Kubernetes Penetration Testing As a sERVICE

Find Out How (In)Secure your Kubernetes Cluster is

Kubernetes Has A Large Attack Surface, Complex Authz and is Likely Processing Critical Business Data

✔︎ Actionable Report with Remediation | ✔︎ Issues Mapped to MITRE ATT&CK & CVSS 3.1 | ✔︎ Exploitation Proofs

See how it works!

Attack surface evaluation and testing

Full cluster config and complete attack surface reviewed and tested

- MITRE ATT&CK, PTES and OWASP standards
- Enumeration of external, attacker in a pod and VPS neighbourhood attack surfaces
- Pod access to cluster services
- CIS K8s Benchmarks & Container registry checks
- Cloud VPS to Node access checks
‍

Complete Authn and Authz Audit

Ensuring 100% Accountability for Your Cloud, Cluster, and Containers

- RBAC and Cloud IAM privilege audit across cloud, cluster and containers
- All RBAC roles and bindings audited
- Cloud IAM to K8s Service Account identity mapping verification
- Cloud Metadata API access & cloud platform services visibility
- Service account token privilege enum

Identify what to fix, how and when to fix it

Simple + actionable report, for devs, not just security teams

- Detailed Report available in multiple formats - PDF, DOCX and CSV
- Steps to remediate in dev friendly language
- Exploit proof of concepts
- Severity mapping to CVSS 3.1 to prioritise fixes

Download Kubernetes PTaaS Detailed Methodology

WHY Should you Test your Kubernetes CLUSTER?

Running a secure Kubernetes Cluster is nearly impossible

Our PTaaS delivers quick results, actionable reports for Engineering/DevOps/DevSecOps teams who take active defence seriously

Detect and Identify Critical Exploitable Vulnerabilities

Go beyond low hanging fruit and compliance checks

Fix Issues without breaking prod with dev friendly reports

Our PTaaS methodology focuses on attacker tactics allowing for the discovery of critical and exploitable vulnerabilities. Critical severity issues can often lead to complete cluster compromises and can lead to data breaches.

Our methodology uses the MITRE ATT&CK framework and PTES to go beyond compliance checks to find vulnerabilities visible to external attackers, attackers in a pod and in the cloud neighbourhood

Our developer friendly reports focus on mitigation and solutions to ensure businesses and teams can fix and move forward without breaking production or creating significant downtime that would affect the business.

Download Sample Report