Container, Kubernetes & cloud security

Trivy

aquasecurity/trivy

Popular

All-in-one scanner for images, filesystems, IaC, Kubernetes and SBOMs; pin its GitHub Action to a commit SHA.

Falco

falcosecurity/falco

Popular

CNCF-graduated runtime security that detects suspicious syscalls in containers and hosts via eBPF.

Kyverno

kyverno/kyverno

Popular

Kubernetes-native policy engine using YAML and CEL to validate, mutate and generate resources; CNCF graduated.

OPA Gatekeeper

open-policy-agent/gatekeeper

Kubernetes admission controller that enforces OPA/Rego policies through constraint templates.

Kubescape

kubescape/kubescape

CNCF Kubernetes security platform for posture scanning (NSA, CIS, MITRE), vulnerabilities and runtime.

Checkov

bridgecrewio/checkov

Popular

Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm and Dockerfile misconfigurations.

Prowler

prowler-cloud/prowler

Rising

Open-source cloud security posture tool auditing AWS, Azure, GCP and Kubernetes against CIS and compliance frameworks.

Wiz

wiz.io

Popular

Agentless cloud security platform (CNAPP), acquired by Google in 2026; a leader in cloud risk visibility.

Tetragon

cilium/tetragon

Rising

Cilium's eBPF-based runtime security observability with in-kernel enforcement for Kubernetes.

kube-bench

aquasecurity/kube-bench

Checks Kubernetes nodes and control planes against the CIS Kubernetes Benchmark.

tfsec

aquasecurity/tfsec

Legacy

Terraform static analysis scanner, now folded into Trivy; new projects should use trivy config instead.