--- title: "Calico Cloud: Active build and runtime security for cloud-native applications" source: "https://www.tigera.io/blog/calico-cloud-active-build-and-runtime-security-for-cloud-native-applications/" --- [Company Blog](https://www.tigera.io/category/company-blog/) [Technical Blog](https://www.tigera.io/category/technical-blog/) # Calico Cloud: Active build and runtime security for cloud-native applications By [Dhiraj Sehgal](https://www.tigera.io/blog/author/dhiraj-sehgal/) on Feb 17, 2022 • 6 min read Calico Cloud has just celebrated its 1-year anniversary! And what better way to celebrate than to launch new features and capabilities that help users address their most urgent [cloud security](https://www.tigera.io/learn/guides/cloud-security/) needs. Over the past year, the Tigera team has seen rapid adoption of Calico Cloud for security and observability of cloud-native applications. With this new release, Calico Cloud becomes the first in the industry to offer the most comprehensive active [cloud-native application security](https://www.tigera.io/learn/guides/cloud-native-security/) that goes beyond detecting threats to limit exposure and automatically mitigate risks in real time. With news of new zero-day threats emerging almost every day (e.g. [Argo CD](https://www.zdnet.com/article/argo-cd-releases-patch-for-0-day-vulnerability/), [Chrome Browser](https://nakedsecurity.sophos.com/2022/02/15/google-announces-zero-day-in-chrome-browser-update-now/)), the current security approach needs to evolve. We need active build, deploy, and runtime security, all together, instead of using a siloed approach. Security threats, vulnerabilities, and risks for all three areas should be addressed together, by the same security platform, rather than using multiple disjointed tools. Calico Cloud does just that! With Calico Cloud, you can reduce your cloud-native application’s attack surface, harness machine learning to combat runtime security risks from known and unknown zero-day threats, enable continuous compliance, and prioritize and mitigate the risks from vulnerabilities and attacks. Let’s take a look at how Calico Cloud provides active build and runtime security for cloud-native applications as an active [CNAPP](https://www.tigera.io/learn/guides/cnapp/) platform. ## Build-time security with image assurance and admission controller Calico Cloud continuously assesses 1st- and 3rd-party images for vulnerabilities and misconfigurations. It also provides runtime visibility by correlating image scan results to provide a real-time view of the images running in your clusters and any potential risk associated with them. An admission controller in Calico Cloud automatically blocks the deployment of pods that contain high-severity vulnerabilities. You can define exceptions for vulnerabilities that are not applicable based on how an affected component may be used in your environment. With Calico Cloud, not only can you scan the images and allow the deployment of ones that pass the security requirements, but you can also actively control which images get deployed based on security profiles tailored to cloud-native applications. This helps to further improve and strengthen the security posture of your environment. ![Calico Cloud's image assurance feature listing image registries, showing control over which images are deployed](https://www.tigera.io/app/uploads/2022/02/Image-Assurance-1.png) *Read more about [Image Assurance](https://www.tigera.io/tigera-products/compare-products/).* ## Configuration assessment for images, workloads, and Kubernetes Calico Cloud continuously monitors images, workloads, and Kubernetes infrastructure configuration against common configuration security standards. Evidence and audit reports for PCI DSS, SOC 2, GDPR, CCPA, and FIPS are available from the platform. You can also create specific reports for your custom compliance frameworks. You can get a detailed daily, weekly, or monthly assessment report based on your organizational requirements and deployment model. This is especially helpful when you are working in a dynamic and ephemeral environment such as Kubernetes. Further, you can integrate these reports into your CI/CD pipeline or incident response workflows for active mitigation. ![Calico Cloud's compliance report, showing Kubernetes CIS benchmark results, including node failure summary and top failed](https://www.tigera.io/app/uploads/2022/02/Compliance-Report-1.png) *Read more about [configuration assessment](https://www.tigera.io/features/configuration-security/).* ## Zero-trust workload security Calico Cloud enforces [zero-trust workload security](https://www.tigera.io/learn/guides/zero-trust/zero-trust-security/) for better prevention against security threats. It reduces the attack surface by enabling zero-trust workload access controls, identity-aware microsegmentation for workloads, and integration with firewalls and security information and event management (SIEM) tools. Calico Cloud enables fine-grained, zero-trust workload access controls between your microservices and external databases, cloud services, APIs, and other applications with an egress access gateway, DNS policy, and NetworkSets. These features help you control access between individual pods in a Kubernetes cluster and external resources or other workloads as per your requirements. You can limit the blast radius of breaches by restricting lateral movement of threats with identity-aware segmentation in Calico Cloud that works across all of your workload environments, including hosts, VMs, Kubernetes components, and services. ![Calico Cloud's Policies Board shows workload access controls. Policies are grouped by security, platform, and default,](https://www.tigera.io/app/uploads/2022/02/Policies-Board.png) *Read more about [zero-trust workload security](https://www.tigera.io/tigera-products/zero-trust-workload-security/).