FAQs

What Kubernetes environments does Mitigant KSPM support?

‍

Mitigant KSPM works with all Kubernetes distributions:

‍

Managed Kubernetes:

• Amazon EKS (Elastic Kubernetes Service)
• Azure AKS (Azure Kubernetes Service)
• Google GKE (Google Kubernetes Engine)

‍

Self-Hosted Kubernetes:

• Vanilla Kubernetes clusters
• OpenShift
• Rancher
• K3s
• MicroK8s

‍

Hybrid Environments:

• Mix of managed and self-hosted
• Multi-cluster deployments
• Edge Kubernetes installations

‍

Architecture Support:

• Single clusters
• Multi-cluster federation
• Multiple clusters across clouds

‍

‍

How does Mitigant KSPM detect misconfigurations in Kubernetes?

‍

Mitigant KSPM uses agentless monitoring of Kubernetes clusters:

‍

What it monitors:

• Pod security configurations (privileged containers, host namespaces, etc.)
• RBAC policies and service account permissions
• Network policies and ingress/egress rules
• Secrets management and storage
• Resource limits and quotas
• Image configurations and vulnerabilities
• API server settings
• etcd security
• Node configurations

‍

How it works:

• Connects to Kubernetes API (read-only access)
• Continuous assessment of cluster state
• Compares configurations against security best practices
• Maps findings to Kubernetes-specific benchmarks

‍

No performance impact:

• No agents or DaemonSets to deploy
• No resource consumption on nodes
• No network overhead
• Works with existing cluster permissions

‍

‍

Can Mitigant KSPM prioritize vulnerabilities by exploitability?

‍

Yes. Mitigant KSPM includes vulnerability prioritization:

‍

How prioritization works:

• Scans container images for known CVEs
• Assesses runtime context (is the container actually running?)
• Evaluates network exposure (is it internet-facing?)
• Considers privileges (does it run as root?)
• Checks for active exploits in the wild

‍

Prioritization factors:

• Severity: CVSS score
• Exploitability: Is there a public exploit?
• Exposure: Is the workload accessible?
• Context: What privileges does the container have?
• Validation: Can CAE prove it's exploitable?

‍

Integration with CAE:

• KSPM finds container vulnerabilities
• CAE validates whether they're exploitable in your specific environment
• Reduces noise by focusing on validated risks

‍

This approach dramatically reduces the vulnerability backlog by focusing on what actually matters.

‍

‍

How does Mitigant KSPM handle multi-cluster environments?

‍

Mitigant KSPM provides centralized visibility across all clusters:

‍

Multi-Cluster Features:

• Single dashboard showing all clusters
• Unified policy enforcement
• Consistent compliance monitoring
• Cross-cluster comparison and benchmarking
• Aggregated reporting

‍

Cluster Organization:

• Group clusters by environment (dev/staging/prod)
• Tag clusters by team or business unit
• Filter by cloud provider or region
• Create custom cluster hierarchies

‍

Use Cases:

• Monitor security posture across 10s or 100s of clusters
• Ensure consistent security policies
• Identify configuration drift between clusters
• Centralized compliance reporting
• Track security metrics across the entire K8s estate