ing at the sidecar model, an application compromise includes takeover of the sidecar and any associated identity/key material. In Istio&rsquo;s ambient mode, no data plane components run in the same pod as the application and therefore an application compromise does not lead to the access of secrets.</p><p>What about Envoy Proxy as a potential target for vulnerabilities? Envoy is an extremely hardened piece of infrastructure under intense scrutiny and <a href=https://www.infoq.com/news/2018/12/envoycon-serv