Kubescape (11,568 Stars) Kubernetes Security 2026: Scan Clusters, Images and YAML in Your IDE

Kubescape (11,568 stars) is the open-source Kubernetes security platform that scans clusters, images and manifests from your IDE or CI/CD. Here is how to start hardening your cluster today.

💡 What You Will Learn

Kubescape (11,568 stars) is the open-source Kubernetes security platform that scans clusters, images and manifests from your IDE or CI/CD. Here is how to start hardening your cluster today.

## The short answer **kubescape/kubescape** (11,568 stars, Go) is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It checks against multiple frameworks (NSA/CISA hardening guide, MITRE ATT&CK) and reports misconfigurations, vulnerabilities, and compliance issues with clear remediation steps. ## What it scans - **Cluster posture**: RBAC risks, exposed dashboards, network policy gaps - **Workloads**: privileged containers, hostPath mounts, missing limits - **Images**: CVEs in container images (via integration with image scanners) - **Manifests**: YAML files before they ever reach the cluster ## Quick start ```bash # Scan your current cluster curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash kubescape scan cluster # Scan a manifest file before deploying kubescape scan deployment.yaml # Scan an image kubescape scan image nginx:1.27 ``` Output is human-readable by default, with a score per control and fix suggestions; `--format json` gives machine-readable results for CI. ## Hardening workflow 1. Run `kubescape scan framework nsa` to see your score against the NSA/CISA guide. 2. Fix the highest-severity items first: privileged containers, default namespaces, public RBAC. 3. Add `kubescape scan` to CI so new manifests fail the pipeline if they regress. 4. Use the VS Code extension to catch issues while writing YAML. ## FAQ **Is it free?** The CLI and core scanner are open source (Apache-2.0). **Does it replace commercial scanners?** For many teams it covers the essentials; commercial products add compliance reporting and advanced image scanning. **Can it run offline?** Yes - it works against your cluster directly and can use locally cached controls.