Onam
Container & Kubernetes Security (KSPM)

Are my Kubernetes clusters and containers configured safely?

Containers move fast. Misconfigurations move faster.

Kubernetes Security Posture Management (KSPM) and container security in one place — covers your full container estate — image vulnerabilities, Kubernetes RBAC, network policies, pod security standards, and cluster CIS benchmarks — across EKS, ECS, and self-managed clusters.

See it in my cloud Read the docs
9,853
posture rules
7
cloud providers
549
cloud services
78
compliance frameworks
Why it mattersHow it worksWhat you getSee it liveFAQ
Why this matters

A pod runs as root.

Its service account can list secrets across the namespace. The base image was pulled from an unofficial registry three releases ago and hasn't been scanned since. Meanwhile the cluster is CIS-non-compliant in seven places nobody has flagged. Every one of those is fine on its own — until an attacker gets shell access on that pod.

The risk of not knowing

If it is not surfaced today, it is exposed today. Attackers do not wait for your quarterly review — and neither do auditors.

Re-checked on every scan, not once a quarter
How does it actually work?

The mechanism, not the marketing

  1. 1

    Onam connects to EKS, AKS, GKE, ECS, and self-managed clusters via read-only Kubernetes RBAC or the equivalent cloud service integration.

  2. 2

    The engine evaluates cluster, node, and workload configuration against CIS Kubernetes Benchmark plus Onam's cloud-native container rules.

  3. 3

    Container images referenced by running workloads are scanned for CVEs in base and application layers, correlated with EPSS and CISA KEV.

  4. 4

    Pod-level analysis flags privileged containers, host mounts, root users, missing security contexts, and over-scoped service accounts.

  5. 5

    Findings feed the same attack-path graph as posture and identity, so a vulnerable image on a pod with a permissive service account shows up as one prioritised risk.

What do you actually get?

Specific outputs, measurable outcomes

KSPMCIS Kubernetes BenchmarkRBACPod SecurityImage scanningAdmission control
Image vulnerability scanning
CVEs in base and app layers
Kubernetes CIS benchmark
cluster, node, RBAC
Service account privilege analysis
Pod security analysis
privileged containers, host mounts, root users
Network policy coverage
Registry security
pull policies, unsigned images, image age
ECS task definition security
Runtime anomaly indicators
See it live

Container & Kubernetes Security (KSPM) in the real console.

A recreation of the Onam console with sample data — the screens and finding types your team works with.

Container Security
Scan Clusters
3
EKS Clusters
24
Nodes
3
Critical CVEs
12
RBAC Violations
Loading live data…
Workload vulnerabilities, ranked
3 EKS clusters, 24 nodes — CVEs ranked by CVSS, EPSS and CISA KEV
Clip length
10s
Data
Demo account
FAQ

Questions we get a lot

EKS, AKS, GKE, OpenShift, Rancher, and self-managed clusters (kubeadm, kops). ECS Fargate and EC2-based ECS clusters are covered separately. Coverage focuses on the control plane, node configuration, workloads, and RBAC — the same regardless of distribution.
Ready to see it live

Ready to see Container & Kubernetes Security (KSPM) in your cloud?

Connect a read-only role in three minutes. Your first findings surface in under five.

Book a live demo →See pricing
Related capabilities
Vulnerability ManagementNetwork SecurityCSPM