Container and Kubernetes
Security Testing from
Image to Runtime
Container and Kubernetes security
Attacker-Led Testing of the Container Platforms Your Applications Run On
iSpyCyber reviews and attacks your container images, registries, clusters and pipelines the way a real adversary would. We combine CIS Kubernetes Benchmark review with hands-on testing of RBAC, network policies, workload isolation and supply chain controls across self-managed clusters and EKS, AKS and GKE.
Why organisations choose iSpyCyber
Container escape focus
We test whether a single compromised pod could break out, move laterally or take over the cluster and its cloud account.
Managed and self-hosted
Consistent methodology for EKS, AKS, GKE, OpenShift and self-managed Kubernetes clusters.
Near-zero noise
Image and configuration scanner output is triaged by hand, so your team only receives real, exploitable issues.
Manifest-level fixes
Remediation written for Helm charts, manifests, admission policies and pipeline configuration.
Safe for production
Agreed rules of engagement and namespace boundaries protect running workloads.
Continuous validation
Retesting confirms every fix, and iefyx, our AI-native VAPT and CTEM platform, keeps exposure visible between engagements.
Coverage
What We Test Across Your Container Platform
Our testers cover the full container lifecycle, from build pipeline to running cluster, and chain weaknesses the way real attackers do.
Container images
Base images, vulnerable packages, embedded secrets, running as root and unnecessary tooling.
Registries
Access control, image signing, vulnerability scanning and exposure of private registries.
CIS Kubernetes Benchmark
Control plane, etcd, kubelet and node configuration reviewed against the CIS Kubernetes Benchmark.
RBAC and service accounts
Over-privileged roles, cluster-admin bindings, service account token exposure and privilege escalation.
Network policies
Pod-to-pod isolation, namespace segmentation, egress controls and service mesh configuration.
Workload isolation
Privileged pods, host mounts, capabilities, Pod Security Standards and container escape paths.
Runtime security
Runtime detection coverage, audit logging and whether our activity was noticed by your tooling.
EKS, AKS and GKE
Cloud IAM integration, workload identity, node roles and managed control plane settings.
Supply chain and CI/CD
Build pipelines, admission controllers, image provenance, SBOMs and deployment secrets.
Methodology
A Proven Six-Phase Testing Methodology
Aligned to the CIS Kubernetes Benchmark, NSA and CISA Kubernetes Hardening Guidance, the OWASP Kubernetes Top 10 and NIST SP 800-190.
- CIS Kubernetes Benchmark
- NIST SP 800-190
- OWASP Kubernetes Top 10
- MITRE ATT&CK Containers
- CVSS 3.1
1–3
weeks for a typical engagement
6
standards-aligned phases
100%
findings manually validated
01
- Days 1–2
Scope and plan
Clusters, namespaces, registries, pipelines and rules of engagement agreed up front.
Key activities
- Confirm clusters, namespaces and registries
- Agree rules of engagement and test windows
- Provision access and escalation contacts
- Output: Signed rules of engagement
02
- Days 2–3
Enumerate and map
Inventory of workloads, identities, network paths and trust relationships across the platform.
Key activities
- Enumerate workloads, services and ingress
- Map RBAC, service accounts and cloud identities
- Identify sensitive workloads and secrets
- Output: Cluster attack surface map
03
- Days 3–6
Configuration review
Cluster, node and image configuration assessed against CIS Kubernetes Benchmark and hardening guidance.
Key activities
- Review against CIS Kubernetes Benchmark
- Assess images, registries and pipelines
- Review network policies and pod security
- Output: Configuration gap list
04
- Days 5–9
Attack and escalate
Compromise scenarios tested from a pod, a pipeline and a stolen credential, with impact safely proven.
Key activities
- Attempt container escape and node access
- Abuse RBAC and tokens to escalate privileges
- Rate every finding with CVSS and business context
- Output: Validated attack paths and findings
05
- Days 9–12
Report and debrief
Executive summary, technical findings and a live walkthrough with your platform, DevOps and leadership teams.
