and registry endpoints to be connected (provide registry hostnames and number of repositories)
• Measure the expected daily image push frequency and total active image tags to be scanned during the PoV Options: Less than 10/day, 10-100/day, 100-1,000/day, More than 1,000/day
• Choose the access method for registry integration (read-only token, service account key, or webhook-based scan trigger) Options: Read-only token, Service account key, Webhook scan trigger
• Pinpoint the image tagging strategy you use to identify production vs staging images (examples: 'latest', semantic tags, git SHA)
• Explain any private registry network constraints (VPC endpoints, IP allowlist, or proxy) that the platform must traverse to reach the registry
• Record any certification or signing requirements for images we should validate (example: signed image attestations or SBOM presence) Options: Require signed images, Require SBOM, No additional signing required

Enforce CI/CD pipeline image blocking

• Choose where image blocking should be enforced in your pipeline: at build artifact push, pre-deploy admission, or at promotion gates Options: At build artifact publish, At promotion gate, Pre-deploy admission
• Select the enforcement mode during PoV: block (fail the job), warn (annotate the pipeline), or audit-only Options: Block (fail), Warn (annotate), Audit-only
• Specify which vulnerability severity levels must trigger blocking (examples: critical, high, CVSS >= 7.0) Options: Critical only, Critical + High, CVSS >= 7.0, Custom threshold
• Grant the CI/CD integration artifact identifiers you will provide for tests (examples: pipeline name, job name, artifact registry path)
• Authorize the CI/CD systems integration method you can support (API token, pipeline plugin, or webhook) and any firewall restrictions Options: API token, Pipeline plugin, Webhook
• Specify the acceptance criteria for CI/CD blocking: the maximum allowed CI build time increase and the blocking accuracy required to accept enforcement into production Options: Provide numeric thresholds (open text)

Deploy sidecar-free runtime instrumentation

• Indicate whether nodes allow kernel-level observability (BPF/eBPF) or require an alternative approach for sidecar-free instrumentation Options: Kernel observability allowed (eBPF), Kernel observability restricted, need alternative
• Detail required node privileges we can request (example: CAP_SYS_ADMIN, loading kernel modules) or confirm we must avoid elevated capabilities Options: We can grant elevated capabilities, We cannot grant elevated capabilities
• Explain any node security constraints such as mandatory signed kernels, FIPS mode, or secure boot that affect instrumentation
• Share the expected maximum pods per node and typical container density so we can size instrumentation resource use Options: Less than 10, 10-50, 50-200, More than 200
• Supply the runtime telemetry endpoints you want the instrumentation to emit to (example: local collector endpoint, external observability endpoint)
• Reveal any host-level agents already installed that could conflict with kernel-level instrumentation (example: existing eBPF users, security agents) Options: No host agents, Host agents present (describe)

Deploy runtime workload protection policies

• Specify the policy types you want in scope during PoV (runtime detection rules, container image allowlists, network microsegmentation policies) Options: Runtime detections, Image allowlist, Network policies / microsegmentation
• Identify the namespaces and workload labels that should be included or excluded from policy enforcement
• Assign the policy owners responsible for approving exceptions and tuning rules
• Detail any existing admission controls or Pod Security Standards that policies must respect during enforcement
• Clarify the remediation actions you want attached to detections (example: alert only, block network egress, quarantine pod) Options: Alert only, Block network egress, Quarantine pod (eviction)
• Determine the escalation path and on-call rotation to be used when runtime policies generate high-confidence exploit detections

Attack path mapping and security graph correlation

• Map the inventory artifacts we must ingest to build the security graph (examples: IAM roles, service accounts, pod identities, network ACLs)
• Connect the identity sources you can provide for correlation (example: cloud identity directory, Kubernetes service account mappings)
• Explain how you tag or label critical assets so we can prioritize them in attack-path scoring (examples: 'production=true', 'tier=payment')
• Detail any asset ownership data you can supply to map remediation responsibilities in the graph (name emails, teams, or ticket queues)
• Correlate how network flows are captured in your environment today (CNI logs, VPC flow logs, service mesh telemetry) so we can ingest the right flows Options: CNI logs, VPC flow logs, Service mesh telemetry, None / limited
• Contrast the types of exploit scenarios you want modeled first (image CVE to pod compromise, misconfigured IAM to data exfiltration, network pivoting between namespaces)

Prioritize exploitable findings and alerts

• Summarize the triage criteria you want applied to prioritize findings (example attributes: exploitability score, business impact tag, exposure to internet)
• Prioritize which alert channels should receive high-priority exploitable findings (examples: chat channel, SIEM, ticketing system)
• Allocate the false-positive tolerance for runtime detections over the two-week staging period (acceptable percent of false positives) Options: <1%, 1-5%, 5-10%, Accept higher while tuning
• Designate the on-call rotation or engineering team responsible for first-response to prioritized alerts
• Establish the SLA for initial triage and remediation handoff for prioritized exploitable findings (examples: 1 hour, 24 hours, 48 hours) Options: 1 hour, 24 hours, 48 hours, Custom
• Specify how duplicate or related findings should be grouped in the console (by pod, by image digest, by attack path) Options: Group by pod, Group by image digest, Group by attack path, Do not group

