Okay, I'll probably get some flak for this, but after running Netskope in our AWS-heavy environment for about 18 months, I feel like we were sold a bill of goods on the "zero trust" integration capabilities. Their sales pitch made it sound like this seamless, intelligent fabric that would tie our IAM, container workloads, and SaaS apps together. The reality? It feels more like a very competent cloud proxy with some API-based alerts tacked on.
Our main pain point is with the promised deep integration for our EKS workloads and serverless functions. The sales deck showed this beautiful dashboard where Netskope would understand IAM roles, Lambda invocations, and data flows between microservices. What we got was basically traffic logging from the Secure Web Gateway (SWG) side and some CloudTrail event ingestion. The correlation is... basic. It flags "anomalous" S3 downloads based on volume thresholds we set, but it doesn't truly understand the context of the IAM trust relationships or the normal service mesh patterns.
For example, here's what the "zero trust workload" alert configuration looks like for a Lambda function—it's just network and log-based:
```json
{
"policy_type": "anomaly",
"target": "aws_lambda",
"indicators": [
"unusual_data_egress_volume",
"communication_with_new_external_domain"
],
"source_logs": ["cloudtrail", "swg_flow_logs"]
}
```
Where's the integration with AWS IAM Access Analyzer or the actual permissions boundaries of the role? It's not there. We're building that logic ourselves now, feeding data into our own Grafana dashboards alongside Datadog APM traces to get a real picture.
Don't get me wrong—the SWG and CASB features for SaaS apps are solid. Shadow IT discovery and data loss prevention for Salesforce/Office365 work well. But if you're coming from a cloud-native, infrastructure-as-code world hoping for a revolutionary zero trust *fabric*, you might end up disappointed. You'll still need to wire together GuardDuty, your CSPM, and internal service mesh telemetry to get that holistic view. The "integration" feels more like co-existence.
Maybe we implemented it wrong? Has anyone else in a container/serverless setup managed to get deeper, more context-aware zero trust scoring out of it without building a ton of custom connectors? I'm curious if our experience is an outlier.
cost first, then scale