How to install ThreatMapper on Kubernetes?

First deploy the Management Console on a Docker host or Kubernetes cluster, then install sensor agents as a daemonset using the provided Helm chart, following the detailed Kubernetes sensor documentation for configuration and API key setup.

ThreatMapper vs. Falco: which is better for runtime security?

ThreatMapper focuses on vulnerability scanning, attack path visualization, and compliance benchmarking for cloud-native apps, while Falco is specialized for real-time behavioral monitoring and intrusion detection. ThreatMapper is better for comprehensive risk assessment, Falco for immediate threat alerts.

Does ThreatMapper support Azure Kubernetes Service (AKS)?

Yes, ThreatMapper supports AKS through its Kubernetes sensor agents deployed via Helm, and it can scan Azure cloud configurations using the agent-less Cloud Scanner tasks with Terraform modules for compliance checks.

How does ThreatMapper handle zero-day vulnerabilities?

It relies on vulnerability databases and continuous monitoring to detect known threats; for zero-days, it may not provide immediate detection but can highlight attack paths and misconfigurations that reduce exploit risk, with updates via the Management Console.

Can I use ThreatMapper for on-premises virtual machines?

Yes, ThreatMapper supports bare-metal or VMs by deploying sensor agents within a lightweight Docker runtime, as specified in the Linux host documentation, enabling security monitoring even without cloud dependencies.

Is ThreatMapper free for commercial use?

The open-source version is free under Apache 2.0 license for self-hosting, but enterprise features like advanced analytics and support are available in ThreatStryker, Deepfence's commercial offering, which may involve costs.

ThreatMapper — Open Source Cloud Native CNAPP

What is ThreatMapper?

ThreatMapper is an open-source Cloud Native Application Protection Platform (CNAPP) that hunts for security threats in production cloud-native environments. It identifies vulnerabilities, exposed secrets, and misconfigurations, then ranks them by risk and visualizes potential attack paths through its ThreatGraph feature. The platform helps security and DevOps teams maintain continuous security observability across their running applications and infrastructure.

Target Audience

Security engineers, DevOps teams, and platform engineers responsible for securing cloud-native applications and infrastructure across Kubernetes, Docker, cloud, and on-premises environments.

Value Proposition

Developers choose ThreatMapper because it provides a comprehensive, open-source CNAPP solution that combines agent-based and agent-less monitoring for wide coverage. Its unique ThreatGraph visualization helps prioritize high-risk threats, and its support for multiple platforms makes it adaptable to diverse cloud-native deployments without vendor lock-in.

Open Source Cloud Native Application Protection Platform (CNAPP)

Use Cases

Best For

Continuous security monitoring of production Kubernetes clusters
Identifying and prioritizing software vulnerabilities in running containerized applications
Visualizing attack paths and security risks in cloud-native environments
Checking cloud infrastructure compliance against security benchmarks (e.g., CIS)
Extending shift-left security practices into runtime protection
Securing hybrid deployments across cloud, on-premises, and serverless platforms

Not Ideal For

Teams exclusively focused on pre-deployment security (e.g., SAST/DAST) without runtime monitoring needs
Organizations with legacy on-premises systems not using containers or cloud-native technologies
Environments where deploying privileged agents is prohibited due to security or compliance policies
Projects requiring real-time behavioral threat detection or deep packet inspection, as it primarily scans for known vulnerabilities and misconfigurations

Pros & Cons

Pros

Hybrid Monitoring Coverage

Combines agent-based inspection for detailed host data (e.g., via Docker or Kubernetes sensors) with agent-less cloud scanning (using Terraform modules), ensuring wide threat detection across cloud and on-premises environments.

Multi-Platform Adaptability

Supports Kubernetes, Docker, AWS Fargate, ECS, bare-metal, and major cloud providers (AWS, Azure, GCP), making it versatile for diverse cloud-native deployments without vendor lock-in.

Risk-Based Threat Prioritization

Uses ThreatGraph visualization to map attack paths and rank threats by exploit risk, helping teams focus remediation on the most critical vulnerabilities and misconfigurations first.

Compliance Benchmark Integration

Checks host and cloud configurations against industry-expert benchmarks like CIS, aiding in regulatory compliance and security hardening directly from the Management Console.

Cons

Complex Multi-Component Deployment

Requires setting up the Management Console, Cloud Scanner tasks (via Terraform), and Sensor Agents across different platforms, which can be time-consuming and prone to configuration errors, as noted in the separate installation steps.

Agent Resource Overhead

Sensor agents run with privileged access (e.g., Docker command includes CPU limits and host mounts), potentially impacting performance in resource-constrained environments and raising operational concerns.

Limited to Supported Runtimes

While it covers many platforms, it may not support niche or custom container runtimes, and the agent-based approach requires compatibility with specific environments like Docker or Kubernetes, limiting flexibility.

Frequently Asked Questions

What is ThreatMapper?

Target Audience

Security engineers, DevOps teams, and platform engineers responsible for securing cloud-native applications and infrastructure across Kubernetes, Docker, cloud, and on-premises environments.

Value Proposition

Use Cases

Best For

Continuous security monitoring of production Kubernetes clusters
Identifying and prioritizing software vulnerabilities in running containerized applications
Visualizing attack paths and security risks in cloud-native environments
Checking cloud infrastructure compliance against security benchmarks (e.g., CIS)
Extending shift-left security practices into runtime protection
Securing hybrid deployments across cloud, on-premises, and serverless platforms

Not Ideal For

Teams exclusively focused on pre-deployment security (e.g., SAST/DAST) without runtime monitoring needs
Organizations with legacy on-premises systems not using containers or cloud-native technologies
Environments where deploying privileged agents is prohibited due to security or compliance policies
Projects requiring real-time behavioral threat detection or deep packet inspection, as it primarily scans for known vulnerabilities and misconfigurations

Pros & Cons

Pros

Hybrid Monitoring Coverage

Multi-Platform Adaptability

Supports Kubernetes, Docker, AWS Fargate, ECS, bare-metal, and major cloud providers (AWS, Azure, GCP), making it versatile for diverse cloud-native deployments without vendor lock-in.

Risk-Based Threat Prioritization

Uses ThreatGraph visualization to map attack paths and rank threats by exploit risk, helping teams focus remediation on the most critical vulnerabilities and misconfigurations first.

Compliance Benchmark Integration

Checks host and cloud configurations against industry-expert benchmarks like CIS, aiding in regulatory compliance and security hardening directly from the Management Console.

Cons

Complex Multi-Component Deployment

Agent Resource Overhead

Limited to Supported Runtimes

Frequently Asked Questions

ThreatMapper

What is ThreatMapper?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?

ThreatMapper

What is ThreatMapper?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?