November 6, 2023 at 03:10PM
Aqua Security has announced that its open source solution, Trivy, now includes vulnerability scanning for Kubernetes components. This helps companies understand the security of their Kubernetes environment and reduce risk. Trivy also supports Kubernetes Bill of Materials (KBOM) generation, allowing users to track cluster security changes over time. Aqua will showcase Trivy and other innovations at KubeCon + CloudNativeCon in Chicago. More information can be found on the Aqua blog or through the Aqua Open Source Slack.
In a recent press release, Aqua Security announced that its open source solution, Trivy, now supports vulnerability scanning for Kubernetes components. This is in addition to its existing Kubernetes Bill of Materials (KBOM) generation capability. The aim is to help companies better understand the components within their Kubernetes environment and assess their security to reduce risk.
It is highlighted that many companies worldwide are concerned about Kubernetes security, particularly vulnerabilities and misconfigurations. While existing infrastructure scanners only scan for misconfigurations, they cannot analyze Kubernetes components for vulnerabilities. Aqua’s new innovation with Trivy addresses this challenge and provides a solution for the first time.
Earlier this year, Aqua also introduced KBOM generation within Trivy. Similar to a Software Bill of Materials (SBOM), KBOM is a manifest of all the important components that make up a Kubernetes cluster. This includes control plane components, node components, add-ons, and their versions and images. With Trivy’s Kubernetes vulnerability scanning using KBOM, users can gain visibility into their cluster’s security changes over time, identify security issues, and know when to upgrade cluster components.
The visibility provided through KBOM generation and component vulnerability scanning is not only important for companies running their own Kubernetes environments but also for those using managed Kubernetes services. It allows them to assess if their service providers are using vulnerable components that may put them at risk.
Trivy, with nearly 20,000 GitHub stars, is the industry’s most popular vulnerability and risk scanner. Developers can try out Trivy’s KBOM generation today to scan their cluster resources for vulnerabilities. Aqua encourages feedback to improve the experience and provides more information on Trivy KBOM documentation and the Aqua blog. Additionally, all KBOM features will be commercially available as part of Aqua’s Kubernetes Security Posture Management solution (KSPM) and the Aqua Platform in late November.
Aqua will be showcasing Trivy, KBOM, and other innovations during KubeCon + CloudNativeCon from November 6-9 in Chicago. Interested individuals can visit Aqua’s booth (C14) at the event.
Aqua Security is a company that offers a comprehensive Cloud Native Application Protection Platform (CNAPP). They provide security solutions for the entire cloud native application lifecycle, including software supply chain security for developers and cloud security and runtime protection for security teams. Aqua is headquartered in Boston, MA and Ramat Gan, IL, and serves Fortune 1000 customers in over 40 countries. More information can be found on their website at https://www.aquasec.com.