About Kubescape
Kubescape is an open source security platform for Kubernetes, created by ARMO. It is a CNCF incubating project that covers configuration, vulnerability, policy and runtime checks.
What it does
Kubescape scans Kubernetes manifests, Helm charts and running clusters for misconfigurations and known vulnerabilities. It checks clusters against well-known security frameworks, and it can validate network policies and seccomp profiles. For active clusters, it also watches for suspicious runtime behavior, which adds a layer beyond static checks.
Key features
- Scans manifests, Helm charts and live clusters
- Checks against CIS, NSA-CISA and MITRE ATT&CK
- Validates network policies and seccomp profiles
- Runtime threat detection in active clusters
- Integrates with VS Code and GitHub Actions
Who it's for
Kubescape fits platform engineers, cluster operators and DevSecOps teams who run Kubernetes in production or in development. Teams that do not use Kubernetes will get little from it.
Pricing and good to know
Kubescape is licensed under Apache-2.0 and is free to use. It works across major cloud providers and Kubernetes distributions, so it can follow you if you change platforms. The project's documentation includes getting started guides, and the repository is the best place to check release notes.
Highlights
- Scans manifests, Helm charts and live clusters
- Checks against CIS, NSA-CISA and MITRE ATT&CK
- Validates network policies and seccomp profiles
- Runtime threat detection in active clusters
- Integrates with VS Code and GitHub Actions
