Open Source Security & compliance Software

Application security, API Security, Identity and Access Management, 2FA, Security for container environments

Alcide provides dev-to-production security for workloads running in Kubernetes & Istio

A service that analyzes docker images and scans for vulnerabilities

Apolicy fuses security and compliance into your cloud native development pipeline. Using policy-as-code, we automate risk, policy and remediation from source to production

Aqua Security is a software company providing cloud-native security technology.

Creators of Kubescape: the first end-to-end open-source Kubernetes Security platform, made for DevOps.

Fine-grained, policy-based, real-time authorization for APIs and microservices. Aserto is the maintainer of the Topaz and Open Policy Containers OSS projects.

Black Duck provides a comprehensive software composition analysis (SCA) solution for managing security, quality, and license compliance risk that comes from the use of open source and third-party code in applications and containers.

Bloombase is the intelligent storage firewall company

High-performance attack protection for Linux production environments – whether containerized, virtualized, or bare-metal, on-prem or cloud

Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage by writing context-aware access control policies for your application resources.

Automatically provision and manage TLS certificates in Kubernetes

Chaitin Tech is a world leading and technology driven cyber security solution provider.

Check Point Software Technologies Ltd. is a leading provider of cyber security solutions to corporate enterprises and governments globally. Check Point protects over 100,000 organizations of all sizes.

Checkov scans cloud infrastructure configurations to find misconfigurations before they are deployed. Checkov manages and analyzes infrastructure as code (IaC) scan results across platforms such as Terraform, CloudFormation, Kubernetes, Helm, ARM Templates and Serverless framework.

InSpec: Auditing and Testing Framework

Vulnerability Static Analysis for Containers

Pioneering the world of self-healing, self-aware, self-sustaining, self-resilient, self-secure and intelligent remediation, MatosSphere brings a complete cloud security and governance solution for your cloud infrastructure.

Confidential Containers is an open source community working to enable cloud native confidential computing by leveraging Trusted Execution Environments to protect containers and data.

ContainerSSH launches a new container for each SSH connection in Kubernetes, Podman or Docker. The user is transparently dropped in the container and the container is removed when the user disconnects. Authentication and container configuration are dynamic using webhooks, no system users required.

Curiefense is a unified, open source platform protecting cloud native applications.

Datica brings the cloud to healthcare and helps highly regulated industries.

Prevent Kubernetes misconfigurations from reaching production (again 😤 )! From code to cloud, Datree provides an E2E policy enforcement solution to run automatic checks for rule violations. See our docs: https://hub.datree.io

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

Dosec Security Platform provides security protection capabilities for containers, kubernetes, microservices, serverless, and DevOps.

External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.

Kubernetes security, policy and compliance experts

Cloud Native Runtime Security

Fast, portable and reliable dependency analysis for any codebase. Supports license & vulnerability scanning for large monoliths. Language-agnostic; integrates with 20+ build systems.

FossID is a software composition analysis tool that scans code for open source licenses and vulnerabilities.

Fugue empowers cloud engineering and security teams to move faster with confidence in their cloud security. Use Fugue to secure the entire development lifecycle—from infrastructure as code through CI/CD and runtime—using a unified policy engine powered by the Open Policy Agent (OPA), the open source standard for policy as code.

Get your resource requests "Just Right"

Artifact Metadata API

Hexa Policy Orchestrator enables you to manage all of your access policies consistently across software providers.

in-toto is a framework to protect supply chain integrity.

Bootstrap & Maintain Trust on the Edge / Cloud and IoT.

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark

Hunt for security weaknesses in Kubernetes clusters

Runtime protection for Kubernetes & other cloud Workloads. Kubearmor provides a observability and policy enforcement system to restrict any unwanted, malicious behaviour of cloud-native workloads at runtime.

Kubescape is an open source security and compliance platform that scans clusters, Kubernetes manifest files (YAML files, and Helm charts), code repositories, container registries and images. It detects misconfigurations according to frameworks such as the NSA-CISA, MITRE ATT&CK® and CIS, as well as software vulnerabilities, and calculates risk scores.

Manage admission policies in your Kubernetes cluster with ease

Kubernetes Native Policy Management

Metarget is a framework providing automatic constructions of vulnerable cloud native infrastructures.

