Kubescape (11,568 Stars) Kubernetes Security 2026

Kubescape (11,568 stars) is the open-source Kubernetes security platform that scans clusters, images and manifests from your IDE or CI/CD. Here is how to start hardening your cluster today.

💡 What You Will Learn

Kubescape (11,568 stars) is the open-source Kubernetes security platform that scans clusters, images and manifests from your IDE or CI/CD. Here is how to start hardening your cluster today.

📜 Table of Contents

• The short answer
• What it scans
• Quick start
• Hardening workflow
• FAQ

The short answer

kubescape/kubescape (11,568 stars, Go) is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It checks against multiple frameworks (NSA/CISA hardening guide, MITRE ATT&CK) and reports misconfigurations, vulnerabilities, and compliance issues with clear remediation steps.

What it scans

• Cluster posture: RBAC risks, exposed dashboards, network policy gaps
• Workloads: privileged containers, hostPath mounts, missing limits
• Images: CVEs in container images (via integration with image scanners)
• Manifests: YAML files before they ever reach the cluster

Quick start

# Scan your current cluster
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
kubescape scan cluster

# Scan a manifest file before deploying
kubescape scan deployment.yaml

# Scan an image
kubescape scan image nginx:1.27

Output is human-readable by default, with a score per control and fix suggestions; --format json gives machine-readable results for CI.

Hardening workflow

1. Run kubescape scan framework nsa to see your score against the NSA/CISA guide.
2. Fix the highest-severity items first: privileged containers, default namespaces, public RBAC.
3. Add kubescape scan to CI so new manifests fail the pipeline if they regress.
4. Use the VS Code extension to catch issues while writing YAML.

FAQ

Is it free? The CLI and core scanner are open source (Apache-2.0).

Does it replace commercial scanners? For many teams it covers the essentials; commercial products add compliance reporting and advanced image scanning.

Can it run offline? Yes - it works against your cluster directly and can use locally cached controls.

❓ FAQ

Is it free?

The CLI and core scanner are open source (Apache-2.0).

Does it replace commercial scanners?

For many teams it covers the essentials; commercial products add compliance reporting and advanced image scanning.

Can it run offline?

Yes - it works against your cluster directly and can use locally cached controls.