Service Mesh Security.

The set of identity, encryption, and authorization controls a service mesh provides to secure service-to-service traffic in a cloud-native environment. It belongs to the Cloud Security category of cybersecurity.

The set of identity, encryption, and authorization controls a service mesh provides to secure service-to-service traffic in a cloud-native environment.

Service mesh security is the security model offered by service meshes such as Istio, Linkerd, Consul, and Cilium Service Mesh. It places a sidecar or node-level proxy next to every workload and uses that proxy to enforce mutual TLS between services, automatic certificate rotation, fine-grained authorization (allow/deny by source identity, path, method, JWT claims), and observability for traffic. The mesh shifts trust from network location to workload identity, supporting zero-trust architectures inside Kubernetes and multi-cluster environments. Risks include sidecar misconfiguration, control-plane compromise, certificate-authority weaknesses, and bypassed traffic when sidecar injection is incomplete. Defenses include CIS-style hardening, policy review, and monitoring of the mesh control plane.

Defences for Service Mesh Security typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Mesh security, Sidecar security.