Kubernetes security posture and compliance scanner
CNCF project that scans clusters, manifests and Helm charts against frameworks such as the NSA-CISA guidance and CIS Benchmarks, and scans images.
Kubescape checks Kubernetes clusters and YAML or Helm files against controls grouped into frameworks such as the NSA-CISA Kubernetes Hardening Guidance, MITRE ATT&CK and CIS Benchmarks, and gives a risk score with remediation hints. It can also scan container images for vulnerabilities.
It runs as a CLI, in CI, in the IDE or as an in-cluster operator for continuous monitoring. Kubescape is a Cloud Native Computing Foundation (CNCF) project.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
No published advisory found for Kubescape in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
Runtime threat detection for containers and hosts
CNCF graduated project that watches Linux system calls (via eBPF or a kernel module) and raises alerts when rules detect suspicious behaviour.
CIS Kubernetes Benchmark checks
Aqua Security tool that checks whether Kubernetes nodes and control-plane components are configured according to the CIS Kubernetes Benchmark.
Cloud security posture and compliance checks
Open-source cloud security platform that runs hundreds of checks against AWS, Azure, Google Cloud, Kubernetes and Microsoft 365, mapped to compliance frameworks.
Static analysis for infrastructure as code
Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.
Multi-cloud security auditing tool
NCC Group's multi-cloud auditing tool that collects configuration data through cloud APIs and highlights risk areas in an offline HTML report.
