Bound to workloads
Cluster findings attach to the cluster, and the inventory ties each workload in it to the image digest it runs.
See your clusters.
Control the release path.
Bring Kubernetes inventory, workload posture and admission control together. Connect cluster findings to the images and policies behind them.
Kubernetes environment
Namespace
Workload specification
Pod configuration
Investigation context
01 / Discover
Place the finding in its namespace.
- Cluster reference
- Namespace
Inspect the cluster configuration and preserve the resource context.
02 / Inspect
Review the workload setting.
- Workload identity
- Configuration evidence
Connect the posture finding to the resource and configuration that explain it.
03 / Coordinate
Give the platform team a concrete change.
- Resource owner
- Follow-up check
Use the resource context to review the correction and its follow-up evidence.
CIS v1.8
Per cluster
Evidence on every failing control.
Deny
On error
Admission fails closed.
mTLS
Cluster sensor
Tenant from the certificate.
Four-eyes
Enforcement
Audit to enforce takes two approvers.
The category
What is KSPM?
KSPM answers two questions about a cluster: is it configured safely, and what is running in it? Benchmarks such as CIS Kubernetes cover the first. The second needs a live inventory of workloads and the image digests they run. Most teams have the first answer in one tool and the second nowhere, so a privileged pod and the critical CVE inside it are triaged by different people on different days.
SecurityVault puts cluster posture on one graph that runs from code to image to cloud. A failing control, the workload it affects, the digest that workload runs and the commit that built it are one story, ranked by exposure, gated by fail-closed admission and recorded as continuous evidence. Platform teams get one prioritised list per cluster; security teams can review policies in audit mode before enabling enforcement.
Cluster configuration
Review the Kubernetes posture findings.
Workload specification
Inspect the settings attached to the affected resource.
Admission checkpoint
Apply policy before a new workload is admitted.
Posture review and admission control address different points in the lifecycle.
How SecurityVault does it
How does SecurityVault secure Kubernetes?
Assess
A cluster scan collects cluster state once, then runs kubescape and kube-bench over it. CIS Kubernetes v1.8 is evaluated per cluster against the managed control plane of EKS, AKS and GKE clusters, with each failing control linked to its misconfiguration, finding and detection time.
Inventory
The same scan folds cluster state into a workload and image inventory: namespaces, workloads, services, ingresses and the digest each workload runs.
Observe
The cluster sensor reports runtime observations over mutually authenticated TLS with replay protection. Each complete snapshot ends observations it no longer sees, so the inventory tracks what runs now, including an image swapped with
kubectl edit.Admit
The admission webhook evaluates Pod and Deployment specs, verifies image signatures with cosign and audit-logs every decision.
Shift left
The same classes of setting are checked in manifests, Helm charts and Kustomize overlays in the pull request. See IaC security.
Outcomes
What happens to a cluster finding?
Cluster findings join the graph that already holds your code and images, so a privileged workload and the CVE in the image it runs are one story with one owner.
Commit
produces
Container image
runs image
Workload
routes to · exposes
Service → Ingress
01
02
Ranked by exposure
Blast radius counts the workloads and ingresses a finding reaches, so an exposed workload outranks an internal one.
03
Evidence you can trust
Evidence from a deregistered cluster stays visible as history and is never counted as active.
Gates
How does admission control fail closed?
Any evaluation error is a denial. An image with no completed scan stays pending evaluation, and an image from an untrusted source can never evaluate to allow. The same policy chain runs at the pull request, the build and the cluster, so a setting refused in CI is refused again at admission. See deployment gates and container security.
Workload request
Evaluate the resource presented for admission.
Policy check
Review the configured conditions.
Fail-closed result
Preserve a deny when evaluation fails.
The decision is made before the workload is admitted.
Evidence
How does cluster evidence support compliance?
Cluster findings count as Kubernetes posture evidence when controls are evaluated, CIS results carry the resources assessed and the scan that produced them, and admission decisions are audit-logged. SecurityVault maps that evidence to your controls across 6 seeded framework catalogues through the cross-walk. See continuous compliance.
Resource finding
Keep the affected Kubernetes resource in scope.
Posture record
Retain the configuration analysis.
Control coverage
Review the evidence and any remaining gaps.
Audit context stays linked to the cluster finding.
FAQ
Kubernetes security questions
- What does KSPM cover in SecurityVault?
- Cluster posture from kubescape and kube-bench, CIS Kubernetes v1.8 results per cluster for managed EKS, AKS and GKE control planes, a workload and image inventory of every cluster, and an admission webhook that enforces policy when workloads are created.
- What does the admission webhook refuse?
- Containers running as root or privileged, host network, PID or IPC namespaces, hostPath volumes, the latest tag, the SYS_ADMIN capability, writable root filesystems, privilege escalation, missing resource limits and, with signature verification configured, unsigned images. Any evaluation error is a denial.
- How is a cluster connected?
- A cluster scan collects cluster state once and runs kubescape, kube-bench and the inventory collector over it. The cluster sensor authenticates with a mutual-TLS certificate, and the organisation is derived from the certificate binding, never from the data the sensor sends.
- What if a CIS control could not be assessed?
- It is reported as not measured, with the reason. A control counts as evaluated only when a resource it targets was actually assessed for that cluster, so a missing input is never shown as a pass.
- How can we stage enforcement before production?
- Image policies export as Kyverno policies that start in audit mode and move to staging and then production enforcement, each step requiring two approvals from different people. A paused policy always renders in audit mode, and a global switch returns every policy to audit.
Platform offerings
What are we developing next?
- An eBPF workload sensor will add runtime threat signals to cluster posture.
Related: container image security · cloud security posture management · IaC security · policy-as-code deployment gates · SecurityVault for platform engineering · cloud posture. New to the platform? Start with the quickstart.
From the blog
Further reading on Kubernetes security
- Kubernetes service accounts: audit workload accessAudit Kubernetes service accounts by tracing token mounts, effective permissions and workload ownership, then verify that access changes work.
- Kubernetes NetworkPolicy: test workload isolationVerify Kubernetes NetworkPolicy with an explicit traffic matrix, allowed and denied probes, and evidence that distinguishes policy from network failure.
- KSPM: why Kubernetes posture starts with inventoryKSPM starts with a live inventory of clusters, workloads and RBAC. Learn how inventory, topology and admission control turn posture into enforcement.
- Kubernetes admission gates and the cluster drift problemKubernetes admission gates decide what runs, but drift undoes them. Learn what to gate on and how to keep the live cluster matching git.
See it on your stack
Connect one cluster.
See CIS results with evidence, every running digest, and an admission decision on the record.