Platforms Cluster Operations Kubernetes Security
Core 01 · Cluster Operations

Kubernetes security and compliance — audit-ready, continuously.

Atmosly scans every connected cluster against CIS, NSA, PCI DSS, SOC 2, and HIPAA — continuously. It catches drift the moment posture regresses, and generates the evidence pack auditors actually ask for. Compliance becomes a dashboard you watch, not a fire drill you survive.

  • Read-only scanning
  • Drift detection
  • Evidence-pack export
compliance posture · prod-cluster
CIS K8s92%
NSA88%
PCI DSS78%
SOC 284%
HIPAA81%
Top findings
2 pods with privileged: true
Network policies missing in 6 namespaces
9 service accounts with overly-broad RBAC
Scanned continuously against CIS Benchmark NSA Hardening PCI DSS SOC 2 HIPAA ISO 27001
How it works

Scan, catch drift, prove it — without an audit-prep quarter.

Security runs continuously on every connected cluster. No point-in-time snapshot that's stale by lunchtime — a live posture you can watch, and evidence you can hand to an auditor on demand.

continuous scan
RBACRole bindings · least-privilege checks
netpolNamespace isolation · ingress/egress
pod-secPrivileged, hostPath, capabilities
imageRegistry trust · known CVEs
01 — Scan

Continuous checks across every control surface

RBAC, network policy, pod security, secrets, and images — checked continuously against every framework you care about, on every cluster, without you scheduling a thing.

  • CIS, NSA, PCI DSS, SOC 2 & HIPAA frameworks
  • RBAC, network-policy & pod-security checks
  • A live posture score per framework — not a yearly snapshot
drift · prod-cluster
10:14SOC 2 posture 86% → 84%
causeNew SA bound to cluster-admin
alertFlagged to #security · owner notified
02 — Catch drift

Know the moment posture regresses

Configuration drifts — a new binding, a relaxed policy, a fresh namespace without isolation. Atmosly compares posture across every connected cluster and flags the regression, with the cause attached, before it lands in an audit finding.

  • Drift detection across every connected cluster
  • Each regression carries its cause from the audit log
  • Owner notified — no waiting for the next quarterly review
evidence pack
SOC 2 Type II · Q2 2026
Control coverage, check results, and remediation history — exported as the artifact your auditor accepts.
EXPORTevidence-pack · prod-cluster.pdf
controls 142/148timestamped
03 — Prove

The evidence pack auditors actually ask for

When the audit comes, the artifact is already built: control coverage, check results, and remediation history per framework — exported on demand, not assembled by hand over a frantic week.

  • Audit-ready evidence pack export, per framework
  • Control coverage + remediation history, timestamped
  • Zero audit-prep cycles — it's always current
What's inside

Coverage across every Kubernetes attack surface

The checks that turn a cluster from "probably fine" into a posture you can prove — and defend.

Framework coverage

CIS, NSA Kubernetes Hardening, PCI DSS, SOC 2, and HIPAA — each scored continuously, per cluster.

RBAC & permissions

Surfaces over-broad role bindings and service accounts before they become the breach path.

Network policy

Flags namespaces without isolation and risky ingress/egress paths across the cluster.

Pod security

Catches privileged containers, hostPath mounts, and dangerous capabilities at admission and at rest.

Image & supply chain

Checks registry trust and known CVEs so what runs in the cluster is what you vetted.

Audit-ready evidence

One-click evidence pack with control coverage and remediation history, accepted by auditors.

The payoff

What changes when compliance runs itself

5+
frameworks scored continuously, per cluster
0
audit-prep cycles — the evidence is always current
minutes
to a shareable evidence pack, not a quarter
every
cluster compared for drift, continuously

Representative of customer-reported outcomes. Your results depend on cluster count and current posture.

Questions

What teams ask before connecting a cluster

Does scanning need write access to my cluster?
No. Security scanning is read-only. Atmosly reads your cluster's configuration and reports posture, drift, and findings — it never needs write access to assess you. Remediation, when you choose it, runs through the same guardrails as everything else.
Does it replace Trivy, Kyverno, or my admission controller?
It complements them. Atmosly gives you a unified posture across frameworks and clusters, and coexists with the policy and scanning tools you already run — pulling their signal into one place rather than asking you to rip anything out.
How is drift actually detected?
Atmosly continuously re-scores each cluster's posture and compares it over time and across clusters. When a framework score regresses — a new binding, a relaxed policy — it's flagged with the cause pulled from the audit log, so you see what changed and why.
Will auditors accept the evidence pack?
The pack is built around what auditors ask for: control coverage, check results, and timestamped remediation history per framework. It's the artifact teams hand over for SOC 2 and PCI DSS reviews — generated on demand, always reflecting the cluster's current state.

How exposed is your cluster right now?

Connect one cluster, read-only. Your posture across CIS, PCI DSS and SOC 2 — plus the privileged pods, missing policies, and broad RBAC — shows up on your dashboard in about five minutes. Free, no sales call.

Scan my cluster → Book a 15-min walkthrough