* ## Runtime threat defense for container and network-based threats With new capabilities, Calico Cloud now delivers runtime security against both container and network-based threats. Calico Cloud has built-in probes based on eBPF that collect workload activity data across the network, file system, system calls, and processes. The threat defense engine compares data from these probes, in near real time, with known malicious attacks. It uses a combination of signature-based techniques, curated rulesets based on historical attacks, and machine learning to create a behavioral baseline of the workload. To complete runtime threat defense, Calico provides workload-level intrusion detection and prevention (IDS/IPS), deep packet inspection (DPI), distributed denial-of-service (DDoS) attack prevention, and application-level protection with a web application firewall (WAF). Calico Cloud’s highly performant security policy engine can alert, pause, quarantine, or terminate infected pods within milliseconds in multi-cloud and hybrid environments. The Security Policy Recommender scans your environment and recommends policies for robust security. ![Calico Cloud's security policy recommender scans images, showing pass/warn/fail status, for robust multi-cloud security](https://www.tigera.io/app/uploads/2022/02/Runtime-Threat-Defense-1.png) *Read more about [runtime threat defense](https://www.tigera.io/features/network-threat-detection/).* ## Live visualization and faster troubleshooting with Dynamic Service and Threat Graph Calico Cloud’s Dynamic Service and Threat Graph provides live visualization of communication between services, namespaces, and workloads enabling faster troubleshooting. You have a live view of security gaps and vulnerabilities along with performance issues and communication breakdown between microservices. With simple clicks, you can drill down into the visualization to perform troubleshooting and significantly reduce the time and steps it takes to pinpoint and troubleshoot container or connectivity issues. *Read more about [Dynamic Service and Threat Graph](https://www.tigera.io/features/dynamic-service-graph/).* ## Summary Calico Cloud is the only active cloud-native application security platform that goes beyond finding and alerting DevOps, security, and platform teams about vulnerabilities in their cloud-native applications. Calico Cloud helps reduce the attack surface using zero trust, actively mitigates risks with a combination of preventive measures, and combines behavioral baselining and known threat knowledge to detect anomalous activity at runtime, providing security policies to address them in real time. As securing cloud-native applications becomes a shared team goal, it becomes important for active [CNAPP](https://www.tigera.io/learn/guides/cnapp/) to address problems at build, deploy, and runtime while not adversely impacting the rate at which cloud-native applications are being built and deployed. ***To see these new features and capabilities in action, [try out Calico Cloud for yourself](https://www.calicocloud.io/) with a free trial.*** If you’d like to know more about the driving force behind these recent changes and why an ‘active’ approach to security is needed, read [this blog](https://www.tigera.io/blog/why-you-need-tigeras-new-active-cloud-native-application-security/) from President & CEO Ratan Tipirneni. [Products](https://www.tigera.io/tags/products/)[Release](https://www.tigera.io/tags/release/)[Announcements](https://www.tigera.io/tags/announcements/) ## Related posts [![Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/app/uploads/2026/09/Meet-Mylo-An-AI-native-way-to-work-with-Calico.png)](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) #### [Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) By [Phil DiCorpo](https://www.tigera.io/blog/author/phil-dicorpo/) on Sep 3, 2026 A library of Calico tools and skills — delivered through the Calico MCP Server What if your hardest network question took ten minutes instead of ten days? Anyone who has operated Kubernetes networking at scale... [Read more](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) [![The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/app/uploads/2026/08/The-Safest-Place-to-Run-an-AI-Agent-Is-On-a-Cluster-That-Doesnt-Trust-It.png)](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) #### [The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 27, 2026 Every organization running AI agents has already made a hosting decision. Most made it by accident. The sales team switched on the agent built into their CRM. Engineering is piloting a coding agent in a... [Read more](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) [![AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/app/uploads/2026/08/AI-Red-Team-Agents-Automate-Attacks-on-your-AI-Agents.-Runtime-Policies-Automate-their-Defense.png)](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) #### [AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 24, 2026 The AI red teaming market grew up fast this year. OpenAI bought Promptfoo, Cisco and Microsoft shipped automated attack suites, and a seed-stage startup publicly compromised 50 of 55 live customer service bots. These platforms... [Read more](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/)