Kubescape

Kubescape: Open-Source Kubernetes Security Platform

Kubescape is a CNCF Incubating open-source project that provides comprehensive Kubernetes security scanning across the entire development and deployment lifecycle — from IDE to CI/CD pipeline to live cluster.

End-to-End Kubernetes Security

Kubescape scans Kubernetes manifests, Helm charts, and running clusters for vulnerabilities, misconfigurations, and compliance violations. It maps findings to industry frameworks including NSA-CISA Kubernetes Hardening Guidelines, MITRE ATT&CK, and CIS Benchmarks, giving security teams actionable, context-rich results.

Key Features

• Multi-stage scanning: IDE plugin, CI/CD integration, and live cluster scanning
• Compliance frameworks: NSA-CISA, MITRE ATT&CK, CIS Kubernetes Benchmark
• Runtime threat detection: eBPF-based runtime security with Kubescape 3.0+
• Vulnerability scanning: Container image CVE detection with EPSS scoring
• RBAC analysis: Identifies overly permissive Kubernetes role bindings
• AI integration: KAgent plugin for AI assistants to query security posture
• ARMO Platform: Commercial SaaS dashboard for team collaboration

Who Uses Kubescape?

Kubescape is used by DevSecOps teams and security engineers who need open-source Kubernetes security scanning without vendor lock-in. The ARMO Platform adds team management, historical trending, and enterprise features on top of the open-source core.

Pricing

Kubescape is free and open source. ARMO Platform has a free tier and paid plans for teams.