Overview

Kubescape is an open-source security platform for Kubernetes teams that want to manage cluster checks themselves. Its CLI and operator cover configuration, image vulnerabilities, compliance, and activity in running clusters. The main trade-off is operational ownership: the free core is self-hosted, while ARMO Platform adds a compatible route for scan uploads and custom artifacts at resource-based pricing.

Created and maintained by ARMO, Kubescape is licensed under Apache 2.0. The CLI can download artifacts for offline or air-gapped use, a practical fit for restricted environments. Scan results export as JSON or JUnit XML, or can be rendered as HTML or PDF. In-cluster results are treated as temporary and regularly updated, but regenerable.

It sits across Kubernetes Security Software, Container Security Software, Cloud Security Platforms, Cloud Vulnerability Scanners, Security Configuration Management Software, and Infrastructure as Code Security Software.

Key features

Configuration and policy checks

Kubescape scans Kubernetes manifests, Helm charts, and live clusters for misconfigurations. Its Open Policy Agent engine checks Kubernetes objects against posture controls written in Rego, while framework support includes CIS, NSA-CISA, MITRE ATT&CK, and SOC 2. This combination suits teams that need checks spanning their deployment definitions and running environment, though policy controls require familiarity with Rego to tailor them.

Image and runtime security

The operator scans deployed container images for vulnerabilities using Grype and public vulnerability databases. It also provides runtime monitoring and detection for suspicious activity and threats in active clusters. The operator runs as microservices that continually monitor cluster security posture, giving teams ongoing visibility rather than a one-off scan; it also means the self-hosted approach includes an in-cluster component to operate.

Integrations and reporting

Integrations are available for GitHub, GitLab CI/CD, Lens, and Visual Studio Code. JSON and JUnit XML exports support downstream handling, while HTML and PDF rendering offer report formats for readers who do not need raw scan output. ARMO Platform is the compatible provider for uploading scan results and downloading custom artifacts.

Project support

The project aims to respond to issues within 48 hours and provides CNCF Slack users and developers channels. That is useful community support, but it is not a substitute for a stated commercial support commitment.

Pricing

Kubescape open source: 0.00 USD per free. The plan includes the CLI and Kubernetes operator, is self-hosted, and is covered by the Apache 2.0 license. It is the direct choice for teams prepared to run the software themselves and accept the ongoing work of operating cluster monitoring.

ARMO Platform: custom pricing. Cost depends on vCPUs and other cloud resources. It provides a compatible option for scan uploads and custom artifacts, but the resource-based model means it is not a fixed-price alternative to the free self-hosted core.

Platforms

Kubescape supports API, Linux, macOS, Windows, and self-hosted deployment. Its Kubernetes focus and self-hosted operator make it a fit for teams managing their own clusters, while the CLI's offline artifact workflow accommodates air-gapped use.

Who it's for

Kubescape is best for Kubernetes teams that want a free, Apache-licensed tool spanning configuration review, image vulnerability scanning, compliance checks, and runtime monitoring, and that can operate a self-hosted CLI and operator. It is less suited to buyers seeking a fixed-price hosted service or those who do not want to maintain an in-cluster monitoring component.

Pros and cons

Pros: The free Apache 2.0 core combines manifest, Helm chart, live-cluster, and deployed-image scanning with runtime monitoring, so teams can cover several Kubernetes security tasks in one self-hosted tool.
Pros: Offline artifact downloads and JSON, JUnit XML, HTML, and PDF outputs serve both restricted environments and varied reporting workflows.
Cons: The CLI and operator are self-hosted, so teams must take responsibility for running the software and its cluster microservices.
Cons: ARMO Platform pricing varies with vCPUs and other cloud resources, making costs dependent on usage rather than a simple fixed rate.

Alternatives

For a different security focus, these alternatives may fit better:

Qualys External Attack Surface Management offers a 30-day no-cost CSAM with EASM plan and a free trial, a better fit for a time-limited evaluation of external attack surface management than for Kubescape's Kubernetes-centered checks.
Chef InSpec has a free plan for unlimited duration, limited to non-production workloads and personal, non-commercial use; choose it when those constraints suit the intended use.
Lynis is free and open source under GPLv3, with a SaaS premium plan at 36.00 USD per year; it is an alternative for readers considering its Linux and macOS-oriented offering.
OpenSCAP offers free open-source tools across its project umbrella, making it an option for readers seeking that toolset.
Prowler Cloud offers a 15-day trial with no cloud account limit and every check and compliance framework; choose it when that trial scope is a better match.
CloudSploit offers a self-hosted open-source version and a hosted commercial version; it is an alternative for readers weighing those deployment options.
Mondoo CSPM offers free open-source tools for cloud, Kubernetes, OS, SaaS, and API scanning, including a Kubernetes operator; it is worth considering when that broader stated scan scope is preferable.
DigitalOcean Cloud Security Posture Management has a free plan for unlimited manual scans of standard rules and a 5.00 USD per month Basic plan with one workload scan per day; choose it when those scan limits and pricing structure fit.

Verdict

Choose Kubescape if your team wants broad Kubernetes security checks without a license charge and is willing to run the CLI and operator itself. Its strongest case is combining configuration, image, compliance, and runtime coverage with offline use and multiple report formats. Look elsewhere if self-hosting is a poor fit or you need predictable fixed pricing for the compatible platform layer.

	Calico Enterprise	Kubescape
Free plan	No	Yes
Free trial	No	No
Paid from	—	Free
Open source	No	No
Platforms	Linux, self-hosted, Web, Windows	api, Linux, macOS, self-hosted, Windows
Free plan	No	Yes
Kubernetes security	—	Yes

Calico Enterprise vs Kubescape

Calico Enterprise

Kubescape