KCheckOps
Kubescape
Kubescape is an Apache-2.0 Kubernetes security platform for IDEs, CI/CD and clusters, with risk analysis, compliance frameworks, misconfiguration and vulnerability scanning.
- Security Testing
- Open source
- Free
- Container Security
- Kubernetes
- Security testing
- Release & CI gates
- Production monitoring & observability
Latest public signals
Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.
Introduction
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines and clusters. It includes risk analysis, security and compliance checks, and misconfiguration scanning. It is a CNCF project.
The source code is at kubescape/kubescape on GitHub under the Apache-2.0 licence, with about 11,900 stars; the most recent commit was on 10 November 2026.
Features
- Manifest and cluster scanning: Scan YAML, Helm charts and live clusters.
- Frameworks: NSA-CISA, MITRE ATT&CK and CIS checks; see docs.
- Image scanning: Vulnerability scanning of workloads.
- Operator: Continuous in-cluster scanning.
- IDE and CI: VS Code and pipeline integrations.
Pros
- Free to use: Open source under Apache-2.0.
- Maintained: Commits as recent as 10 November 2026.
- Community: About 11,900 GitHub stars.
Cons
- Breadth means setup: Operator and integrations take configuration.
- Noise: Tune controls to your policies.
Usage and Links (Example)
kubescape scan
kubescape scan framework nsa ./manifestsResources:
Pricing
Kubescape is free and open source under the Apache-2.0 licence.
Recommended for?
- Kubernetes teams wanting one security tool from IDE to cluster.
- Compliance-driven organisations.
- Not a fit for non-Kubernetes estates.
Conclusion
Kubescape covers Kubernetes security from manifests to running clusters.
Alternatives
Other tools on CheckOps that cover similar ground. Open a page, or compare one with Kubescape side by side.
Kkube-benchkube-bench is Aqua Security's Apache-2.0 tool that checks whether Kubernetes is deployed according to the CIS Kubernetes Benchmark.Compare with Kubescape
PPolarisPolaris is Fairwinds' Apache-2.0 tool that validates Kubernetes workloads against best practices as a dashboard, admission controller or CLI.Compare with Kubescape
KKubeLinterKubeLinter is StackRox's Apache-2.0 static analysis tool that checks Kubernetes YAML files and Helm charts against best practices for security and production readiness.Compare with Kubescape
CCheckovCheckov is an Apache-2.0 static analysis tool for infrastructure as code (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile and more) that also does SCA for images and open-source packages.Compare with Kubescape
TTrivyTrivy is Aqua Security's Apache-2.0 all-in-one scanner for container images, filesystems, Git repos, VM images and Kubernetes, finding CVEs, IaC misconfigurations, secrets, licences and SBOM data.Compare with Kubescape
FFalcoFalco is the CNCF's Apache-2.0 cloud-native runtime security tool that detects abnormal behaviour in hosts, containers and Kubernetes using system calls and rules.Compare with Kubescape