Status: OUT
AKS provides runtime security defense-in-depth across compute and storage layers: AppArmor and seccomp profiles restrict container actions following least-privilege, while managed disks provide automatic encryption at rest for node storage — but the defense-in-depth model has a gap at the application data layer where Kubernetes Secrets use base64 encoding rather than encryption.