ARMO Platform is a Kubernetes security and cloud-native application protection platform (CNAPP) built by ARMO. It is built on Kubescape, an open-source project ARMO created and donated to the Cloud Native Computing Foundation, where it now holds incubating project status. The platform covers the security lifecycle from pre-deployment code scanning to live runtime threat detection across multi-cluster Kubernetes environments.
ARMO deploys lightweight agents and operators inside clusters to perform continuous posture management, configuration analysis, image scanning, and runtime behavior monitoring. It uses eBPF (Extended Berkeley Packet Filter) technology to observe container memory, system calls, and network interactions at the kernel level.
A core part of ARMO’s approach is combining static scanner output with eBPF runtime context to identify which vulnerable components are actually loaded into memory during execution. The company reports this can cut actionable CVE alerts by up to 95 percent. ARMO also supports air-gapped, on-premises, and hybrid Kubernetes deployments alongside managed cloud services.
The underlying Kubescape project currently has over 11,000 stars on GitHub. ARMO has raised a total of 34.5 million dollars, with its Series A round led by Tiger Global and Hyperwise Ventures, and participation from Pitango First and Peled Ventures.
Pricing
ARMO offers a free community tier based on open-source Kubescape, covering cluster posture scanning, vulnerability detection, and CLI usage without node fees. A free trial is available for the SaaS ARMO Platform to evaluate enterprise capabilities. Paid plans scale primarily on a per-node, usage-based model for managed worker nodes, and an enterprise custom tier adds dedicated support and custom SLAs for high-volume, multi-cluster environments. Exact per-node and enterprise pricing figures are not published and require direct sales contact.
* Disclaimer: Please note that pricing information may not be up to date. For the most accurate and current pricing details, refer to the official website.
Key Features
-
✓
Posture scanning against NSA-CISA, CIS Benchmarks, and MITRE ATT&CK
-
✓
eBPF-based runtime threat detection for anomalous kernel activity
-
✓
Runtime-based vulnerability prioritization filtering out non-reachable CVEs
-
✓
Automated fix suggestions and pull requests into infrastructure-as-code repos
-
✓
Auto-generated Seccomp and network profiles to reduce attack surface
-
✓
CI/CD scanning of Helm charts, manifests, and container images
Use Cases
Reducing Vulnerability Alert Fatigue
Security teams often face thousands of container vulnerability alerts, making manual triage impractical. ARMO uses eBPF runtime context to surface only reachable, executing vulnerabilities, letting teams focus on active risks instead of dormant CVEs.
Continuous Compliance Enforcement
Regulated organizations must repeatedly demonstrate compliance with standards such as PCI-DSS, SOC 2, and NSA-CISA. ARMO audits cluster configurations continuously and generates compliance reports with remediation steps.
Real-Time Runtime Threat Detection
Zero-day exploits and container breakouts require detection when perimeter defenses fail. ARMO’s CADR engine monitors kernel-level calls to spot unauthorized binary execution, unexpected shell spawns, and suspicious network traffic.
Shift-Left Security in DevOps
Insecure infrastructure-as-code manifests and vulnerable images can reach production pipelines undetected. ARMO integrates into CI/CD workflows, blocks non-compliant builds, and submits fixes as GitOps pull requests.
Protecting Air-Gapped Clusters
Defense, financial, and healthcare organizations often run air-gapped clusters that cannot send telemetry to external vendors. ARMO’s on-premise control plane performs posture checks and runtime protection entirely within the isolated network.
Strengths & Weaknesses
Strengths
Built on Kubescape, a CNCF incubating project with over 11,000 GitHub stars.
eBPF runtime reachability analysis can reduce actionable vulnerability lists by up to 95 percent.
Offers full native support for air-gapped and hybrid Kubernetes clusters without cloud data lock-in.
Integrates with GitOps workflows to automate configuration fixes through pull requests.
Maps posture checks directly to NSA-CISA, CIS Benchmarks, and MITRE ATT&CK out of the box.
Weaknesses
Focused strictly on Kubernetes and cloud-native workloads, with limited coverage for traditional VM infrastructure.
Advanced eBPF-based CADR features depend on modern Linux kernel versions, limiting support on legacy OS nodes.
Complete enterprise pricing schedules and volume node discounts are not published on the website.
Setting up custom policy definitions requires familiarity with Kubernetes CRDs and security concepts.
Who Is This For?
DevSecOps and platform engineers who want security checks built into existing CI/CD pipelines and GitOps workflows.
Cloud security engineers who need unified visibility into multi-cluster posture, eBPF runtime threats, and prioritized CVEs.
Compliance and CISO teams that need automated tracking and audit reports for NSA-CISA, CIS, and SOC 2.
Enterprise infrastructure architects who require on-premises or air-gapped deployment to maintain strict data privacy.
Frequently Asked Questions
What is the relationship between ARMO and Kubescape?
Kubescape is an open-source Kubernetes security project created by ARMO and donated to the CNCF, where it is now an incubating project. ARMO Platform is the commercial layer built on top, adding multi-cluster management, CADR, and dedicated support.
How does ARMO reduce vulnerability alert noise?
ARMO uses eBPF to observe which packages and binaries are actually loaded and executed during pod runtime. It filters non-reachable vulnerabilities out of the priority remediation queue.
Can ARMO run in air-gapped or on-premises environments?
Yes. ARMO offers on-premise installation so organizations can run the full security control plane and telemetry database inside isolated, air-gapped networks.
What is CADR and how does it work?
CADR (Cloud Application Detection and Response) is ARMO’s eBPF-powered runtime engine. It continuously monitors container execution, kernel calls, and network traffic to detect real-time attacks and anomalous behavior.
How is the ARMO Platform priced?
ARMO uses a node-based pricing model for managed worker nodes, with a free community tier and a SaaS free trial. Full enterprise pricing is negotiated directly and not published.
Does ARMO work with existing CI/CD pipelines?
Yes. ARMO scans Helm charts, YAML manifests, and container images within pipelines such as GitHub Actions, GitLab CI, Jenkins, CircleCI, and Azure DevOps.
What compliance frameworks does ARMO support?
ARMO includes pre-packaged controls for NSA-CISA guidance, CIS Kubernetes Benchmarks, MITRE ATT&CK, SOC 2, and PCI-DSS.
Is there a learning curve for setting up custom policies?
Configuring custom rules and policy tuning requires familiarity with Kubernetes CRDs and security concepts, so teams without that background may need ramp-up time.
Does ARMO support non-Kubernetes infrastructure?
No. ARMO is built specifically for Kubernetes and cloud-native workloads, with limited native coverage for traditional VM-based infrastructure.
Who typically deploys ARMO within an organization?
DevSecOps engineers, cloud security teams, and compliance officers are the primary users, often alongside infrastructure architects managing on-premises or air-gapped clusters.
ARMO integrates with Kubernetes platforms including Amazon EKS, Google GKE, Microsoft AKS, Red Hat OpenShift, SUSE Rancher, MicroK8s, and vanilla Kubernetes. CI/CD support covers GitHub Actions, GitLab CI, Jenkins, CircleCI, and Azure DevOps. GitOps fixes route through ArgoCD and Flux. Alerts and tickets connect to Slack, Microsoft Teams, Jira, and PagerDuty. Metrics export to Prometheus and Grafana, and image scanning covers Docker Hub, Quay, Amazon ECR, Google Artifact Registry, and Azure Container Registry.