Kubescape is a Kubernetes security scanner that checks cluster configurations and IaC manifests against security frameworks including NSA-CISA, MITRE ATT&CK, CIS, and SOC2. It can scan live clusters, local manifest files, Helm charts, and YAML files.

• Scans live Kubernetes clusters and local manifest files
• Frameworks: NSA-CISA, MITRE ATT&CK, CIS Kubernetes, SOC2
• Supports Helm charts, Kustomize, and raw YAML
• Outputs to table, JSON, HTML, and SARIF

No setup required. Run from the shell.

kubescape scan <path>                  # e.g. kubescape scan .
kubescape scan <path> --format json --output /output/kubescape-results.json

# Ensure kubectl is configured and connected to the cluster
kubescape scan
kubescape scan --format html --output /output/kubescape-report.html

kubescape scan framework nsa
kubescape scan framework mitre
kubescape scan framework cis-v1.23-t1.0.1

kubescape scan <helm-chart-directory>

kubescape scan --include-namespaces <namespace>

kubescape list frameworks

TBC

• GitHub Repo