Platform security
Kubernetes security tools that gate the cluster you operate (2026)
A 2026 shortlist of gates and sensors on a cluster you run. Public docs, not a lab bake-off.
Expertise: Platform security · Level: Intermediate · 12 min read
A pretty dashboard is not an admission controller.
The pod ran as root because nobody admitted the manifest. Platform security is the factory. Cloud is the account. AppSec is the code. Falco rules also sit on the detection-as-code list. This page is the cluster.
Six gates. One runtime. One scanner. Two admission engines. One in-cluster Trivy. One CNAPP view. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Falco | Runtime rules on syscalls | Apache-2.0 |
| Kubescape | Cluster and YAML scanner you can CI | Apache-2.0 |
| Kyverno | Kubernetes-native admission policies | Apache-2.0 |
| OPA Gatekeeper | Rego admission on the cluster | Apache-2.0 |
| Trivy Operator | In-cluster scan from the Trivy engine | Apache-2.0 |
| Wiz (cluster view) | CNAPP view of the cluster you already bought | Commercial |
Falco
Best for runtime rules on syscalls
Falco is the runtime sensor. Rules are on the detection-as-code list. Here it is the DaemonSet.
Key features
- Syscall and K8s audit
- YAML rules
- Apache-2.0
- You operate it
Why we like it
Hidden gem for runtime. A policy that only exists at admit time will miss the process that changed later.
Limits
Noise. Not a historical SIEM. Link detection-as-code for the YAML job.
Kubescape
Best for cluster and YAML scanner you can CI
Kubescape scans cluster and manifests against frameworks. ARMO opened it.
Key features
- NSA and MITRE-style frameworks they document
- CI and in-cluster
- Apache-2.0
- CLI
Why we like it
A scan you can run in PR is the admit-before-admit.
Limits
A scan is not an admission controller. You still need Kyverno or Gatekeeper to reject.
Kyverno
Best for kubernetes-native admission policies
Kyverno policies look like Kubernetes YAML. Validate, mutate, generate. CNCF.
Key features
- YAML policies
- Validate and mutate
- Reports
- Apache-2.0
Why we like it
If the team already writes Kubernetes YAML, Kyverno is the policy they will finish.
Limits
Cluster-scoped ops is still a privilege. A bad policy can block the cluster. Test in a cluster you own.
OPA Gatekeeper
Best for rego admission on the cluster
Gatekeeper is OPA for admission. ConstraintTemplates are Rego. The authorization list already rows OPA for the app.
Key features
- Rego constraints
- Audit of existing objects
- Apache-2.0
- Same language as OPA
Why we like it
If Rego is already the org language, do not invent a second one for the cluster.
Limits
Rego is easy to write badly. Constraint bugs fail closed or open depending on how you set it. Test.
Trivy Operator
Best for in-cluster scan from the Trivy engine
Trivy Operator runs Trivy inside the cluster. The SBOM list rows the CLI. This is the operator.
Key features
- Vulnerability and config CRDs
- Apache-2.0
- In-cluster
- Same engine as Trivy
Why we like it
If CI already runs Trivy, the operator is the same finding on what actually runs.
Limits
A CRD is not admission. You still need a policy to block.
Wiz (cluster view)
Best for cNAPP view of the cluster you already bought
Wiz appears on cloud and DSPM lists. Here it is the cluster graph if you already bought it.
Key features
- Agentless snapshots they document
- K8s findings
- Commercial
- Same tenant
Why we like it
Known shelf. Do not buy Wiz twice. Link the CNAPP list.
Limits
Commercial. Not an admission controller you write. Overlap declared.
What the internet thinks about Kubernetes security tools
Falco threads are honest about noise and eBPF. Admission is still required. Runtime is still a different door.
pwny700 on Hacker News, Mar 2025: “We couldn’t use Falco in production on our kubernetes infrastructure because eBPF is hard to do right.”
Prove Kyverno still ships Apache-2.0
Confirm Kyverno still publishes Apache-2.0. Apply policies only on a cluster you own.
curl -fsS https://raw.githubusercontent.com/kyverno/kyverno/main/LICENSE | head -n 5FAQs
Does a scanner replace admission?
No. A scan warns. Admission rejects. Different door.
Is this the cloud platforms list?
No. That page is the account CNAPP. This page is the cluster you operate.
Why is Falco on two lists?
Rules are detection as code. The DaemonSet is platform. We link both.
Is this a scored bake-off?
No. Order is editorial. No escape recipes.
