Kubescape -- a Kubernetes security platform. Scans clusters, manifests, Helm charts and images against CIS Benchmarks, NSA-CISA and MITRE ATT&CK, then watches the cluster at runtime.
Alternative to: Wiz Essential at $24,000/year for 100 cloud workloads -- roughly $240 per workload per year -- the base tier exposed on AWS Marketplace. Red Hat Advanced Cluster Security is metered at $0.028 per vCPU per hour, about $245 per vCPU per year, across every vCPU on the secured cluster.
Cost to run: free licence. The CLI is a single Go binary and costs seconds of CPU. The in-cluster operator runs a node-agent DaemonSet on every node plus a storage layer for SBOMs, so budget real memory and one engineer's part-time attention.
Licence: Apache-2.0. Free for commercial use, no copyleft.
Runs on: CLI on Linux, macOS and Windows via Homebrew, Krew, PPA, NixOS, Chocolatey, Scoop and a PowerShell installer. In-cluster via thekubescape-operatorHelm chart.
Requires: nothing but the binary to scan local YAML, Helm or Kustomize files. Cluster scanning needs kubectl and a kubeconfig. Continuous and runtime protection need Helm, a live cluster and eBPF. Image patching needs buildkitd or Docker. No ARMO account required.
Traction: 11,700 stars · ~1,000 forks · 4,613 commits on master · 52 open issues · 37 open PRs.
Liveness: very live -- commit landed 2026-08-17, dozens of issues closed in the preceding 24 hours, v4.0.12 shipped 2026-08-12.
Maturity: v4.0.12. The 4.0 line went GA 2026-03-26. The Helm config marks the auto-upgrade capability, in the project's own words, "an experimental capability with an elevated security risk."
Links: repo · kubescape.io · CNCF Incubating since 2025-02-26 · Trendshift: not listed
Figures as of 2026-08-18.
What it does
Kubescape looks at a Kubernetes setup and tells you which parts of it are configured badly.
It runs in two shapes. As a CLI, it reads YAML manifests, Helm charts, Kustomize output or a live cluster and grades them against published control frameworks -- CIS Benchmarks, the NSA-CISA hardening guidance, MITRE ATT&CK mappings. That mode needs no cluster and no account. You can point it at a directory on your laptop.
As an in-cluster operator, installed by Helm, it keeps scanning on a schedule, builds SBOMs for the images actually running, tracks vulnerabilities against them, and -- since the 4.0 line -- watches process and network behaviour at runtime using eBPF, learning what normal looks like for each workload and flagging what is not.
The output is a list of findings with a control ID, a severity, and the specific resource at fault.
What it replaces, and what that costs
Cloud-native application protection is one of the most expensive categories in security software, and it is also one of the most secretive about price.
Wiz is the one you can actually cost, because its AWS Marketplace listing exposes base-tier numbers that its website does not. Wiz Essential is $24,000/year for 100 cloud workloads, about $240 per workload per year. Wiz Advanced is $38,000/year for the same 100 workloads, about $380 each. The SMB bundle, Wiz Go, lists at $222,000 across a 36-month term -- roughly $74,000 a year. Full multi-cloud CNAPP is private-offer only.
Red Hat Advanced Cluster Security, formerly StackRox, also leaks a real number through AWS Marketplace: $0.028 per vCPU per hour, on demand, metered across every vCPU on the clusters it secures. Annualised that is about $245 per vCPU. A modest 200-vCPU estate is roughly $49,000 a year.
Then the wall. Palo Alto Prisma Cloud is priced in credits, and the dollars-per-credit rate and the minimum commitment live inside a gated PDF licensing guide. Aqua Security publishes no list price at all; every tier routes to "Request a Trial." Sysdig Secure publishes nothing either -- G2's own page notes its Sysdig pricing information was last updated in September 2023 and was supplied by nobody since.
That opacity is the finding, not a gap in the research. Four of the five leading vendors in this category will not tell you what it costs until you are on a call.
