Deepfence ThreatMapper

ThreatMapper is a self-hosted security platform for teams that need to find and prioritize risks across production workloads. It is strongest for Linux-based environments spanning containers, cloud and on-premise infrastructure; experimental Windows Server support rules it out for production Windows workloads.

Overview

ThreatMapper discovers pods, containers, applications and infrastructure, mapping their topology and attack surface while ranking threats by exploit risk. Its Threat Graph ties vulnerabilities, exposed secrets and compliance issues to live and recent network flows, security groups and workload status. That context gives teams a way to prioritize findings by their relationship to current exposure, rather than treating every scan result as equally urgent.

The single management console can cover multiple workload types and cloud and on-premise deployments. It runs in containers on a Docker host or a dedicated Kubernetes cluster and provides HTTPS administration and API automation. This breadth is useful for teams consolidating security work across a mixed estate, but the self-hosted deployment means they must operate the console themselves.

Key features

Workload discovery and scanning

Runtime SBOMs cover running pods, containers, serverless apps, applications and operating systems, with vulnerability matching against multiple feeds. Secret detection looks for exposed keys, tokens and passwords in containers and host filesystems. Image-build scanning also supports CircleCI, Jenkins and GitLab, connecting checks to common build pipelines. Together, these capabilities cover both running workloads and images before deployment; teams seeking only a narrow image scanner may not need the wider platform.

Threat context and compliance

Infrastructure configuration is assessed against CIS, PCI-DSS, HIPAA and other compliance benchmarks. The Threat Graph combines those results with vulnerability and secret findings and network context, helping security teams distinguish issues that may warrant faster attention. It does not remove the need to investigate findings and decide remediation priorities.

Operations and integrations

Documented integrations include Slack, PagerDuty, Jira, Splunk, ELK, Sumo Logic and AWS S3. Sensor agents connect to the console over TLS using a URL and API key. Sensor requirements include 0.2 CPU cores, 200 MB to 1 GB of RAM, Linux kernel 4.4 or newer, and access to console port 443. These are useful deployment constraints to check against hosts and network policy before rolling out agents.

Cloud Scanner tasks run locally through Terraform modules, use typically read-only cloud API access, and do not listen for remote connections or control. That approach limits the scanner's cloud access profile, while still requiring teams to provision and run the Terraform-based tasks.

Pricing

ThreatMapper is offered as a free, self-hosted project. The ThreatMapper plan costs nothing and has no limits or hidden features. It includes image scanning, runtime protection, Kubernetes security, registry scanning and SBOM generation, so there is no cheaper tier that trades away those capabilities. The project is licensed under Apache 2; GitHub issues and a Deepfence Community Slack channel provide support options. Teams should account for operating the management console and sensors themselves.

Platforms

ThreatMapper supports API, Linux, self-hosted, web and Windows environments. Windows Server support is experimental and not suitable for production use, so the practical fit is Linux-based workloads. The console can span on-premise and cloud deployments, with its own Docker host or dedicated Kubernetes cluster required.

Who it's for

ThreatMapper suits security and platform teams responsible for containerized and other production workloads across more than one environment, especially when they want discovery, SBOM-based vulnerability scanning, secret detection and compliance checks in one self-managed system. It is a poor match for organizations that require production-ready Windows Server coverage or do not want to operate security infrastructure themselves.

Pros and cons

• Pros: One console covers multiple workload types across cloud and on-premise deployments, reducing the need to split those environments across separate views.
• Pros: Threat Graph adds network, security-group and status context to vulnerability, secret and compliance findings, supporting risk-based prioritization.
• Pros: The free Apache 2 project includes image and registry scanning, runtime protection, Kubernetes security and SBOM generation without plan limits.
• Cons: Self-hosting requires a Docker host or dedicated Kubernetes cluster and ongoing operation of the console.
• Cons: Windows Server support is experimental, making ThreatMapper unsuitable for production Windows estates.
• Cons: Sensors require Linux kernel 4.4 or newer and access to port 443 on the console, which may constrain deployment on older hosts or tightly restricted networks.

Alternatives

Choose Docker Desktop instead when a freemium desktop-oriented option fits better: its free Personal plan includes Docker Engine and Kubernetes, Docker Hub, Docker Scout and Docker Debug, while Pro costs $9 a month.

Snyk Open Source is an alternative for teams focused on software composition analysis: its free plan covers five projects and Snyk Open Source (SCA), while the Team plan costs $25 a month.

Kubescape is another free, self-hosted Apache 2.0 option, with a CLI and Kubernetes operator.

Consider Trivy for a free, Apache-2.0-licensed open-source scanner.

Dockle is a free open-source container image linter.

Grype is a free, Apache-2.0-licensed open-source vulnerability scanner.

Kyverno is a free open-source project under the Apache License 2.0.

Qualys External Attack Surface Management offers a 30-day, no-cost trial of CSAM with EASM for teams considering that option.

For more options, browse Container Security Software.

Verdict

Choose ThreatMapper if your team wants a free, self-hosted way to discover and assess diverse production workloads, with network context to help rank issues. Its broad scanning and single-console scope are the main reasons to pick it; the need to run the platform and its lack of production-ready Windows Server support are the clearest reasons to look elsewhere.