Kubernetes Security with Sysdig Secure

Sysdig Secure’s SaaS-first Kubernetes security platform lets you automate Kubernetes compliance and governance using policy as code based on OPA. Secure the Kubernetes control plane, detect runtime threats, and implement Kubernetes-native network security. Conduct incident response with a detailed activity record.

Get Kubernetes Security Checklist

Kubernetes Security Platform

Risky image prevention via admission control

Block unscanned or vulnerable images from being deployed onto the cluster with the Sysdig Admission Controller plugin tool. Define criteria based on flexible conditions (i.e., namespace, CVE severity level, fix availability, image size, etc.) in order for the image to be approved.

Sysdig Secure also prevents vulnerabilities early by integrating image scanning into the CI/CD pipelines and registries.

Run Confidently in Kubernetes

Kubernetes Security Image Scanning


Automate scanning locally in your CI/CD tools without images leaving your environment, and block vulnerabilities pre-deployment.
Kubernetes Security Compliance


Validate compliance against standards like PCI, NIST, and SOC2 across the lifecycle of containers and Kubernetes.
Kubernetes Security Runtime Security


Detect threats across containers, Kubernetes, and AWS infrastructure with out-of-the-box Falco rules based on syscalls, K8s audit logs, and AWS CloudTrail.
Network Security


Visualize all network communication across apps and services. Apply microsegmentation by automating Kubernetes-native network policies.
Kubernetes Security Incident Response and Forensics

Incident response and forensics

Conduct investigations with low level syscall data, even after the container is gone.

Detect Kubernetes Vulnerabilities

Vulnerability assessment and vulnerability management practices are critical to minimizing the exposure and attack surface of your whole infrastructure. Sysdig Secure’s open source-based Kubernetes security platform can automatically identify new Kubernetes vulnerabilities. Here you can find the latest CVEs affecting your clusters and how to mitigate risk.

Start your free 30-day trial in minutes!

Complete access to all features and functions. No credit card required.

Frequently Asked Questions

Q: What is Kubernetes?

A: Kubernetes is an open-source platform for managing automated container deployment, scaling, workloads and services. Originally developed by Google and now maintained by the CNCF (Cloud Native Computing Foundation), the purpose for Kubernetes is to automate the operations, deployment, and scaling of application containers across clusters of hosts. Cloud services offered by many vendors now offer their branded version of Kubernetes.

Q: Why use Kubernetes?

A: Containers are very effective at bundling and running your applications. In production settings, there is a need to manage containers that run your applications without downtime. Kubernetes is a framework that manages distributed systems robustly as well as manages the scaling and failover of your container applications. Kubernetes stores and manages sensitive information, will restart containers that fail, automates rollbacks and rollouts, and manages automated mounts of storage systems.

Q: What is Kubernetes Security?

A: Kubernetes security mechanisms and software protect you against container-based attacks. These attacks often occur by hackers exploiting vulnerabilities in container base images or even 3rd party libraries. It could also be due to cluster misconfigurations that allow malicious activity to go undetected at runtime or cause cloud-native applications to fall out of compliance. As a result, your teams need to embed security and compliance tools across the Kubernetes lifecycle. Native controls like admission controllers can be used to block unscanned or vulnerable images from being deployed onto the cluster. Using open-source Falco, you can detect and alert on malicious activity at runtime. A Kubernetes security tool that is part of your DevOps ecosystem can help you manage your cloud security risk.

Q: What is a Kubernetes Cluster?

Kubernetes pools together various nodes into a cluster to run cloud-native applications. The Kubernetes cluster contains, at minimum, a master node and a worker node. The master node maintains the desired state of the cluster, such as which applications are running and which container images they use and directly controls the worker node. Worker nodes actually run the applications and workloads. When you deploy programs onto the cluster, the master node intelligently handles distributing work to the individual nodes. If any nodes are added or removed, Kubernetes will automatically manage your cluster to match the desired state.

Q: What is difference between Kubernetes and Docker?

Kubernetes and Docker are fundamentally different technologies that work well together for building, delivering, and scaling containerized applications. Docker packages software, or microservices, into a container, to make them more portable. Kubernetes is the orchestrator that helps you scale and manage multiple Docker containers at scale.

“The fact that Sysdig is immediately compatible with Kubernetes was a big draw for us. A lot of the security around Kubernetes is new and it's kind of hard to grapple with it at first. Sysdig helps with a lot of that and we don’t have to do a lot of managing the Sysdig stack, which ultimately makes our lives easier so we can focus on debugging our own stack.”

Ryan Staatz, Systems Architect at LogDNA

Read the Case Study