Qualys Kubernetes and Container Security (KCS)

From build to runtime, from on-premises to public cloud: your containers stay secure at every stage.

Containers speed up application delivery, but every image, registry and Kubernetes cluster adds to your attack surface. When security can’t keep pace with development, vulnerabilities ship to production and changes in running containers go unnoticed. Qualys Kubernetes and Container Security (KCS) discovers, tracks and continuously secures containers across the entire DevSecOps lifecycle. It is part of the Qualys Enterprise TruRisk Platform and the TotalCloud CNAPP.

Container security that doesn’t slow DevOps down

KCS embeds security in the tools your development and operations teams already use, so vulnerabilities and drift become visible wherever they appear in the container lifecycle.

• Six Sigma vulnerability detection: Vulnerabilities are discovered with Six Sigma accuracy across the full lifecycle of your containers.
• Configuration drift detection: Deviations in running containers are detected, so environments that quietly change in production don’t slip past you.
• Build-to-runtime protection: Qualys Container Sensors deliver next-generation protection that follows containers from build through runtime.
• Broad integration support: Extensive support for CI/CD tools, container registries and Kubernetes environments, with assessments managed through those tools.
• Hybrid coverage: Container estates on-premises and in public clouds are protected by one solution.

How it works

• Deployment: Container Sensors are deployed in your environment to provide continuous visibility into containers, images and Kubernetes workloads.
• Pipeline integration: Images are assessed in the CI/CD pipeline and in registries, so vulnerable images are caught before they reach production.
• Runtime monitoring: Running containers are monitored for drift and vulnerabilities, and findings flow into the platform’s risk view.
• Unified risk view: Within TotalCloud, container findings are assessed alongside cloud infrastructure and workload risk.

“Catch it in the pipeline, watch it at runtime”: A software team scans every new image with KCS in its CI/CD pipeline and blocks an image with a critical vulnerability before it is pushed to the registry. In the production Kubernetes cluster, a manual configuration change inside a running container is flagged as drift and the team is alerted.

Ready to bring container security into DevSecOps?

Komtera, Qualys’s distributor in Turkey, supports KCS deployments, demos and proofs of concept (POC) with its technical team. Contact us to experience KCS in your own Kubernetes environment.