Side by side

CFRipper vs Kubescape

Both stand on infrastructure as code security software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.

CFRipper

Free plan Open source LinuxMacSelf-hosted+2

CFRipper focuses on CloudFormation analysis, with configurable rules, custom plugins and text or JSON output. Its listed scope excludes Terraform and Kubernetes.

Visit CFRipper

Choose Kubescape if you want a free, self-hosted Kubernetes security platform with configuration, image, compliance, and runtime coverage. Consider the ARMO Platform if you need its documented scan-upload and custom-artifact provider, with pricing dependent on resource usage.

Visit Kubescape

The facts

	CFRipper	Kubescape
Free plan	Yes	Yes
Open source	Yes	Yes
Runs on	Linux, Mac, Self-hosted, Web, Windows	API, Linux, Mac, Self-hosted, Windows
Lowest paid plan	Free or on request	ARMO Platform Startup: $30 a month
Plans published	2	5
Maker	Not published	Not published
Website	github.com	kubescape.io
On infrastructure as code security software	#1 of 22	#2 of 22

CFRipper: what it does well

Analyzes AWS CloudFormation templates
Custom plugins allow user-written compliance checks
Results can be returned as text or JSON
Installation guidance covers macOS, Linux and Windows
Apache License 2.0

What to know first

Does not analyze Terraform
Does not analyze Kubernetes

Kubescape: what it does well

Free, self-hosted CLI and operator under Apache License 2.0.
Scans manifests, Helm charts, and live clusters for misconfigurations.
Operator scans deployed images and monitors runtime activity.
Supports CIS, NSA-CISA, MITRE ATT&CK, and SOC 2 frameworks.
CLI supports offline and air-gapped operation.

What to know first

Self-hosted deployment requires teams to run the CLI and operator.
ARMO Platform pricing depends on vCPUs and other cloud resources.
In-cluster scan results are ephemeral and regularly updated.

Alternatives to CFRipper Alternatives to Kubescape The whole list