Generate remediation playbooks and runbooks

• Document the format you require for playbooks and runbooks (plain text, Markdown, runbook steps with scripts) Options: Markdown, Plain text, Structured runbook with script blocks
• Identify the ticketing or incident system you want playbooks integrated with for automated remediation actions
• Specify the automated remediation scopes you will approve during PoV (example: auto-add network deny rule, auto-revert deployment) Options: No automated remediation, Safe automated actions (non-disruptive), Full automated remediation
• Detail required runbook steps for a high-severity container escape path from detection to containment to post-mortem
• Capture any compliance evidence artifacts the runbooks must produce (example: ticket IDs, audit log extract, timeframe timestamps)
• Propose who will be the named approver for automated playbook actions in production

• gaps
• decision_readiness
• current_state
• desired_state
• success_criteria
• stakeholders
• decision_readiness
• current_state
• desired_state
• stakeholders
• success_criteria
• gaps
• gaps
• desired_state
• stakeholders
• decision_readiness
• success_criteria
• current_state
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness

• Subscription Agreement
• Order Form
• Support & Service Level Agreement (SLA)
• License & Entitlement Schedule
• Data Processing Addendum (DPA)
• Rollout Go/No-Go Criteria
• Termination, Data Return & Exit Plan

• Go-live Health Check (weeks 1-4)
• First Measurement Review (weeks 4-10)
• Acceptance Gate Review (around day 90)
• Monthly Operational Review (first 3 months post-acceptance)
• Quarterly Operational Review (ongoing cadence)

• Schedule a CI/CD integration audit and publish findings in the shared channel.
• Capture remediation tasks and deadlines for any criteria not met, and record the named signatory for the acceptance decision.
• Publish the acceptance decision document with criterion-level results and signatory record.
• Create and publish a remediation tracking board for any failed criteria with owners and due dates.
• Confirm the shared channel and escalation contacts for post-acceptance issue tracking.
• Operational metrics snapshot
• Confirm MTTR and runtime false positive rate remain at or are moving toward Solution Scope targets, or agree corrective steps.
• Close or reassign top persistent blockers and update the shared issues channel with status.
• Resolve the top persistent blocker within 30 days and report remediation evidence to the shared channel.
• Re-confirm success criteria and named owners
• Update detection tuning parameters to reduce false positives and document the verification method.
• Executive outcome summary
• Validate that pre-deploy blocking rate and exploitable attack path triage rate meet the targets recorded in Solution Scope or document specific next-quarter mitigation steps.
• Agree the operational focus and measurable deliverables for the next quarter and publish them to the shared channel.
• Publish the quarterly outcomes report including blocking rate and attack path triage counts to the shared channel.
• Create the prioritized list of operational improvements for the next quarter with owners and delivery dates.
• Confirm closure or retention steps for any remaining incumbent system dependencies and archive evidence of decommissioning where applicable.
• Deployment is validated as live and telemetry is complete for the initial cluster.
• Owners and due dates are assigned for all open blockers and the incumbent wind-down plan is published.
• Publish the deployment validation checklist and unresolved defects with owners and target resolution dates.
• Create the shared channel for issues and enhancements and invite the named owners.
• Publish the incumbent decommission schedule or read-only retention decision and archive checklist.
• Present first-period outcomes vs targets
• Determine whether mean time to remediate container vulnerabilities and pre-deploy blocking rate are trending toward the Solution Scope targets.
• Agree a set of corrective actions with owners and completion dates to close identified gaps before the acceptance gate.
• Apply policy tuning and CI/CD integration fixes, and report completion with verification steps.
• Deliver an updated dataset showing MTTR and blocking rate within 14 days after remediation actions complete.
• Update the remediation runbook with the new steps and publish to the shared channel.
• Restate acceptance criteria and numeric targets
• Produce a documented pass or fail decision for each acceptance criterion recorded in Solution Scope.
• CI/CD blocking and deployment incidents
• Deployment and telemetry validation
• Present measured outcomes for each criterion
• Root-cause analysis for gaps
• Trend and capacity review
• Document pass/fail per criterion and formal acceptance
• Early adoption and CI/CD activity signals
• Operational improvement commitments
• Agree corrective actions and dates
• Persistent blocker burn-down
• Enhancements and operational improvements log
• Confirm timeline to acceptance gate
• Incumbent system wind-down checkpoint
• Incumbent wind-down follow-up and cost avoidance
• Agree remediation items for any failed criteria
• Open issues and immediate remediation plan