Kubernetes Security Posture Management (KSPM) is the continuous scanning of clusters against security benchmarks (CIS, NSA-CISA, PCI-DSS), detecting drift from the desired state, and surfacing vulnerabilities in workloads. The team that runs production K8s clusters uses KSPM to catch misconfigurations that would otherwise go unnoticed - default ServiceAccounts with cluster-admin, privileged containers, hostPath mounts, missing NetworkPolicies.
Table of contents
- What KSPM actually does
- The CIS Kubernetes Benchmark
- KSPM tools compared
- Drift detection
- Runtime vs posture
- FAQ
What KSPM actually does
A KSPM tool ingests cluster state (API server, kubelet configs, RBAC, network policies, pod specs, image metadata) and compares it against a benchmark (typically CIS Kubernetes Benchmark). It produces:
- Pass/fail per control.
- Severity ranking (critical, high, medium, low).
- Remediation guidance per finding.
- Drift detection (config changed since last scan).
- Continuous or scheduled scanning.
The team that uses KSPM catches the misconfiguration that the cluster admin missed. The team that does not run KSPM finds out about the misconfiguration from a security incident.
The CIS Kubernetes Benchmark
The Center for Internet Security publishes the Kubernetes Benchmark (~250 controls across API server, kubelet, etcd, networking, RBAC, pod security).
Common high-severity findings:
- Anonymous authentication enabled on kubelet.
- Default ServiceAccount used for workloads (auto-mounts the SA token into every pod).
- Privileged containers allowed.
- hostPath / hostNetwork / hostPID used.
- No NetworkPolicies (default-allow across all namespaces).
- Secrets in etcd not encrypted at rest.
- Audit logging disabled.
The team that runs kube-bench against a fresh cluster sees 30-80 failures out of the box. The team that fixes them all before production has a hardened cluster; the team that ignores them has the same setup as everyone else (which is the average, not the secure).
KSPM tools compared
- Aqua Security: Full lifecycle security (scanning, runtime, KSPM). Commercial.
- Wiz: Cloud security platform with KSPM module. Agentless.
- Prisma Cloud (Palo Alto): Full CNAPP with K8s posture.
- Snyk: Developer-focused, scans images and IaC.
- kube-bench (Aqua open-source): The free CIS checker from Aqua. Run as a Job in-cluster.
- kube-hunter (Aqua open-source): Active scanner that probes for vulnerabilities.
- Trivy: Open-source scanner for images, IaC, K8s manifests.
- Polaris (Fairwinds): Open-source, YAML linting + best practices.
- Kubescape (ARMO): Open-source, CIS + NSA-CISA + MITRE benchmarks.
The team that wants a free, self-hosted option uses kube-bench + Trivy + Polaris. The team that wants a managed, full-platform option uses Wiz or Prisma Cloud.
Drift detection
Drift is when the cluster’s actual state diverges from the desired state (IaC definition).
Example: the team declares privileged: false in the Helm chart. Someone runs kubectl edit deployment and sets privileged: true. Drift detected.
KSPM tools flag this. The team that uses drift detection catches human-driven changes that bypass IaC. The team that does not detect drift until the next security audit has weeks of untracked changes.
Runtime vs posture
Posture = configuration. Runtime = behavior.
- KSPM (posture): Are the configs secure? (CIS compliance, RBAC, network policies.)
- Runtime security (CWPP): Is the running workload behaving safely? (syscall monitoring, file integrity, network connections.)
The team that uses both has full coverage. The team that uses only posture catches the misconfiguration but not the active attack. The team that uses only runtime catches the attack but not the misconfiguration that allowed it.
Falco, Tetragon, and Aqua Runtime are the runtime security leaders. Wiz and Prisma Cloud cover both posture and runtime.
FAQ
What is the difference between KSPM and CSPM?
KSPM (Kubernetes Security Posture Management) is for K8s clusters. CSPM (Cloud Security Posture Management) is for the cloud account (AWS, GCP, Azure). The team that runs K8s in the cloud uses both - CSPM for the cloud account, KSPM for the cluster.
Do I need a commercial KSPM tool?
Not strictly. kube-bench, Trivy, Kubescape, and Polaris cover the open-source path. The commercial tools (Wiz, Aqua, Prisma) add: agentless scanning, multi-cluster dashboards, automated remediation, and integration with the rest of the cloud security platform. The team that runs 1-3 clusters does fine with open-source. The team that runs 50+ clusters with compliance requirements uses commercial.
How often should I scan?
Continuously (the commercial tools do this). For open-source: every CI/CD deploy + a daily scheduled scan. The team that scans only on deploy misses runtime drift (someone editing a running deployment).
What is the most common K8s misconfiguration?
Default ServiceAccount with broad permissions. The fix: create per-workload ServiceAccounts with minimal RBAC, and set automountServiceAccountToken: false for workloads that do not need the API. The team that uses the default SA everywhere has a wide blast radius if any pod is compromised.
What is a Pod Security Standard?
PSS (Privileged, Baseline, Restricted) is the K8s-native replacement for the deprecated PodSecurityPolicy. Apply PSS at the namespace level with labels. The team that uses Restricted PSS as the default for new namespaces catches most container-escape risks before deploy.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: