kube-bench

kube-bench checks whether your Kubernetes cluster is configured according to the CIS Kubernetes Benchmark, the industry-standard hardening checklist. It runs the hundreds of checks in that benchmark automatically and tells you what passes, what fails, and how to fix each one. Open source, from Aqua Security, free.

It runs as a job or container on your nodes and inspects the actual configuration of the control plane, kubelet, and policies against the benchmark. The output maps directly to CIS recommendations, which makes it the standard tool when an auditor asks whether you meet the benchmark. Setup is straightforward and it's built to run on a schedule.

Fully free with no paid tier. It's single-purpose in the best way: it does CIS benchmarking and nothing else, so it pairs naturally with broader tools like Kubescape or a runtime monitor like Falco. Any team that needs to demonstrate CIS compliance for Kubernetes runs this.

The catch: it measures against the CIS benchmark, which is a configuration checklist, not a complete security posture. A cluster can pass kube-bench and still have application-level holes, weak RBAC choices the benchmark doesn't judge, or runtime threats it can't see. It answers are we hardened to CIS, not are we secure.