CIS Kubernetes Benchmark checks
Aqua Security tool that checks whether Kubernetes nodes and control-plane components are configured according to the CIS Kubernetes Benchmark.
kube-bench runs the checks of the CIS Kubernetes Benchmark against a node: file permissions, API server flags, kubelet configuration and so on. Checks are defined in YAML so they can follow new benchmark versions and managed distributions such as EKS, GKE and AKS.
It is usually run as a Kubernetes Job on each node type and reports pass, fail and warning results with remediation text.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
No published advisory found for kube-bench in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
Kubernetes security posture and compliance scanner
CNCF project that scans clusters, manifests and Helm charts against frameworks such as the NSA-CISA guidance and CIS Benchmarks, and scans images.
Runtime threat detection for containers and hosts
CNCF graduated project that watches Linux system calls (via eBPF or a kernel module) and raises alerts when rules detect suspicious behaviour.
Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
Cloud security posture and compliance checks
Open-source cloud security platform that runs hundreds of checks against AWS, Azure, Google Cloud, Kubernetes and Microsoft 365, mapped to compliance frameworks.
Vulnerability scanner for images, file systems and SBOMs
Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.
