Fortifying the Fort: Defensive Strategies in Kubernetes and Containers
From a pod RCE to production: PSA restricted, RBAC without escalation paths, KMS v2 for Secrets, default-deny NetworkPolicy, IMDS blocking and Falco.
Security research since 2002
José Ramón Palanco
Founder & CEO/CTO of Plexicus
Security Researcher
Over 20 years in cybersecurity: offensive research, reversing, threat intelligence and product. I founded Dinoflux (acquired by Telefónica) and today lead Plexicus.
Founder of Plexicus 
20+ years in cybersecurity
2002 publishing since
51 articles on this blog
1 exit: Dinoflux → Telefónica
My company
Founder & CEO/CTO of Plexicus
Plexicus is the application security company I founded and lead today. It is where I apply two decades of offensive research, published vulnerabilities and security tooling.
Blog
View all articles Latest articles
Technical notes on DevSecOps, reversing, hardware and cloud security.
Practical DevSecOps: Hardening the Supply Chain in the Age of SBOMs
GitHub Actions pipeline: Syft SBOM, Grype gate, keyless signing and attestation with Cosign v3, and admission-time verification with Kyverno.
Hands-On Tutorial: Hardening MLOps – Building a Secure Machine Learning Pipeline with DevSecOps
An ML pipeline with validated, DVC-versioned data, a safetensors model signed with Sigstore, and least-privilege serving on Kubernetes.
Want to Be a DevSecOps Engineer? Then You Need This Tool Stack!
What to run at each pipeline stage (secrets, SAST, SBOM, image, IaC, admission, DAST, runtime), what should block, and a minimal workflow.
Pipeline Hijacking! An Offensive Perspective on CI/CD and the Hunt for Credentials
How attackers steal credentials from a CI/CD runner, and how to shut them out with OIDC, SHA pinning and admission-time verification.
The 7 Critical Mistakes Every DevSecOps Engineer Must Avoid in Their Pipeline
Seven pipeline mistakes and their fixes: Semgrep on the PR, a Snyk gate, CVSS with EPSS and KEV, pinned Actions, gitleaks, OIDC and ZAP in staging.
Reticulum: Advanced Cloud Infrastructure Security Scanner
Reticulum v2 re-scores Trivy or Semgrep SARIF findings by how exposed each service is in Kubernetes, Helm and Compose: how it works and how to run it.
Career
Two decades of breaking and building
From early write-ups and CVEs to founding and selling a threat-intelligence company, and now Plexicus.
- 2002
First publications
TelephonyPublishes his first article, on telephone networks; WAP and sniffer detection follow in 2003.
- 2006–2007
Published vulnerabilities
Zyxel · D-Link · Mono · GForgeDiscovers and publishes CVEs in routers, web servers and development platforms.
- R&D
R&D at Ericsson and Optenet (Allot)
Ericsson · OptenetWorks in Ericsson's R&D department and at Optenet (Allot).
- 2011–2014
Drainware
Cloud DLP platformBuilds a cloud data-loss-prevention platform with his team, open-sourced in 2020.
- 2014
Founds Dinoflux
Threat intelligenceCreates Dinoflux, which turns malware into intelligence and feeds it to IDS, firewalls, IPS and SIEM.
- 2018
Acquired by Telefónica
Telefónica · ElevenPathsTelefónica acquires Dinoflux and José joins ElevenPaths, its cybersecurity unit.
- Today
Founder & CEO/CTO of Plexicus
Application securityFounds and leads Plexicus, an application security company.
Talks
On stage
Speaker at security conferences including OWASP, RootedCON, ROOTCON, MALCON and FAQin.
“Orquestando el Enjambre: Arquitectura MCP y Grafos para la Explotación Autónoma”
“OT Security”
Slides → OWASPRootedCONROOTCONMALCONFAQinh-c0nAPIAddicts
Research
CVEs and open source
Published vulnerabilities, open-source tools and projects.
Published vulnerabilities
Tools and projects
ProtocolDetector Reticulum Neverwave Drainware attribution.id nmap-scada SCADA IDS EKanalyzer escan pma
Let's talk security
Talks, press or partnerships: get in touch.