Key activities
- Executive summary for leadership
- Technical write-ups with manifest-level fixes
- Live walkthrough and Q&A with your teams
- Output: Final report and debrief
06
- After remediation
Fix and retest
Remediation support and retesting to confirm every issue is closed.
Key activities
- Engineer Q&A while fixes are deployed
- Retest every remediated finding
- Updated report confirming closure
- Output: Retest report
Effort distribution
Where the assessment time goes
Most of every engagement is spent on hands-on configuration analysis and attack testing by skilled container specialists, not on running scanners. Percentages are indicative for a typical assessment.
Quality built into every phase
Every finding reproduced
Nothing is reported until a tester has reproduced it by hand.
Risk rated in context
Severity reflects your workloads, data and exposure.
Agreed rules of engagement
Namespace boundaries protect running services.
Closure confirmed
Retesting proves each fix actually works.
Engagement models
Choose the Testing Approach That Fits Your Risk
Every approach uses the same methodology. The difference is where our testers start and how deep they can go.
External exposure test
No credentials, simulating an attacker probing exposed API servers, dashboards, ingress and registries. Best for validating what is reachable from outside.
Compromised pod
A foothold inside a single workload as the starting point, testing escape, lateral movement and privilege escalation. Best for measuring blast radius.
Full platform review
Read access to clusters, manifests, registries and pipelines for complete benchmark and supply chain coverage. Best for new platforms, audits and major upgrades.
Not sure which approach you need?
Our specialists will recommend a scope based on your clusters, pipelines and compliance obligations.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Clear business context for decision-makers, precise technical detail for platform engineers and evidence your auditors can rely on.
Executive summary
Overall platform risk posture, key themes and business impact in plain language for leadership and boards.
Technical findings
Every issue with CVSS rating, affected resources, reproduction steps and supporting evidence.
Remediation roadmap
Prioritised fixes with manifest, Helm and policy examples, highest-impact issues first.
Retest report
Independent confirmation of which findings are closed, ready to share with customers and auditors.
Supports your compliance and assurance requirements
- CIS Kubernetes Benchmark
- NIST SP 800-190
- ISO/IEC 27001
- SOC 2
- PCI DSS
- DPDP Act 2023
- CERT-In guidelines
- RBI guidelines
- HIPAA
- GDPR
iSpyCyber provides independent security testing that supports these requirements. Certification and attestation are issued by accredited bodies and licensed auditors.
Container security for every industry
FAQ
Container and Kubernetes security questions, answered
Can’t find what you need? Talk to our security team.
The basics
What is a Kubernetes security assessment?
It is a structured review, led by skilled testers, of your container images, registries, clusters and pipelines. It combines configuration review against the CIS Kubernetes Benchmark with hands-on testing of RBAC, network policies and workload isolation, then explains the business impact and how to fix each issue.
Do you test managed services such as EKS, AKS and GKE?
Yes. We test the parts of managed Kubernetes that you control, including RBAC, workloads, network policies, node configuration and cloud identity integration, within each provider’s testing policies.
How is this different from an image scanner?
Image scanners report known vulnerable packages. Our testers validate which issues are reachable and chain RBAC, configuration and isolation weaknesses into real attack paths that scanners cannot see.
Do you review our CI/CD pipeline too?
Yes. Supply chain review covers build pipelines, registries, image signing, admission controls and how secrets reach your workloads.
Working with us
Will testing disrupt our workloads?
We agree rules of engagement, namespaces and test windows in advance, avoid denial-of-service techniques and can test in a staging cluster that mirrors production.
Do you retest after we fix the issues?
Yes. We retest remediated findings and issue an updated report confirming which issues are closed.
How often should we assess our clusters?
At least annually and after major upgrades, new clusters or significant platform changes. Many clients pair periodic tests with continuous validation through iefyx.
Get started
Ship Secure Containers.
Without Slowing Deployments.
Talk to our container security specialists about a scoped Kubernetes security assessment for your platform.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries