Parameter Platform

A red team that never stops.

/ pentesting

Real vulnerabilities, found and proven.

/ Cloud security

Cloud misconfigs, caught continuously.

/ Supply chain

Only the reachable dependency risks.

/ sentinel

Vulnerabilities caught before they merge.

[ By industry ]All →

/ Fintech

Payment flows and partner APIs, with PCI DSS and SOC 2 evidence.

/ Healthcare

The systems behind patient data, with HIPAA and SOC 2 evidence.

[ By framework ]All →

/ SOC 2

Pentest evidence your auditor asks for.

/ ISO 27001

Testing evidence for the controls.

/ PCI DSS

Requirement 11.4, between annual tests.

/ FedRAMP

Continuous monitoring, alongside your 3PAO.

/ Blog

Research, writeups, and product news.

/ Videos

Short explainers on security fundamentals.

/ Solution Briefs

One-PDF overviews of each product.

/ Knowledge Center

Security concepts, from SIEM to SOC 2.

/ Security

How we secure the agents and your data.

/ About

The team behind Parameter.

/ Careers

Open roles. Come build with us.

/ Compare

Parameter next to the tools you're weighing.

Blog

Book a call

What is KSPM?

Kubernetes and container security

What Kubernetes security posture management covers, from cluster configuration and RBAC to image vulnerabilities, and how it fits between CSPM and CNAPP.

01Introduction

Kubernetes adds a second control plane on top of the cloud one, with its own identities, network rules and secrets. A cluster can pass every cloud posture check and still let any pod read every secret in the namespace.

02What is KSPM?

Kubernetes security posture management (KSPM) is the continuous assessment of Kubernetes clusters and the containers running in them: cluster and node configuration, role-based access control, network policies, admission controls and the vulnerabilities in container images.

It sits between CSPM, which covers the cloud account, and CWPP, which protects workloads at runtime. Together they form the core of a CNAPP.

03How KSPM works

Container security spans the image, the cluster and the cloud underneath.

1.
Scan images
Check base images and packages for known CVEs and embedded secrets before they reach a registry, drawing on software supply chain security.
2.
Assess clusters
Benchmark control plane, node and workload settings against the CIS Kubernetes Benchmark and Pod Security Standards.
3.
Review RBAC
Map which service accounts and users can read secrets, create pods or escalate to cluster-admin.
4.
Link to the cloud
Trace how workload identities map to cloud IAM roles, where a pod escape becomes an account compromise.

04Threats and risks

Cluster defaults favor getting started over staying safe.

Privileged pods
Containers running as root, with host mounts or host networking, one step from the node.
Over-broad RBAC
Service accounts bound to cluster-admin or allowed to list secrets across namespaces.
Flat networks
No network policies, so any compromised pod can reach every other service.
Vulnerable images
Outdated base images carrying exploitable packages into production.

05How Parameter helps

Parameter Cloud Security covers Kubernetes and containers as part of the same attack graph as the cloud account.

Cluster to cloud paths
Agents follow a path from an exposed service through pod identity to the cloud role and the data it reaches.
Image dependencies
Supply Chain analysis flags the packages in your images that are actually reachable.
Fixes as code
Changes land as pull requests against your Terraform and manifests.