StackRadar vs Kubescape / ARMO Platform
Kubescape is a CNCF-incubating open-source Kubernetes security scanner whose in-cluster operator includes eBPF runtime relevancy and runtime threat detection; ARMO Platform is the commercial SaaS built on it, adding a hosted dashboard, history across clusters, EPSS/KEV-based prioritisation and, more recently, cloud detection and response.
Facts last checked . Prices and features change — verify with the vendor before deciding.
What Kubescape does well
- CNCF-incubating project with a large open-source community and a wide feature surface: misconfigurations, compliance frameworks, RBAC and vulnerabilities in one tool.
- The open-source operator’s eBPF node agent provides “relevancy”: it can tell which vulnerable packages are actually loaded in memory, which StackRadar does not do. Kubescape 4.0 (March 2026) made its runtime threat detection generally available.
- ARMO Platform’s prioritisation uses CVSS, EPSS, KEV and fixability — the same signals StackRadar uses — on top of the relevancy data.
- Enterprise logos and a sales-led motion if you want a vendor relationship.
How Kubescape and StackRadar differ
The differences are about how the two are built and sold, not a feature checklist. Each point below is a structural fact you can verify on the vendor's own documentation.
- ARMO withdrew its public pricing. It was previously listed at around $59 per worker node per month with a free tier up to 10 nodes; today it is quote-only.
- The company has repositioned from Kubernetes security toward cloud detection and response (CADR), and the free SaaS tier is the top of a sales funnel rather than a product in its own right.
- Runtime relevancy depends on an eBPF agent per node and a learning period; it filters what you see, and a filter you cannot audit can hide risk as easily as noise.
- StackRadar is a narrower tool: SBOM and vulnerability tracking for what runs in the cluster, with the scanner source published and a flat per-cluster price.
Side by side
| Axis | StackRadar | Kubescape |
|---|---|---|
| Where it runs | One Helm chart in the cluster; self-hosted (AGPL-3.0) or reporting to the cloud dashboard | Open-source CLI and operator, with an eBPF node agent; ARMO SaaS on top |
| Kubernetes runtime inventory | Yes — every running image, with its workload, Helm release and ArgoCD application | Yes |
| SBOM | CycloneDX 1.6 per running image (Syft), stored and re-checked as new advisories land | Yes (operator) |
| Prioritisation | Radar Score — CVSS, EPSS and CISA KEV combined in a published formula | Severity plus eBPF runtime relevancy; EPSS, KEV and fixability on the platform |
| History and trends | 1 year (Pro), 2 years (Business); 1 year self-hosted | Platform: yes; retention by plan |
| Multi-cluster view | One cloud dashboard across every cluster in the organisation; self-hosted is one cluster | Platform: yes |
| Scanner source | Open source: scanner Apache-2.0, server and dashboard AGPL-3.0; releases signed and version-pinned | Kubescape is open source (Apache-2.0); platform is closed |
| Pricing | Free to self-host · Cloud: 14-day free trial, then Pro $59/mo · Business $199/mo at beta price ($99 / $299 standard) | Quote-only (public pricing withdrawn) |
| Data residency | Self-hosted: stays in your cluster. Cloud: EU only, and only the SBOM leaves the cluster | Vendor SaaS; US-based company |
Pricing
Kubescape: ARMO no longer publishes pricing. Before it was withdrawn, the platform was listed at roughly $59 per worker node per month with a free tier of up to ten nodes and one month of retention. Per-node pricing scales with cluster size; StackRadar’s Pro plan is $59 per month at the beta price ($99 standard) for up to five clusters regardless of node count.
StackRadar: Free to self-host for one cluster (AGPL-3.0). The cloud starts with a 14-day free trial; then Pro at $59 per month for up to five clusters and one year of history; Business at $199 per month for up to fifteen clusters and two years. Those are beta prices, for the first 10 Pro and 5 Business subscriptions; after that Pro is $99 and Business $299 a month. Every plan scans every image you run. Full details on the pricing page.
Which should you choose?
Choose Kubescape if
- You want misconfiguration, compliance and RBAC scanning in the same tool as vulnerabilities.
- Runtime “is this package actually loaded?” filtering is a hard requirement.
- You prefer a CNCF project with a large community behind the open-source half.
- You want a sales-led vendor relationship with an enterprise contract.
Choose StackRadar if
- You want a published price you can put on a credit card, not a quote.
- You want the scanner’s source, release signatures and scoring formula open to audit.
- You want EU-only data residency and only the SBOM leaving the cluster.
- You want vulnerability history and a multi-cluster view without a per-node bill.
Frequently asked questions
How much does ARMO Platform cost?
ARMO does not publish current pricing. Earlier public listings showed roughly $59 per worker node per month with a free tier up to ten nodes. Contact ARMO for a quote; for comparison, StackRadar is free to self-host and publishes flat per-cluster prices for the cloud.
Is Kubescape free?
Kubescape, the open-source project, is free under Apache-2.0. The ARMO Platform SaaS built on it has a free tier and paid plans that are quote-based.
Does StackRadar have runtime reachability like Kubescape?
No. StackRadar shows every vulnerable package in every running image and ranks by real-world exploitability (EPSS and CISA KEV). It does not use eBPF to filter out packages that are not loaded, because a filter you cannot audit can hide risk. If runtime relevancy is a hard requirement, Kubescape — free, or with ARMO Platform on top — is the better fit.