Kubescape

Kubescape is an open-source security platform for teams running Kubernetes who want to manage security checks themselves. Its strongest case is breadth: configuration, image, compliance, and runtime coverage in a self-hosted tool. The trade-off is that its documented provider for scan uploads and custom artifacts is ARMO Platform, with resource-dependent pricing.

Overview

Created and maintained by ARMO, Kubescape combines a command-line interface with an operator that runs as microservices in a cluster. The operator continually monitors security posture, while the CLI can work offline or in air-gapped environments by downloading artifacts for local use. That makes Kubescape a credible fit for teams that need Kubernetes security checks without depending on a hosted service for their core workflow.

Scan results can be exported as JSON or JUnit XML, or rendered as HTML or PDF. In-cluster results are treated as ephemeral: they are regularly updated and can be regenerated. Teams needing durable records should plan to export results rather than rely on cluster retention.

It belongs among Kubernetes Security Software, Container Security Software, Cloud Security Platforms, Security Configuration Management Software, Cloud Vulnerability Scanners, and Infrastructure as Code Security Software.

Key features

Configuration, policy, and compliance

Kubescape analyzes Kubernetes manifests, Helm charts, and live clusters for misconfigurations. Its Open Policy Agent engine evaluates Kubernetes objects against posture controls written in Rego, giving teams a way to check configuration against their own policies as well as established frameworks. Support includes CIS, NSA-CISA, MITRE ATT&CK, and SOC 2. This range is useful for teams with multiple compliance or security baselines; it does not remove the work of choosing and maintaining appropriate controls.

Image and runtime coverage

The operator scans deployed container images for vulnerabilities using Grype and public vulnerability databases. Kubescape also supports registry scanning, SBOM generation, admission control, and runtime protection. Runtime monitoring detects suspicious activity and threats in active clusters, extending coverage beyond pre-deployment checks. The breadth is valuable for Kubernetes teams seeking several security functions in one platform, though the core deployment and ongoing management remain self-hosted responsibilities.

Workflow and deployment

Integrations cover GitHub, GitLab CI/CD, Lens, and Visual Studio Code, connecting checks with development and cluster workflows. Offline and air-gapped CLI operation is a practical advantage in restricted environments. ARMO Platform is the documented compatible provider for uploading scan results and downloading custom artifacts; teams that need those functions should account for its resource-based pricing.

Pricing

Kubescape open source — free

The free plan includes the Apache 2.0-licensed CLI and Kubernetes operator for self-hosted use. It is the natural choice for teams able to operate their own tooling and clusters, and it avoids a software subscription for the core platform. The cost advantage comes with self-management: in-cluster results are ephemeral, and the documented provider for scan uploads and custom artifacts is a separate offering.

ARMO Platform — custom pricing

Pricing depends on vCPUs and other cloud resources. This is the option to consider when scan-result uploads or custom-artifact downloads are needed, but resource-based pricing makes it less straightforward to budget than the free self-hosted core.

Platforms

Kubescape supports API, Linux, macOS, Windows, and self-hosted deployment. Its Kubernetes focus and self-hosted model make it a better fit for teams operating clusters than organizations looking for a general-purpose cloud security service.

Who it's for

Kubescape suits Kubernetes platform and security teams that want configuration checks, vulnerability scanning, compliance assessments, and runtime monitoring under an open-source license. It is particularly compelling for air-gapped or otherwise restricted environments, and for teams prepared to manage an operator and retain exported results themselves. It is less suitable for buyers who need a hosted workflow or predictable flat-rate pricing for scan uploads and custom artifacts.

Pros and cons

Pros

• Broad Kubernetes coverage: configuration, image vulnerabilities, compliance, and runtime detection are addressed in one platform.
• Self-hosted and offline options: the CLI can download artifacts for local use, including in air-gapped environments.
• Open-source core: the Apache 2.0 license, CLI, and operator are included in the free plan.
• Useful output and integrations: teams can export or render scan results and connect with GitHub, GitLab CI/CD, Lens, and Visual Studio Code.

Cons

• Operational ownership stays with the team: self-hosted deployment means teams must run the operator and manage their security workflow.
• Cluster results are ephemeral: they are regularly refreshed and regenerable, so teams needing retained records should export them.
• Hosted functions add variable cost: ARMO Platform pricing depends on vCPUs and other cloud resources.

Alternatives

Armor is worth considering for teams whose priority is endpoint protection: its $99 a month Agent Premium Tier is billed per endpoint and includes malware protection, file integrity monitoring, intrusion prevention, and vulnerability scanning. Its focus differs from Kubescape's Kubernetes coverage.

Prowler Cloud may suit teams seeking cloud security checks and compliance frameworks, with a 15-day free trial and a free Apache-licensed open-source plan. Choose it when that cloud-oriented workflow is a better match than Kubernetes-focused coverage.

C3M Cloud Control offers a free cloud security assessment for up to two cloud accounts, making it an option for a limited initial assessment rather than a self-hosted Kubernetes platform.

Onam Security API Security is the alternative to consider when API security is the priority rather than Kubernetes posture and runtime coverage.

Qualys TotalCloud is another cloud security option; its free license has limited API calls for control evaluation.

Skyhigh Private Access is an alternative for buyers considering private access software.

Sysdig Secure is a paid alternative whose licensing is based on the number of hosts in a customer's environment, with compute instances used for CSPM.

FortiCNAPP is a paid alternative with Standard tiers licensed by vCPU for one- or three-year terms.

Verdict

Choose Kubescape if your team wants a free, self-hosted Kubernetes security platform spanning configuration, image scanning, compliance, and runtime monitoring—and can own its operation. Look elsewhere if you need a hosted scan-upload and custom-artifact workflow with simple fixed pricing; ARMO Platform's cost varies with resource usage.