Security findings from AWS, Kubernetes and pull requests, sent to the team that owns them.
KSec reads the findings of the AWS security services that you already run, scans your EKS clusters with one Helm chart, and checks every pull request. Each finding gets an owner, so the right team fixes it.
KSec is in development. Early access is open for teams on AWS and EKS.
| Severity | Finding | Source | Owner |
|---|---|---|---|
| Critical | Image payments-api:2.14 has a critical vulnerability with a fixCluster scan | Cluster scan | Payments |
| High | S3 bucket exports-prod allows public read accessAWS Security Hub | AWS Security Hub | Data |
| Medium | Pull request #482 adds a container that runs as rootPull request | Pull request | Web |
How it works
Cloud
KSec reads AWS Security Hub, GuardDuty and Inspector through a read-only role in your AWS organization. You turn these services on and pay AWS for them. KSec does not scan your cloud a second time.
Kubernetes
One Helm chart runs open-source scanners in each EKS cluster. They check the running images and the cluster configuration, and send their results to KSec. The chart uses only open-source components with permissive licenses.
Pull requests
A GitHub check runs on every pull request. It shows what the change adds and what it fixes, for example “adds 3 findings, fixes 1”. You decide if a critical finding blocks the merge.
Who sees what
- CISO
- The open risk across all accounts and clusters, and how it changes over time.
- Security engineer
- Every finding with its source and its resource. Filter, group and assign findings, or accept a risk until a set date.
- Team lead
- The findings of the services that the team owns. Ownership comes from your repositories, or from a ksec.yaml file in a repository.
What comes next
These parts are planned after the first release.
- SOC 2 and ISO 27001. The same findings count as evidence for the technical controls of an audit.
- Google Cloud and Azure.
- GitLab and Jenkins.
Early access
We look for a small number of teams on AWS and EKS that want to use KSec first and help to shape it. Tell us about your setup, and we answer by email.
Request early access