The Kubernetes Security Posture Management (KSPM) capability, driven by the KSPM Connector component, is positioned as a core security module within Cortex Cloud. KSPM is a lightweight cloud-native solution for Kubernetes security, both posture management and real-time protection that automatically discovers assets, enforces policies, and scans for vulnerabilities, malware, secrets, and misconfigurations across the environment.
The Cortex Cloud KSPM offering focuses on comprehensive security posture and compliance checks:
Inventory and visibility: KSPM provides full visibility into your Kubernetes cluster and resources, including namespaces, nodes, and workloads. The KSPM dashboard provides a visual overview, including inventory insights and cluster protection coverage to show which clusters have no protection solution deployed.
Compliance and misconfiguration detection: KSPM leverages hundreds of out-of-the-box KSPM rules. It detects compliance violations and misconfigurations using built-in and custom rules mapped to compliance controls. Compliance checks include CIS Benchmarks for both managed and unmanaged Kubernetes distributions. Custom rules are supported using Rego for the KSPM Connector and Python for Cortex XDR agent endpoints.
Vulnerability, malware, and secret scanning: KSPM receives critical security information related to vulnerabilities (via AVA scan), malware, secrets, and other available scanners. AVA scan is a vulnerability identification and prioritization engine that discovers security vulnerabilities in Kubernetes cluster nodes and correlates findings with running workloads. Malware scanning detects suspicious or malicious code patterns within cluster workloads. Secret scanning identifies exposed credentials, API keys, authentication tokens, and other sensitive data that could be exploited for unauthorized access. The KSPM dashboard includes metrics for malware detected and secrets detected in clusters, enabling security teams to prioritize remediation efforts.
Policy enforcement and control: An admission controller ensures all new resources meet required security and governance standards, enhancing the overall security posture of your environment. The admission controller intercepts requests to the Kubernetes API server before they are persisted, allowing enforcement of access control, image assurance, and security configurations.
Centralized policy management: The offering provides centralized Cloud Workload Policy management and enforcement at runtime when the admission controller is used.
Real-time threat detection and response (XDR): Beyond static posture, the solution provides active XDR capabilities to detect and intercept threats as they happen. It monitors live cluster activity to identify malicious behavior, zero-day attacks, and unauthorized runtime changes. This ensures that instead of just finding vulnerabilities, you are actively defending your environment against ongoing attacks with immediate visibility and automated response.