● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
K

Kubescape

IncubatingProvisioning & Security
Open source · CNCF · CNCF Incubating · Apache-2.0

Kubescape is an open source Kubernetes security platform built around static and runtime scanning.

updated 2026-07-01

What it is

Kubescape is an open source Kubernetes security platform built around static and runtime scanning. It ingests manifests, Helm charts, container images, registries, and running clusters, then checks them against compliance frameworks (NSA-CISA, MITRE ATT&CK, CIS Benchmarks) and known CVE databases. Output is a risk score plus prioritized findings — misconfigurations, exposed secrets, RBAC issues, vulnerable images — with remediation guidance. It runs as a CLI, in CI/CD, as an admission controller, or as an in-cluster operator with continuous scanning.

Despite the "Provisioning" category label here, this is fundamentally a security/compliance tool, not a provisioning engine. If you're looking for cluster or workload provisioning, look elsewhere.

Who builds it and why

Kubescape originated at ARMO, an Israeli cloud-native security company, and was donated to CNCF, where it now sits in the Incubating stage. ARMO still drives the bulk of development and uses Kubescape as the open core for its commercial platform. The project has 205 contributors and an active commit history, indicating it's not a single-vendor side project anymore, but ARMO's continued commercial interest in the space is worth knowing going in — it shapes roadmap priorities.

Production readiness signal

  • CNCF Incubating: passed the sandbox bar, meaning adoption and governance requirements are demonstrably met.
  • 11,503 GitHub stars, 205 contributors: healthy community size for a security-focused CNCF project, comparable to other tools in this space.
  • Active commit cadence: recent commit history through mid-2026 signals the project is not stagnant.
  • v4.0.10: major version 4 suggests the project has been through multiple breaking-change cycles and has stabilized its core architecture and APIs.
  • Apache-2.0, Go: standard, unrestrictive license; Go is the expected language for this tooling category and plays well with the rest of the K8s ecosystem (easy to embed, cross-compile, containerize).

No public data on founding date or company backing structure beyond ARMO's involvement — verify current governance status directly against the CNCF landscape before making procurement decisions.

Who should use this

  • Platform teams who need a single tool covering both shift-left (manifest/CI scanning) and shift-right (runtime cluster scanning) security checks.
  • Teams required to demonstrate compliance against NSA-CISA, MITRE ATT&CK, or CIS benchmarks for audits.
  • Organizations wanting vulnerability scanning integrated with configuration and RBAC posture checks rather than stitching together separate tools.
  • Teams already comfortable running CNCF incubating-stage projects and doing their own operational hardening.

Who should NOT use this

  • Teams needing enterprise SLAs, dedicated support, and guaranteed patch timelines out of the open source project itself — that's ARMO's commercial tier, not this repo.
  • Shops that already have a mature, integrated stack (e.g., Trivy for vuln scanning + OPA/Gatekeeper for policy + Falco for runtime) and don't want the overlap and migration cost of consolidating.
  • Small clusters or dev-only environments where the operational overhead of continuous scanning and framework tuning isn't worth it — a lighter CLI scanner in CI may suffice.
  • Teams wanting a pure provisioning/IaC tool — Kubescape does not provision infrastructure or manage cluster lifecycle; don't confuse it with tools in that space despite how it's categorized here.

Alternatives

  • Trivy (Aqua Security) — narrower focus on vulnerability and misconfiguration scanning for images and IaC, lighter weight, widely embedded in other tools' pipelines.
  • Falco (CNCF Graduated) — runtime threat detection via syscall monitoring; complements rather than replaces Kubescape's static/config scanning.
  • Checkov (Bridgecrew/Palo Alto) — IaC-focused static analysis across Terraform, CloudFormation, and Kubernetes manifests, less focused on live cluster runtime posture.

Pricing

Kubescape itself is fully open source under Apache-2.0 — no paywalled core features. ARMO offers a commercial platform (ARMO Platform) built on top with additional enterprise features, support, and hosted management, but the CNCF project remains free to self-host and operate.

Frequently asked

What is Kubescape?+
Kubescape is an open source Kubernetes security platform built around static and runtime scanning. It ingests manifests, Helm charts, container images, registries, and running clusters, then checks them against compliance frameworks (NSA-CISA, MITRE ATT&CK, CIS Benchmarks) and known CVE databases.
Who builds Kubescape?+
Kubescape originated at ARMO, an Israeli cloud-native security company, and was donated to CNCF, where it now sits in the Incubating stage. ARMO still drives the bulk of development and uses Kubescape as the open core for its commercial platform.
Is Kubescape production ready?+
CNCF Incubating: passed the sandbox bar, meaning adoption and governance requirements are demonstrably met. 11,503 GitHub stars, 205 contributors: healthy community size for a security-focused CNCF project, comparable to other tools in this space.
Who should use Kubescape?+
Platform teams who need a single tool covering both shift-left (manifest/CI scanning) and shift-right (runtime cluster scanning) security checks. Teams required to demonstrate compliance against NSA-CISA, MITRE ATT&CK, or CIS benchmarks for audits.
Who should not use Kubescape?+
Teams needing enterprise SLAs, dedicated support, and guaranteed patch timelines out of the open source project itself — that's ARMO's commercial tier, not this repo. Shops that already have a mature, integrated stack (e.g.
What are the alternatives to Kubescape?+
Trivy (Aqua Security) — narrower focus on vulnerability and misconfiguration scanning for images and IaC, lighter weight, widely embedded in other tools' pipelines. Falco (CNCF Graduated) — runtime threat detection via syscall monitoring; complements rather than replaces Kubescape's static/config scanning.
How much does Kubescape cost?+
Kubescape itself is fully open source under Apache-2.0 — no paywalled core features. ARMO offers a commercial platform (ARMO Platform) built on top with additional enterprise features, support, and hosted management, but the CNCF project remains free to self-host and operate.