Cloud Security Tools

Full-lifecycle container and cloud-native security platform from build scanning to runtime control.

Static analysis scanner for infrastructure-as-code that detects misconfigurations in Terraform, CloudFormation, Kubernetes, and Dockerfile.

eBPF-based Kubernetes CNI that delivers networking, observability, L3-L7 network policy, and identity-based security for container workloads.

Declarative YAML rules engine for cloud governance and security that manages, filters, and remediates resources across multiple clouds.

Cloud-native runtime security engine that monitors Linux kernel system calls to detect anomalous behavior in containers.

Open source IaC scanner covering more than twenty platforms with thousands of Rego queries.

Go tool that checks Kubernetes clusters against the CIS Kubernetes Benchmark across managed and self-hosted distributions.

Cloud-native security system that uses Linux security modules and eBPF to restrict pod, container, and node behavior in Kubernetes clusters.

CNCF Kubernetes security scanner that checks clusters, workloads, and configurations against compliance and misconfiguration frameworks.

Kubernetes-native policy engine that validates, mutates, and generates resources through declarative admission control policies.

General-purpose policy engine with the Rego language for authoring and enforcing context-aware policies across services and infrastructure.

Agentless cloud security platform using snapshot-based SideScanning for workloads and containers.

Palo Alto Networks CNAPP spanning code security, posture management, and runtime protection.

Open-source multi-cloud security posture and compliance platform with hundreds of controls mapped to CIS, NIST, and ISO 27001.

Open-source multi-cloud security auditing tool that gathers cloud configuration data and presents risks in a navigable HTML report.

Runtime-first cloud security platform built on syscall visibility and the Falco engine.

eBPF runtime security tool for Kubernetes and Linux that provides process, syscall, file, and network observability with in-kernel enforcement.

Linux security tool that uses eBPF to detect suspicious process, file, and network behaviors in containers, Kubernetes, and host systems.

Comprehensive security scanner for container images, file systems, Git repositories, and Kubernetes configurations to detect CVEs.

Agentless CNAPP that correlates cloud posture, vulnerabilities, identities, and exposures into risk graphs.