Shift Security Left, Then Shift Up

This document explains the 'shift left' approach—integrating security early in the development lifecycle—and argues it must be complemented by 'shift up' runtime controls that focus on the application layer in cloud-native environments. It outlines how responsibilities differ under the shared-responsibility model for self-managed Kubernetes clusters, cloud-managed clusters (e.g., EKS), and serverless container services (e.g., Fargate), and recommends that security teams adapt from host/network-centric controls to application/runtime visibility and response.