Kubescape

Kubescape is an open-source Kubernetes security platform for checking configuration, vulnerabilities, compliance, and activity in running clusters. It analyzes Kubernetes manifests, Helm charts, and live clusters for misconfigurations. Its operator scans deployed container images for vulnerabilities using Grype and public vulnerability databases, and monitors clusters for suspicious runtime activity and threats. Kubescape supports frameworks including CIS, NSA-CISA, MITRE ATT&CK, and SOC 2. Its policy engine uses Open Policy Agent to check Kubernetes objects against posture controls written in Rego. The operator runs as microservices that continually monitor cluster security posture. Integrations include GitHub, GitLab CI/CD, Lens, and Visual Studio Code. The CLI can download artifacts for local use, supporting offline and air-gapped operation. Scan results can be exported as JSON or JUnit XML, or rendered as HTML or PDF. The self-hosted CLI and operator are free under the Apache License, Version 2.0. ARMO Platform is a compatible provider for uploading scan results and downloading custom artifacts; its pricing depends on vCPUs and other cloud resources.

Kubescape provides free, self-hosted Kubernetes scanning and ongoing cluster monitoring, with several report formats and development-tool integrations. ARMO Platform is a compatible provider for scan uploads and custom artifacts, with pricing based on resource use.

Kubescape suits teams that operate Kubernetes clusters and need configuration, vulnerability, compliance, or runtime security checks. Its offline and air-gapped CLI operation may suit environments that download artifacts for local use.

Overview

Kubescape is an open-source security platform for Kubernetes teams that want to manage cluster checks themselves. Its CLI and operator cover configuration, image vulnerabilities, compliance, and activity in running clusters. The main trade-off is operational ownership: the free core is self-hosted, while ARMO Platform adds a compatible route for scan uploads and custom artifacts at resource-based pricing.

Created and maintained by ARMO, Kubescape is licensed under Apache 2.0. The CLI can download artifacts for offline or air-gapped use, a practical fit for restricted environments. Scan results export as JSON or JUnit XML, or can be rendered as HTML or PDF. In-cluster results are treated as temporary and regularly updated, but regenerable.

It sits across Kubernetes Security Software, Container Security Software, Cloud Security Platforms, Cloud Vulnerability Scanners, Security Configuration Management Software, and Infrastructure as Code Security Software.

Key features

Configuration and policy checks

Kubescape scans Kubernetes manifests, Helm charts, and live clusters for misconfigurations. Its Open Policy Agent engine checks Kubernetes objects against posture controls written in Rego, while framework support includes CIS, NSA-CISA, MITRE ATT&CK, and SOC 2. This combination suits teams that need checks spanning their deployment definitions and running environment, though policy controls require familiarity with Rego to tailor them.

Image and runtime security

The operator scans deployed container images for vulnerabilities using Grype and public vulnerability databases. It also provides runtime monitoring and detection for suspicious activity and threats in active clusters. The operator runs as microservices that continually monitor cluster security posture, giving teams ongoing visibility rather than a one-off scan; it also means the self-hosted approach includes an in-cluster component to operate.

Integrations and reporting

Integrations are available for GitHub, GitLab CI/CD, Lens, and Visual Studio Code. JSON and JUnit XML exports support downstream handling, while HTML and PDF rendering offer report formats for readers who do not need raw scan output. ARMO Platform is the compatible provider for uploading scan results and downloading custom artifacts.

Project support

The project aims to respond to issues within 48 hours and provides CNCF Slack users and developers channels. That is useful community support, but it is not a substitute for a stated commercial support commitment.

Pricing

Kubescape open source: free. The plan includes the CLI and Kubernetes operator, is self-hosted, and is covered by the Apache 2.0 license. It is the direct choice for teams prepared to run the software themselves and accept the ongoing work of operating cluster monitoring.

ARMO Platform: custom pricing. Cost depends on vCPUs and other cloud resources. It provides a compatible option for scan uploads and custom artifacts, but the resource-based model means it is not a fixed-price alternative to the free self-hosted core.

Platforms

Kubescape supports API, Linux, macOS, Windows, and self-hosted deployment. Its Kubernetes focus and self-hosted operator make it a fit for teams managing their own clusters, while the CLI's offline artifact workflow accommodates air-gapped use.

Who it's for

Kubescape is best for Kubernetes teams that want a free, Apache-licensed tool spanning configuration review, image vulnerability scanning, compliance checks, and runtime monitoring, and that can operate a self-hosted CLI and operator. It is less suited to buyers seeking a fixed-price hosted service or those who do not want to maintain an in-cluster monitoring component.

Pros and cons

• Pros: The free Apache 2.0 core combines manifest, Helm chart, live-cluster, and deployed-image scanning with runtime monitoring, so teams can cover several Kubernetes security tasks in one self-hosted tool.
• Pros: Offline artifact downloads and JSON, JUnit XML, HTML, and PDF outputs serve both restricted environments and varied reporting workflows.
• Cons: The CLI and operator are self-hosted, so teams must take responsibility for running the software and its cluster microservices.
• Cons: ARMO Platform pricing varies with vCPUs and other cloud resources, making costs dependent on usage rather than a simple fixed rate.

Alternatives

For a different security focus, these alternatives may fit better:

• Qualys External Attack Surface Management offers a 30-day no-cost CSAM with EASM plan and a free trial, a better fit for a time-limited evaluation of external attack surface management than for Kubescape's Kubernetes-centered checks.
• Chef InSpec has a free plan for unlimited duration, limited to non-production workloads and personal, non-commercial use; choose it when those constraints suit the intended use.
• Lynis is free and open source under GPLv3, with a SaaS premium plan at $36 a year; it is an alternative for readers considering its Linux and macOS-oriented offering.
• OpenSCAP offers free open-source tools across its project umbrella, making it an option for readers seeking that toolset.
• Prowler Cloud offers a 15-day trial with no cloud account limit and every check and compliance framework; choose it when that trial scope is a better match.
• CloudSploit offers a self-hosted open-source version and a hosted commercial version; it is an alternative for readers weighing those deployment options.
• Mondoo CSPM offers free open-source tools for cloud, Kubernetes, OS, SaaS, and API scanning, including a Kubernetes operator; it is worth considering when that broader stated scan scope is preferable.
• DigitalOcean Cloud Security Posture Management has a free plan for unlimited manual scans of standard rules and a $5 a month Basic plan with one workload scan per day; choose it when those scan limits and pricing structure fit.

Verdict

Choose Kubescape if your team wants broad Kubernetes security checks without a license charge and is willing to run the CLI and operator itself. Its strongest case is combining configuration, image, compliance, and runtime coverage with offline use and multiple report formats. Look elsewhere if self-hosting is a poor fit or you need predictable fixed pricing for the compatible platform layer.