Side-by-side comparison

Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm and Dockerfile misconfigurations.

All-in-one scanner for images, filesystems, IaC, Kubernetes and SBOMs; pin its GitHub Action to a commit SHA.

CNCF-graduated runtime security that detects suspicious syscalls in containers and hosts via eBPF.

Kubernetes-native policy engine using YAML and CEL to validate, mutate and generate resources; CNCF graduated.