Kubescape

Kubescape, developed by ARMO and governed as an open-source project under the Cloud Native Computing Foundation (CNCF), is an industry-leading Kubernetes security, compliance, and vulnerability scanning tool. Built to give developers and platform engineers immediate visibility into cluster risks, Kubescape scans running Kubernetes clusters, YAML configuration manifests, Helm charts, and Kustomize files to identify security misconfigurations, software vulnerabilities, and compliance drifts. Kubescape evaluates environments against respected industry security benchmarks, including the NSA-CISA Kubernetes Hardening Guidance, CIS Kubernetes Benchmarks, and the MITRE ATT&CK container framework. The tool performs deep vulnerability analysis across container images, highlighting critical CVEs and correlating them with cluster configuration data to determine whether vulnerable components are actually exposed to network traffic. Kubescape also features robust Role-Based Access Control (RBAC) analysis, mapping out complex user and service account permissions to expose risky privilege escalation paths. Packaged as a versatile command-line utility, VS Code extension, and cluster-native operator, Kubescape integrates effortlessly into GitOps workflows and CI/CD pipelines, allowing engineering teams to catch and fix Kubernetes security flaws before deploying applications to production clusters.