Kubescape

Overview

Kubescape is an open-source security platform for Kubernetes, combining a CLI with an operator for ongoing cluster monitoring. It suits teams that want to run security checks in their own environments, including offline or air-gapped setups. Its breadth—from configuration review to runtime detection—is compelling, provided your team is prepared to operate the tooling itself.

Created and maintained by ARMO, Kubescape is licensed under Apache 2.0. Scan results can be exported as JSON or JUnit XML, or rendered as HTML or PDF. Results retained in a cluster are ephemeral, regularly updated, and regenerable, so they are not a substitute for a separate durable reporting archive.

Kubescape belongs among Kubernetes Security Software, Cloud Security Platforms, Cloud Vulnerability Scanners, Security Configuration Management Software, Container Security Software, and Infrastructure as Code Security Software.

Key features

Configuration and policy checks

The CLI analyzes Kubernetes manifests and Helm charts, while checks against live clusters can catch misconfigurations after deployment. Open Policy Agent evaluates Kubernetes objects against posture controls written in Rego. That flexibility is useful for teams with policy expertise, but it places the burden of authoring and maintaining custom controls on them.

Vulnerability and runtime coverage

The operator scans deployed container images for vulnerabilities with Grype and public vulnerability databases. It also monitors active clusters for suspicious activity and threats. Together, these checks extend beyond static configuration, although teams should expect to manage a continuously running operator for ongoing cluster coverage.

Compliance and integrations

Supported frameworks include CIS, NSA-CISA, MITRE ATT&CK, and SOC 2, giving teams recognizable baselines for posture assessment. Integrations for GitHub, GitLab CI/CD, Lens, and Visual Studio Code connect Kubescape to development and cluster workflows rather than isolating security review in a separate tool.

Offline operation and reporting

The CLI can download artifacts for local use, making Kubescape suitable for offline and air-gapped operation. JSON and JUnit XML exports support programmatic handling, while HTML and PDF output offer human-readable reports. Kubescape’s in-cluster results are treated as temporary and regenerable, so teams needing lasting records should plan their own retention approach.

Pricing

Kubescape open source

The open-source plan costs nothing and includes the Apache 2.0 license, CLI, Kubernetes operator, and self-hosted deployment. It is the clear fit for teams able to manage their own installation and operations; its main trade-off is that the package is self-hosted rather than a hosted service.

ARMO Platform

ARMO Platform has custom pricing dependent on vCPUs and other cloud resources. It is the compatible option for uploading scan results and downloading custom artifacts, but teams should weigh that resource-dependent cost against the free self-hosted workflow.

Platforms

Kubescape supports API, Linux, macOS, Windows, and self-hosted deployment. Its self-hosted orientation and offline CLI make it a stronger fit for teams controlling their Kubernetes environment than for readers seeking a conventional end-user desktop or mobile security app.

Who it's for

Kubescape is best suited to platform and security teams responsible for Kubernetes clusters who want one open-source tool spanning configuration, image vulnerabilities, compliance, and runtime monitoring. It is particularly relevant where air-gapped operation or self-hosting is a requirement. Teams that want a managed service, durable in-cluster result retention, or a workflow centered on ARMO’s custom artifacts should consider whether the separately priced ARMO Platform fits better.

Pros and cons

Pros

• Broad Kubernetes coverage: configuration checks, image vulnerability scanning, compliance assessments, and runtime monitoring address several stages of cluster security.
• Open-source and self-hosted: the Apache 2.0 CLI and operator are available at no charge, with deployment under the team’s control.
• Works offline: locally downloaded artifacts support air-gapped workflows that cannot rely on routine external access.
• Useful integration and export options: GitHub, GitLab CI/CD, Lens, and Visual Studio Code integrations plus multiple report formats give teams routes into existing workflows.

Cons

• Self-hosted operation is a real responsibility: teams must run the CLI and operator rather than rely on a hosted core plan.
• Cluster results are ephemeral: regularly updated, regenerable results do not provide durable in-cluster history.
• ARMO Platform costs vary with resources: its price depends on vCPUs and other cloud resources, making it less straightforward to budget than the free open-source edition.

Alternatives

Armor is a better fit when endpoint protection is the priority: its $99 a month Premium Tier is billed per endpoint and includes malware protection, file integrity monitoring, intrusion prevention, and vulnerability scanning.

Prowler Cloud is worth considering for cloud checks across accounts: its 15-day free trial has no cloud account limit and includes every check and compliance framework, while its open-source plan is also free.

Skyhigh Private Access is an alternative for readers seeking a paid product across Android, iOS, macOS, web, and Windows.

C3M Cloud Control offers a free cloud security assessment for up to two cloud accounts, making it an option for a limited initial assessment.

Microsoft Defender for Individuals is a paid alternative with a free trial for personal device protection across Android, iOS, macOS, web, and Windows.

Onam Security API Security is aimed at API security; its free plan lasts indefinitely and covers one cloud account, up to 500 resources, and 30 days of finding history.

Qualys TotalCloud offers a free license with limited API calls for control evaluation, alongside a paid cloud platform subscription.

Palo Alto Networks Cortex Cloud API Security is another API security alternative, with API, Linux, and web platforms.

Verdict

Choose Kubescape if you need a free, self-hosted Kubernetes security tool that spans posture, image vulnerabilities, compliance, and runtime monitoring, especially in offline environments. Look elsewhere if you need a managed core service or persistent in-cluster results; for scan uploads and custom artifacts, ARMO Platform is the compatible route, with cost tied to cloud resources.