Kubernetes security tools, by what they actually do
Open-source and paid Kubernetes security tools sorted into the jobs they do — posture, vulnerabilities, policy, runtime, network, secrets and supply chain — instead of a top-ten list. Which layer each covers, and which it does not.
StackRadar Team
· 12 min read
"Top 10 Kubernetes security tools" lists put Falco next to Trivy next to Kyverno as if you would choose one. You would not; they do different jobs, and a cluster that has all three is not being greedy. This post sorts the tools — open source and paid — into the seven questions Kubernetes security actually asks, says which tools answer each one, and is honest about where our own product sits, which is in exactly one of the seven.
The map
| Layer | Question | Open source | Paid / managed |
|---|---|---|---|
| Posture | Is the cluster configured safely? | kube-bench, Kubescape, Polaris, Checkov, Trivy (misconfig) | ARMO, Fairwinds Insights, every CNAPP |
| Vulnerabilities | Which known CVEs are in what is running? | Trivy Operator, Kubescape, Grype/Syft, StackRadar CLI | StackRadar, Snyk, every CNAPP |
| Admission policy | What is allowed to be deployed? | Kyverno, OPA Gatekeeper, Pod Security Admission, ValidatingAdmissionPolicy | Styra, Nirmata |
| Runtime | What is happening inside running containers? | Falco, Tetragon, KubeArmor | Sysdig Secure, Aqua, Defender, Wiz Runtime |
| Network | Who can talk to whom? | NetworkPolicy, Cilium, Calico | Isovalent, Tigera Calico Cloud |
| Secrets | Where do credentials live and who can read them? | External Secrets Operator, Sealed Secrets, Vault, SOPS | Vault Enterprise, cloud secret managers |
| Supply chain | Was this image built and signed as claimed? | Sigstore cosign, Kyverno verifyImages, Ratify, SLSA tooling | Chainguard, Docker Scout |
1. Posture and configuration
The question this layer answers: is the cluster set up the way the hardening guides say it should be?
The CIS Kubernetes Benchmark, the NSA/CISA hardening guidance and the Pod Security Standards define the questions; these tools check the answers. kube-bench (Aqua) runs the CIS checks against nodes. Kubescape (ARMO, CNCF) scans manifests and live clusters against several frameworks and visualises RBAC; it is the most complete free posture tool and also does vulnerabilities. Polaris (Fairwinds) and Checkov (Prisma) check manifests for best-practice violations, Checkov across IaC generally. Trivy does misconfiguration scanning of manifests and Helm charts alongside its vulnerability scanning.
Posture findings are mostly static: fix the manifest, re-run the scan, done. That is why the free tools cover this layer so well and why a paid platform adds relatively little here beyond a dashboard.
2. Vulnerability scanning
The question this layer answers: which known CVEs are in the images we are actually running, and which of them matter?
This is the layer that changes every day without anyone touching the cluster — new advisories land against images that were clean when deployed — and therefore the layer where the operational burden is largest. Trivy Operator scans running workloads and stores results as CRDs; Kubescape does the same with a relevancy filter for loaded packages; Grype and Syft are the building blocks for a DIY pipeline; the StackRadar CLI scans a cluster from a laptop and flags KEV entries.
StackRadar, our product, is this layer only: a source-published in-cluster scanner that keeps a CycloneDX SBOM per running image, re-matches it as advisories land, shows every cluster in one place with history, and ranks by CVSS, EPSS and KEV. It does not do posture, admission, runtime, network, secrets or supply chain, and nothing on this page should be read as suggesting otherwise. The tools-by-job post and the comparison pages go through the alternatives.
3. Admission policy
The question this layer answers: should this object be allowed into the cluster at all?
Pod Security Admission is built in and enforces the Pod Security Standards per namespace; enable it first. Kyverno writes policies as Kubernetes resources and can mutate, validate, generate and verify image signatures; it is the most approachable. OPA Gatekeeper uses Rego and is the choice where policy is shared with non-Kubernetes systems. ValidatingAdmissionPolicy (CEL, GA since 1.30) covers simple rules without a webhook. Admission is also where vulnerability scanning meets enforcement — "reject images with a critical CVE" — though that policy is only as good as the scan behind it and tends to block the ingress controller first.
4. Runtime detection
The question this layer answers: is something happening in a running container that should not be?
