Deepfence ThreatMapper

ThreatMapper is a self-hosted security platform for teams that need to map and assess container, cloud, and on-premise workloads. It is strongest in Linux-based environments where security staff can run its console and act on findings spanning vulnerabilities, secrets, and compliance.

Overview

ThreatMapper discovers pods, containers, applications, and infrastructure, mapping their topology and attack surface before ranking threats by exploit risk. Its Threat Graph adds useful context by correlating vulnerabilities, exposed secrets, and compliance issues with live and recent network flows, security groups, and live status. That combination helps teams prioritize findings in relation to their environment rather than review each scan result in isolation.

The deployment is self-hosted: the management console runs in containers on a Docker host or a dedicated Kubernetes cluster, and provides HTTPS administration and API automation. A single console can cover multiple workload types across cloud and on-premise deployments, a practical advantage for mixed estates. The trade-off is that teams must operate the console themselves.

Key features

Discovery and scanning

Runtime SBOMs cover running pods, containers, serverless apps, applications, and operating systems, with matches against multiple vulnerability feeds. ThreatMapper also detects exposed keys, tokens, and passwords in containers and host filesystems. Image-build scanning supports CircleCI, Jenkins, and GitLab, extending checks into build workflows rather than limiting them to running workloads.

Risk context and compliance

The Threat Graph connects vulnerabilities, secrets, and compliance findings to live and recent network flows, security groups, and workload status. Infrastructure configuration checks cover CIS, PCI-DSS, HIPAA, and other benchmarks. This breadth is valuable for teams that want one view across technical exposure and configuration posture; it does not remove the need to decide which findings warrant remediation.

Operations and integrations

Documented integrations include Slack, PagerDuty, Jira, Splunk, ELK, Sumo Logic, and AWS S3. Sensors communicate with the console over TLS using a URL and API key. Sensor requirements include 0.2 CPU cores, 200 MB to 1 GB RAM, Linux kernel 4.4 or newer, and access to console port 443, so Linux compatibility and network access are important deployment considerations.

Cloud Scanner tasks run locally through Terraform modules, typically use read-only cloud API access, and do not listen for remote connections or control. The project uses the Apache 2 license, with GitHub issues and a Deepfence Community Slack channel for support.

Pricing

ThreatMapper costs nothing, with no limits or hidden features. The free plan includes image scanning, runtime protection, Kubernetes security, registry scanning, and SBOM generation. That makes it a strong fit for teams that can self-host and want broad scanning without a paid tier or usage cap; its cost advantage does not offset the operational work of managing the console.

Platforms

ThreatMapper supports API, Linux, self-hosted, web, and Windows environments. Its Windows Server support is experimental and unsuitable for production, so organizations with production Windows Server workloads should not rely on it as their security platform for those systems.

Who it's for

ThreatMapper suits security and infrastructure teams overseeing containerized workloads across cloud and on-premise environments, especially those that value runtime SBOMs, image scanning, secret detection, and compliance checks in one self-managed system. It is less suitable for teams that need production-ready Windows Server coverage or do not want to run a Docker- or Kubernetes-based management console.

Pros and cons

• Pro: One console covers multiple workload types and cloud or on-premise deployments, giving mixed estates a common place to assess findings.
• Pro: Threat Graph context links findings to network activity, security groups, and live status, supporting more informed prioritization.
• Pro: The free plan includes image and registry scanning, runtime protection, Kubernetes security, and SBOM generation without limits or hidden features.
• Con: The management console must be self-hosted on Docker or Kubernetes, adding infrastructure and operations responsibility.
• Con: Experimental Windows Server support makes it unsuitable for production Windows Server protection.
• Con: Sensors require Linux kernel 4.4 or newer and access to console port 443, which constrains deployment environments.

Alternatives

For a broader directory of related tools, see Container Security Software.

• Docker Desktop is a better fit when the priority is Docker Engine and Kubernetes tooling, Docker Hub, Scout, and Debug, with a free Personal plan and a paid Pro plan at $9 a month.
• Snyk Open Source suits teams focused on open-source dependency analysis and willing to work within its Free plan's 5-project limit or consider its Team tier.
• Trivy is a free Apache-2.0 licensed open-source scanner for teams seeking a scanner across Linux, macOS, self-hosted, and Windows platforms.
• Kubescape is an alternative open-source option with a CLI and Kubernetes operator for self-hosted use under Apache 2.0.
• Qualys External Attack Surface Management is worth considering for a 30-day no-cost trial of its CyberSecurity Asset Management 3.0 with EASM.
• Grype is a free Apache-2.0 licensed open-source vulnerability scanner.
• Kyverno is a free Apache 2.0 open-source project.
• RapidFort may suit teams looking for curated near-zero-CVE container images, with its free plan limited to five images from a limited catalog and daily rebuilds and patching.

Verdict

Choose ThreatMapper if you want a no-cost, self-hosted platform that combines workload discovery, scanning, compliance checks, and risk context across Linux-based cloud and on-premise environments. Its broad coverage and unlimited free plan are compelling; look elsewhere if you need production Windows Server support or prefer not to operate the management console.