The problem we kept living
Every platform team knows the feeling: a forced Kubernetes version deadline is coming, a removed API is buried somewhere in a manifest, and a CVE just dropped on an image you're pretty sure is running in prod — but you can't say where, or which of these actually collide.
Upgrade risk and security risk are usually managed separately. The upgrade project lives in one backlog; vulnerability scanning lives in another. Neither tells you the one thing that matters most: the workload that carries both — the CVE sitting on the exact service that also blocks your next upgrade. That's the fire you should fight first, and nobody was pointing at it.
What Runtimez does about it
Runtimez normalizes every finding onto two axes — upgrade risk and security risk — scored per workload and rolled up per cluster and per fleet. Then it joins the two axes by workload to surface what carries both risks, so your remediation list is ordered by real blast radius, not by whichever scanner shouted last.
It connects to a live cluster with a single read-only Helm command, inventories every workload, image, and API in use, and delivers a prioritized, cross-axis fix list — plus a PR-time verdict on every proposed change, before it merges. First report in under an hour. It runs on EKS, GKE, and AKS.
What we believe
Read-only by default
An observability tool should never be able to break the thing it observes. The agent requests read-only access and never mutates your cluster.
Your data stays yours
Secret values and image contents never leave your cluster. We work from metadata and findings — not your application's data.
Prioritize the collision
The point isn't more findings — it's the right one first. We rank by where upgrade and security risk actually intersect.
Who we build for
Runtimez is built for the SRE and platform engineers who own production Kubernetes — the people who get paged, who run the upgrades, and who are (rightly) skeptical of anything asking for cluster access. It's built by engineers who've lived through forced upgrades, end-of-support deadlines, and 2 a.m. incidents, and who wanted the tool they never had: one that makes the risk on a cluster legible before it turns into an outage.
See what's on your clusters
One read-only Helm install · first report in under an hour · secrets and images never leave your cluster.
Questions? hello@runtimez.io