- Home
- Container Security Software
- Deepfence ThreatMapper
Deepfence ThreatMapper
What it is
Deepfence ThreatMapper is a free, self-hosted security tool that identifies production workloads and ranks threats by exploit risk. It discovers pods, containers, applications, and infrastructure, then maps their topology and attack surface. For running workloads and operating systems, it generates runtime software bills of materials and checks them against multiple vulnerability feeds. It also finds exposed keys, tokens, and passwords in containers and host filesystems, and evaluates infrastructure settings against CIS, PCI-DSS, HIPAA, and other benchmarks. Threat Graph connects these findings with network flows, security groups, and live status. The management console runs in containers on a Docker host or a dedicated Kubernetes cluster, and provides HTTPS administration and API automation. A single console can manage multiple workload types across on-premise and cloud deployments. Documented integrations include Slack, PagerDuty, Jira, Splunk, ELK, Sumo Logic, and AWS S3. Image-build scanning supports CircleCI, Jenkins, and GitLab. The project is offered under the Apache 2 license, with GitHub issues and a community Slack channel for support.
For and against
For
- Ranks production threats by exploit risk.
- Generates runtime SBOMs and checks multiple vulnerability feeds.
- Detects exposed credentials in containers and host filesystems.
- One console manages cloud and on-premise deployments.
- Free under the Apache 2 license.
Against
- Windows Server support is experimental and not for production.
- Sensor requires Linux kernel 4.4 or newer.
- Sensor needs access to console port 443.
The verdict
ThreatMapper brings workload discovery, vulnerability scanning, secret detection, and compliance findings into one self-hosted tool. Windows Server support is experimental, so it is not suitable for production use on that platform.
Who it suits
ThreatMapper suits teams looking to scan and manage security issues across self-hosted production workloads and infrastructure. It may fit environments spanning cloud and on-premise deployments that can operate its container-based console.
Plans and prices
ThreatMapper
no limits · no hidden features
Read 30 Sep 2026 · threatmapper.org
On the record
- CI/CD
- Image-build scanning supports CircleCI, Jenkins and GitLab.threatmapper.org · read 30 Sep 2026
- Cloud scanning
- Cloud Scanner tasks run locally through Terraform modules, use typically read-only cloud API access and do not listen for remote connections or control.threatmapper.org · read 30 Sep 2026
- Compliance
- It evaluates infrastructure configuration against CIS, PCI-DSS, HIPAA and other compliance benchmarks.threatmapper.org · read 30 Sep 2026
- Deployment scope
- A single console can manage multiple workload types and on-premise and cloud deployments simultaneously.threatmapper.org · read 30 Sep 2026
- Integrations
- Documented integrations include Slack, PagerDuty, Jira, Splunk, ELK, Sumo Logic and AWS S3.threatmapper.org · read 30 Sep 2026
- License and support
- The ThreatMapper project is offered under the Apache 2 license, with GitHub issues and a Deepfence Community Slack channel available for support.github.com · read 30 Sep 2026
- Management console
- The standalone management console runs as containers on a Docker host or dedicated Kubernetes cluster and exposes HTTPS administration and API automation.threatmapper.org · read 30 Sep 2026
- Purpose
- ThreatMapper hunts for hidden threats in production platforms and ranks them by risk of exploit.threatmapper.org · read 30 Sep 2026
- SBOM vulnerability scanning
- It generates runtime SBOMs for running pods, containers, serverless apps, applications and operating systems and matches them against multiple vulnerability feeds.threatmapper.org · read 30 Sep 2026
- Secret detection
- It detects exposed keys, tokens and passwords in containers and host filesystems.threatmapper.org · read 30 Sep 2026
- Sensor requirements
- Sensor requirements include 0.2 CPU cores, 200 MB to 1 GB RAM, Linux kernel version 4.4 or newer and access to console port 443.threatmapper.org · read 30 Sep 2026
- Sensor security
- Sensor agents communicate with the management console over TLS using a URL and API key.threatmapper.org · read 30 Sep 2026
- Threat Graph
- The Threat Graph correlates vulnerabilities, secrets and compliance issues with live and recent network flows, security groups and live status.threatmapper.org · read 30 Sep 2026
- Windows support
- Windows Server support is experimental and not suitable for production use.threatmapper.org · read 30 Sep 2026
- Workload discovery
- It scans platforms to identify pods, containers, applications and infrastructure and maps their topology and attack surface.threatmapper.org · read 30 Sep 2026