Cloud native infrastructure security for your entire fleet

Moresec Shangfu Cloud Native Protection Platform is a security protection model based on the concept of cloud native. In view of the characteristics of cloud native application life-cycle, it involves in many stages of security protection, including R&D construction, security testing, image control, container deployment, container operation, etc. Shangfu also integrates security with development which means providing feedback of the application security condition through correlating operation asset, and promoting the iteration and upgrade of application. Whereupon, a closed loop of efficient cloud native application security risk is created, covering the whole stages of DevSecOps.

NeuVector Full Lifecycle Container Security Platform delivers the only cloud-native security with uncompromising end-to-end protection from DevOps vulnerability protection to automated run-time security, and featuring a true Layer 7 container firewall.

The solution enables DevSecOps teams to ensure the security, compliance, and operational readiness of their Kubernetes workloads and clusters. By automating the creation, deployment, and lifecycle management of policy-based Intelligent Guardrails, customers can gain insights, alerts, and reports, and enable effective collaboration across development and operations teams.

Notary is a project that allows anyone to have trust over arbitrary collections of data

An open source, general-purpose policy engine.

A docker-inspired CLI for building, tagging, pushing, pulling, and signing OPA policies to and from OCI-compliant registries.

OpenFGA is a high performance and flexible authorization/permission system built for developers and inspired by Google Zanzibar

NIST Certified SCAP 1.2 toolkit

Orca Security provides instant-on, workload-level security for AWS, Microsoft Azure, and Google Cloud Platform.

Noise Cancellation for Application Security. Built for cloud-native applications using container and Kubernetes-based architectures.

Open source, Security-as-Code platform for developers and security teams to identify and eliminate risks in your clouds.

Paralus is a free, open source tool that enables controlled, audited access to Kubernetes infrastructure and Zero trust Kubernetes with zero friction.

Platform AbstRaction for SECurity service

Passage makes it easy for developers to implement passwordless customer identity in any application.

A cli tool to help discover deprecated apiVersions in Kubernetes

Validation of best practices in your Kubernetes clusters

Kubernetes-native security solution, single pane of glass for containers and Kubernetes security.

A complete cloud native application protection platform that secures infrastructure and applications across cloud environments.

Qingteng Honeycomb · Container Security Platform can display risk scenarios visually for enterprises through continuous monitoring and analysis of the container security status, and protects the container environment during the entire life cycle (build, ship, and run) of the container.

Easily find roles and cluster roles attached to any user, service account, or group name in your Kubernetes cluster

A Kubernetes operator that simplifies the management of Role Bindings and Service Accounts.

Rudder is a configuration and security automation platform. Manage your Cloud, hybrid or on-premises infrastructure in a simple, scalable and dynamic way.

Scribe Security is a Tel Aviv, Israel-based provider of a SaaS platform for securing software across various supply chains.

Common go library shared across sigstore services and clients

Snyk is a cloud native application security provider that enables millions of developers to build software securely.

Sonobuoy is a diagnostic tool that makes it easier to understand the state of a Kubernetes cluster by running a set of Kubernetes conformance tests and other plugins in an accessible and non-destructive manner.

Spyderbat provides Linux runtime security, protecting dynamic environments by proactively tracking all user activities by their causal connections to detect and resolve external attacks, misconfigurations, and insider threats.

StackHawk helps developers find and fix application security vulnerabilities before they hit production with CI/CD automation.

StackRox is a Kubernetes-native security platform for cloud-native applications, containers, serverless, and Kubernetes.

Sysdig Secure embeds security and compliance into the build, run and respond stages of the Kubernetes lifecycle. 

Tensor Security is a cloud-native security company focused on providing AI-based and full-stack cloud-native security solutions.

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

eBPF-based Security Observability and Runtime Enforcement

Python reference implementation of The Update Framework (TUF)

Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more.

Active, zero-trust based security for containers and Kubernetes

Cloud-native authorization for modern applications and APIs, combining the best of Open Policy Agent and Google Zanzibar

Trend Micro, a global technology leader, helps make the world safe for exchanging digital information with its innovative security platform.

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Trivy-Operator operate trivy security tool on the Kubernetes cluster and incorporate it outputs into Kubernetes CRDs (Custom Resource Definitions) and from there, making security reports accessible through the Kubernetes API

Mend is a platform designed to automate open source security and compliance processes.

Zettaset is software-defined encryption that protects against data theft and can be deployed across all physical and virtual environments.