ARMO, the company that built Kubescape, sells ARMO Platform on the same model: the pricing page is a lead-generation form that says your needs "deserve a tailored pricing" and routes you to a Slack sales chat. What that money buys, versus the free tool, is not better detection -- the scan engines are the same -- but operability: a multi-cluster dashboard, multi-tenancy, SSO, data retention and history, attack-path analysis, an RBAC visualiser, Slack/Teams/Jira integration, and a support SLA.
Running Kubescape yourself has no licence line. The costs that do not disappear are the node-agent DaemonSet sitting on every node, the aggregated-API storage layer holding SBOMs and application profiles, and a person to tune out false positives and keep the Helm chart current. Against a five-figure floor from every vendor above, that is a favourable trade -- but it is a trade, not a free lunch, and it is an avoided cost rather than a saving unless you are cancelling a contract.
Is it still alive?
Very live.
The last commit landed 2026-08-17, eight hours before these figures were taken. Release v4.0.12 shipped 2026-08-12, six days earlier, in a run of roughly weekly patch releases. The closed-issues feed shows dozens of issues closed in the preceding 24 hours, dated 15 to 17 August, with maintainers triaging same-day.
The binaries download: the v4.0.12 checksums.sha256 asset returns HTTP 200 on a direct request.
The governance signal is the one worth stating plainly. Kubescape entered the CNCF Sandbox in November 2022 and was voted to Incubating on 2025-02-26. It has not graduated. All four core maintainers -- matthyx, slashben, rotemamsa and amirmalka -- work for ARMO. ARMO's own blog was still publishing as recently as 2026-07-01, so there is no evidence of a backer walking away, but a single company sets the direction.
Trendshift has no entry for it, which is worth noting honestly: this repo has never had a viral trending moment. Its credibility comes from the CNCF, not from a spike.
What people say
Reddit was unreachable from the research sandbox, so no r/kubernetes quotes or vote counts are reported here. Hacker News comments are quoted with permalinks; HN does not expose per-comment scores, only story points, so none are claimed.
Scepticism about the open-core model that funds projects like this, on the CNCF-acceptance thread (story at 27 points):
"In the short to medium term, most of the development ends up being done by the company who created the project... though [for] simple stuff like typo bugs, people will submit PRs."
-- news.ycombinator.com/item?id=34343527
And the sharpest dissent about the whole category, from a self-identified former GitHub Security Products PM:
"To a developer, think of them as glorified linters... they aren't going to catch anything you're not already looking for, they're just going to make it easier to remedy/enforce the problems you already know about."
-- news.ycombinator.com/item?id=34344432
Maintainer Matthias Bertschy, on incubation in February 2025, quantified the community as "growing from a small group to over 130 contributors, including many first-time open-source participants."
The catch
False positives and false negatives are documented, not theoretical. Issue #1647, "Evaluating C-0037 seems to report false positives as well as false negatives," is a maintainer-acknowledged report against a specific control. Any rules engine carries this; the question is whether you have someone to tune it.
The architecture churned recently. Version 4.0, in March 2026, removed the host-sensor DaemonSet and folded its job into the node-agent, because -- in the project's own account -- the old design "was often perceived as intrusive and difficult to monitor from a security perspective." Anyone running the pre-4.0 operator had to re-plan their deployment.
Runtime detection is young. The node-agent and the aggregated-API storage layer only reached GA in March 2026. Adopting them means running capabilities roughly five months out of beta.
The free tier is complete on detection and thin on operations. One cluster, one team, no history, no SSO, no support number. That is fine until it is not.
Governance is concentrated. Four maintainers, one employer, incubating rather than graduated.
Credits
Matthias Bertschy (matthyx), Ben Hirschberg (slashben, ARMO co-founder and CTO), Rotem Refael (rotemamsa) and Amir Malka (amirmalka) -- the four core maintainers listed in the project's governance file. ARMO (@armosec) and the project account (@Kubescape). The CNCF, for the incubation record and the 4.0 announcement. The Hacker News commenters quoted above. Pricing verified against AWS Marketplace listings for Wiz and Red Hat ACS, and against Aqua, Sysdig, Palo Alto and ARMO's own pages.