The packets move, but no one sees them. Every request, every response is wrapped, encrypted, and authenticated before it leaves the mesh. This is privacy by default in service mesh security—no opt-in, no extra flag, no manual wire setup. It happens automatically, for every workload, across every cluster.
A service mesh is more than a traffic router. It is a security layer that enforces identity, policy, and encryption as data moves between microservices. Privacy by default means mutual TLS (mTLS) is not a feature; it is the baseline. It eliminates plaintext traffic inside your mesh. It prevents service impersonation. It removes opportunities for passive network attacks.
In a properly configured mesh, every pod, container, or VM is issued a short-lived certificate. The mesh sidecar authenticates endpoints before any bytes flow. Policies define which service can talk to which, down to HTTP verbs or gRPC methods. Encryption is end-to-end inside the mesh—no hop is trusted without verification.
Privacy by default extends beyond TLS. Metadata is protected. Service-to-service authorization is granular and enforced centrally. Certificate rotation is automatic. Audit logs track every request, every identity, every decision made by the mesh control plane. This makes the security posture both strong and observable.