THE STARTING POINT
Three things to get right.
- Inventory exposed services and identify their owners.
- Use scoped workload identities instead of embedded secrets.
- Review drift against a documented deployment baseline.
TRY THIS IN THE LAB
A question worth testing.
Choose one test workload. Map its public entry points, identity permissions, secret stores, and logs; look for a path that crosses more than one trust boundary.
Browse the lab notesLeave a useful trail.
Write down your starting assumptions, scope, expected behavior, observed behavior, and evidence. A successful test should explain what happened and which question to investigate next.