
kube-hunter
Automated security weakness hunting and vulnerability exploitation for Kubernetes clusters.

Security risk analysis for Kubernetes resources with precise score-based remediation.

Kubesec is a high-performance security risk analysis tool specifically engineered for Kubernetes resource manifests. In the 2026 landscape, it remains a foundational component of the DevSecOps 'Shift-Left' movement, providing a deterministic risk scoring engine for YAML and JSON configurations. The architecture focuses on identifying misconfigurations that lead to privilege escalation, container escapes, and unauthorized data access. By evaluating manifests against a set of opinionated security best practices—such as the use of privileged containers, hostPath mounts, and capabilities—Kubesec assigns a numerical risk score and provides actionable remediation steps. Its lightweight design allows it to be deployed as a standalone binary, a Docker container, or via a hosted API. As organizations move toward AI-driven infrastructure automation in 2026, Kubesec serves as a critical validation gate, ensuring that LLM-generated Kubernetes manifests do not introduce security regressions before reaching production environments. It bridges the gap between raw configuration and policy enforcement, providing the necessary telemetry for security teams to maintain cluster integrity across multi-cloud deployments.
Kubesec is a high-performance security risk analysis tool specifically engineered for Kubernetes resource manifests.
Explore all tools that specialize in misconfiguration detection. This domain focus ensures Kubesec delivers optimized results for this specific requirement.
Assigns positive/negative weights to security flags (e.g., +10 for AppArmor profile, -30 for Privileged mode).
Can be utilized within a Validating Admission Webhook to block insecure pod deployments in real-time.
Parses and evaluates complex files containing multiple Kubernetes objects in a single pass.
Provides the specific YAML field and value required to resolve identified vulnerabilities.
Standardized schema output designed for ingestion by Prometheus, ELK, or SIEM platforms.
Stateless execution with zero external dependencies, optimized for minimal container footprints.
Functions entirely without internet access for air-gapped environment security.
Install the Kubesec binary via Homebrew, Curl, or Docker.
Prepare a Kubernetes manifest file (e.g., deployment.yaml).
Run 'kubesec scan manifest.yaml' to perform a local analysis.
Review the JSON output containing 'score', 'scoring', and 'remediation' fields.
Integrate the scan into a Git pre-commit hook using a shell script.
Configure a GitHub Action to run Kubesec on every Pull Request.
Set a threshold for the risk score to automatically fail builds (e.g., exit 1 if score < 0).
Optional: Deploy the Kubesec API as a microservice within your cluster.
Configure an Admission Controller to trigger Kubesec scans before object creation.
Export scan results to a centralized logging system for compliance auditing.
All Set
Ready to go
Verified feedback from other users.
"Users praise Kubesec for its speed and simplicity, though some note it is focused strictly on K8s manifests rather than full infrastructure-as-code (like Terraform)."
Post questions, share tips, and help other users.

Automated security weakness hunting and vulnerability exploitation for Kubernetes clusters.

Kubernetes Native Policy Management: Secure and Automate Clusters Without Learning New Languages.

The Code to Cloud platform that secures apps from design to runtime.

Real-time cloud security with zero compromise, securing the complete cloud lifecycle.

The Wiz Cloud Security Platform enables security, dev, and DevOps to work together in a self-service model, built for cloud development scale and speed.
Zscaler Workload Communications provides comprehensive security for cloud workloads by extending zero trust principles to prevent lateral threat movement and data breaches.
TruEra helps businesses build and maintain trust in their AI systems by providing AI model evaluation, debugging, and monitoring solutions.
The AI orchestration platform that allows you to turn AI and agents into business performance.