kube-bench

kube-bench runs the checks defined in the CIS Kubernetes Benchmark - a widely used, official security configuration standard - against a running cluster, reporting exactly which settings pass or fail and why. It runs as a job inside the cluster it's checking, so it tests the actual live configuration rather than static manifests.

kube-bench is a fit for teams that need to demonstrate or verify Kubernetes configuration compliance against a recognized standard, a distinct, narrower intent than Trivy's broader vulnerability scanning or Kyverno's ongoing policy enforcement (also in this catalog).