Falco (CNCF graduated) watches syscalls and Kubernetes audit events against rules — a shell in a container, a write to /etc, an outbound connection from a pod that never makes them. Tetragon (Cilium) does similar with eBPF and can enforce, not just alert. KubeArmor takes a policy-first approach. The commercial platforms — Sysdig Secure (built on Falco), Aqua, Defender for Containers, Wiz — add managed rules, forensics and response. Runtime is the layer with the highest operating cost: rules need tuning, alerts need someone awake.
5. Network
The question this layer answers: which pods are allowed to talk to which, and to the outside?
NetworkPolicy is the API; the CNI enforces it. Cilium and Calico both enforce it and extend it (L7, DNS-based egress, cluster-wide policies). Default-deny egress per namespace is the single highest-value change most clusters have not made, and it needs no new tool.
6. Secrets
The question this layer answers: where do credentials live, and who and what can read them?
Kubernetes Secrets are base64, not encryption; enable encryption at rest first. External Secrets Operator syncs from a cloud secret manager or Vault into the cluster. Sealed Secrets and SOPS let you commit encrypted secrets to Git. Vault (or the cloud equivalents) is the source of truth. RBAC on get secrets is the part most often left wide open.
7. Supply chain
The question this layer answers: was this image built from the source it claims, by the pipeline it claims, and has it been altered?
Sigstore cosign signs images and attaches attestations (SBOMs, SLSA provenance) to them in the registry. Kyverno and Ratify verify those signatures at admission. Chainguard sells minimal, signed base images with an SBOM per build. This layer is where the SBOM comes from at build time; the vulnerability layer is where it is used afterwards. The two meet in the cluster-level SBOM: what was signed and shipped versus what is actually running.
Where the CNAPPs fit
Wiz, Orca, Prisma Cloud, Sysdig, Aqua and Defender for Cloud each cover most of the seven layers, across clouds, in one product — plus identity and cloud posture that have nothing to do with Kubernetes. That consolidation is the product. It is the right buy for a security organisation that would otherwise run nine tools with nine dashboards, and an expensive way for a platform team to get the two layers it actually needed. Prices are quote-only and start in the tens of thousands a year.
A note on ranking findings
Whatever tool sits in the vulnerability layer, the list it produces will be long. Two free feeds shrink it: the CISA KEV catalogue (evidence of exploitation) and EPSS (probability of it). Most open-source scanners do not join them by default; a platform should.
Frequently asked questions
What are the main categories of Kubernetes security tools?
Seven, roughly: posture and configuration (is the cluster set up safely), vulnerability scanning (what known CVEs are in the images), admission policy (what is allowed to be deployed), runtime detection (what is happening in running containers), network (who can talk to whom), secrets management, and supply chain (was this image built and signed as claimed). Most tools cover one or two; the CNAPP platforms cover most of them at a price.
What is the best open-source Kubernetes security tool?
It depends on the layer. Kubescape or kube-bench for posture, Trivy Operator for vulnerabilities in-cluster, Kyverno or OPA Gatekeeper for admission policy, Falco or Tetragon for runtime, Cilium or Calico for network policy, External Secrets Operator for secrets, and Sigstore cosign for signing. There is no single open-source tool that does all of them well.
Do I need a CNAPP for Kubernetes security?
Not necessarily. A CNAPP (Wiz, Orca, Prisma Cloud, Sysdig, Aqua, Defender for Cloud) consolidates posture, vulnerabilities, runtime and identity across clouds in one product, which is valuable for a security organisation managing many teams. A platform team running a handful of clusters can cover the same layers with a few focused tools, most of them free, and add a managed product only where the operational burden is real — usually vulnerability tracking, because it is the layer that changes daily.
What is the difference between Kubescape and Trivy Operator?
Both run in-cluster and both scan images and configuration, but they lead with different jobs. Kubescape leads with posture — compliance frameworks, RBAC analysis, misconfiguration — and adds vulnerabilities. Trivy Operator leads with vulnerabilities and SBOMs and adds config audit and RBAC assessment. Either is a reasonable single free choice; they are the two most-compared tools in the category.
Which Kubernetes security tools use EPSS or KEV?
Few of the open-source scanners do by default; Trivy, Grype and Trivy Operator rank by CVSS. Among tools focused on vulnerabilities, StackRadar combines CVSS, EPSS and the CISA KEV catalog in a published formula; several CNAPPs expose EPSS and KEV as filters. The StackRadar CLI flags KEV entries for free.