Skip to main content

Run Security Scan on Cluster

Atmosly provides two types of security scanning to assess the security health of your infrastructure:

  1. Kubescape — Kubernetes cluster-level security scanning
  2. Prowler — AWS account-level security assessment

Kubescape (Cluster Security Scan)​

Kubescape is an open-source Kubernetes security scanner that evaluates your cluster against security best practices and compliance frameworks.

Key Features​

  • Security Score: A numeric score (0-100) indicating the overall security posture of your cluster
  • Compliance Score: Measures how well your cluster adheres to security policies and best practices
  • Category Summary: Breakdown of findings by security category
  • Trend Analysis: Track how your security posture changes over time with historical scan data
  • Control-level Details: Drill down into individual security controls to see specific failures and remediation steps

What is Evaluated​

  • Access control configurations
  • Control plane security
  • Secrets management
  • Workload security settings
  • Network policies
  • Pod security standards
  • Resource limits and requests

Compliance Frameworks​

When you start a scan, you choose one or more frameworks to evaluate the cluster against, organized into two groups:

Kubernetes Baselines

FrameworkWhat it checks
CIS KubernetesCIS Kubernetes Benchmark v1.10.0 — the auditor-friendly hardening baseline.
MITRE ATT&CKAdversary techniques mapped for containers.
ArmoBestKubescape's opinionated best-practice baseline.

Compliance Frameworks

FrameworkWhat it checks
SOC 2SOC 2 Trust Services Criteria mapping.
ISO 27001ISO/IEC 27001 Annex A control mapping.
tip

Use Recommended to select a sensible default set, or Select all to evaluate against every framework.

In the results, each failed control is tagged with the framework(s) it maps to — for example CIS Kubernetes v1.10.0, MITRE ATT&CK, ArmoBest, SOC 2, or ISO 27001 — so you can see which standards an issue affects and prioritize accordingly.

How to Run a Kubescape Scan​

  1. Navigate to the Clusters section from the main dashboard.
  2. Click on the cluster you wish to scan.
  3. In the top-right corner, click the Cluster Actions dropdown.
  4. Select Run Security Scan.
  5. In the Run security scan dialog, choose the frameworks to evaluate the cluster against (see Compliance Frameworks above). Use Recommended, Select all, or Clear to adjust your selection.
  6. Click Run scan and wait for it to complete.

Viewing Results​

Once the scan completes, review:

  • Security Score and Compliance Score displayed prominently
  • Category Summary — breakdown of findings by area (access control, networking, workload security, etc.)
  • Controls — detailed list of security checks with pass/fail status
  • Severity Levels — each finding is tagged with severity (Low, Medium, High, Critical)
  • Remediation Recommendations — specific guidance to fix failed controls
  • Trend Charts — filter by time period to view security score trends over multiple scans
info

Scans can be run on both Atmosly-provisioned and imported clusters (including token-imported clusters).

Prowler (AWS Account Security Assessment)​

Prowler provides a comprehensive security assessment at the AWS account level — not a specific cluster. It evaluates the security posture of your entire cloud account, covering IAM, networking, storage, and other AWS services.

Key Features​

  • Account-wide scanning: Evaluates security across your entire AWS account, not just Kubernetes
  • Selectable scan regions: Choose exactly which AWS regions to assess directly from the UI (up to 3 regions per scan), instead of always scanning every region. Scoping the scan to the regions you actually use means faster scans and fewer findings from inactive or unused regions.
  • Multiple scan types: Different scan profiles for various compliance frameworks
  • S3 report storage: Scan reports are stored in S3 for historical reference
  • Detailed findings: Categorized by AWS service, severity, and compliance framework
  • Rate limited: Maximum 3 scans per account per day

How to Run a Prowler Scan​

  1. Navigate to the Security section.
  2. Select Prowler Scan.
  3. Choose the AWS Cloud Account to scan.
  4. Select the Scan Type based on the compliance framework you need.
  5. Select the Regions to scan (required) — pick up to 3 AWS regions from the list so the assessment is scoped to only the regions you care about. Use the Quick select active regions shortcut to pick the regions Atmosly auto-detects as active in your account.
  6. Wait for the scan to complete (this may take several minutes depending on account size and the number of regions selected).
note

At least one region is required, and a maximum of 3 regions can be scanned per run — scanning all regions at once may time out due to session limits.

Viewing Results​

  • Scan reports are accessible from the Prowler section
  • Results include pass/fail status for each security check
  • Findings are categorized by AWS service and severity
note

Prowler scans are only available for AWS accounts and scan the entire account (not individual clusters). For cluster-specific security scanning, use Kubescape.

Best Practices​

  • Run scans regularly to maintain continuous compliance and catch drift
  • Address critical findings immediately — prioritize High and Critical severity issues
  • Monitor trends to ensure your security posture improves over time
  • Combine both scan types for comprehensive coverage (Kubescape for K8s, Prowler for AWS)

Permissions​

To run security scans, your Atmosly user role must have the Security Scan permission enabled. Contact your organization admin if you are unable to initiate or view scan results.