Arnav Tripathy
Security operations
Kaseya
Arnav Tripathy is a Cloud Security Engineer based in Dublin with over three years of experience across DevSecOps, DevOps, and incident response. He's worked across the full stack of securing modern engineering — from embedding security into pipelines and cloud infrastructure to being the person on call when things go sideways at 3am.OSCP certified and a Kubestronaut, he brings both the attacker mindset and the engineering depth to understand how systems actually break in production — not just in theory.He builds open source security tools on the side, most recently Kubeconfess, a lightweight Kubernetes AI security and red teaming tools to hack clusters just by talking to it.When he's not responding to incidents or breaking his own infrastructure, he's usually travelling somewhere new.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
KubeConfess: Mapping Kubernetes Attack Paths Using Conversational AI from a Compromised Pod
Kubernetes security audits are slow, manual, and incomplete. Security engineers
spend hours chaining kubectl commands, parsing JSON output, and mentally joining
data across pods, service accounts, RBAC bindings, and secrets — often missing
critical attack paths in the process.
KubeConfess is an open-source conversational AI agent that changes this. Instead
of memorising kubectl flags, you describe what you want in plain English. The agent
determines which Kubernetes API calls are needed, executes them against your live
cluster, and explains what it found — including why it is dangerous and exactly
how to fix it.
The tool operates in two modes. In external mode, it connects via kubeconfig to
audit clusters from the outside. In in-cluster mode — the more powerful and novel
capability — it runs inside a pod using the mounted ServiceAccount token, simulating
exactly what an attacker with shell access to a compromised workload would see and
be able to do.
The centrepiece feature is Investigate Mode. Type "investigate pod/nginx -n payments"
and the tool runs a fixed sequence of security checks — permissions via
SelfSubjectAccessReview, RBAC binding analysis, secret enumeration, privileged
container detection, host path mounts, and cloud metadata endpoint probing. It
collects everything and produces a structured attack path report: findings, concrete
step-by-step attack chains with exact kubectl commands, blast radius, and prioritised
remediations.
KubeConfess is AI-agnostic — it works with Claude, GPT-4, Gemini, or local models
via Ollama. The architecture is intentionally modular so security engineers can
extend it with new checks by adding a single Python file.
- 14:40
- Tue
- 01 Dec
Stage:
Arsenal 3
Sessions Type:
Keynote