Open source CNAPP that hunts for threats in cloud native platforms, ranks them by risk, and visualizes attack paths.
ThreatMapper is an open-source Cloud Native Application Protection Platform (CNAPP) that hunts for security threats in production cloud-native environments. It identifies vulnerabilities, exposed secrets, and misconfigurations, then ranks them by risk and visualizes potential attack paths through its ThreatGraph feature. The platform helps security and DevOps teams maintain continuous security observability across their running applications and infrastructure.
Security engineers, DevOps teams, and platform engineers responsible for securing cloud-native applications and infrastructure across Kubernetes, Docker, cloud, and on-premises environments.
Developers choose ThreatMapper because it provides a comprehensive, open-source CNAPP solution that combines agent-based and agent-less monitoring for wide coverage. Its unique ThreatGraph visualization helps prioritize high-risk threats, and its support for multiple platforms makes it adaptable to diverse cloud-native deployments without vendor lock-in.
Open Source Cloud Native Application Protection Platform (CNAPP)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Combines agent-based inspection for detailed host data (e.g., via Docker or Kubernetes sensors) with agent-less cloud scanning (using Terraform modules), ensuring wide threat detection across cloud and on-premises environments.
Supports Kubernetes, Docker, AWS Fargate, ECS, bare-metal, and major cloud providers (AWS, Azure, GCP), making it versatile for diverse cloud-native deployments without vendor lock-in.
Uses ThreatGraph visualization to map attack paths and rank threats by exploit risk, helping teams focus remediation on the most critical vulnerabilities and misconfigurations first.
Checks host and cloud configurations against industry-expert benchmarks like CIS, aiding in regulatory compliance and security hardening directly from the Management Console.
Requires setting up the Management Console, Cloud Scanner tasks (via Terraform), and Sensor Agents across different platforms, which can be time-consuming and prone to configuration errors, as noted in the separate installation steps.
Sensor agents run with privileged access (e.g., Docker command includes CPU limits and host mounts), potentially impacting performance in resource-constrained environments and raising operational concerns.
While it covers many platforms, it may not support niche or custom container runtimes, and the agent-based approach requires compatibility with specific environments like Docker or Kubernetes, limiting flexibility.