The typical first audit surfaces 12–25 critical misconfigurations and 20–40% over-provisioned compute
Kubernetes Audit
Free Kubernetes Audit - Security, Reliability & Cost (CIS Benchmark, NSA/CISA Hardening Guide)
A senior platform engineer reviews your entire cluster estate — control plane, workloads, networking, runtime security and cost — then hands you a prioritized, ticket-ready fix list. Free.
- Know your real security exposure — mapped to CIS Benchmark and the NSA/CISA hardening guide, triaged by blast radius, not raw CVSS noise.
- Stop paying for compute you don’t use — quantified $/month savings from over-provisioned workloads and orphaned resources.
- Get a plan, not a wall of alerts — a 0–100 audit score and a 30/60/90-day remediation roadmap, verified by a human.
- Read-only access only
- No workload changes
- Senior platform-engineer verified
- Live findings walkthrough included
Supported Platforms
From kubeconfig to fix list — in four steps
Grant read-only access
A kubeconfig or least-privileged ServiceAccount with get/list/watch only. Step-by-step guides for every provider.
We scan cluster & workloads
kube-bench, kube-hunter, Trivy, Polaris, Goldilocks and more analyze config and metrics — at a controlled rate, zero risk to delivery.
A senior engineer verifies
False positives removed, findings triaged by real blast radius, recommendations tailored to your stack.
Report + live debrief
Delivered in 1–2 business days, with a 45-minute walkthrough of your score, risks and roadmap.
What We Audit Across Your Kubernetes Estate
Six areas covering every layer from control plane to workload - benchmarked against the CIS Kubernetes Benchmark, NSA/CISA Hardening Guide, and Pod Security Admission.
Security Posture & Hardening
RBAC and ServiceAccount audit, Pod Security Admission (privileged / baseline / restricted), pod security contexts, NetworkPolicy and Cilium / Calico coverage, admission control (Kyverno, OPA/Gatekeeper), image signing (cosign / Sigstore), runtime security (Falco), and secrets management (External Secrets, SealedSecrets) - benchmarked against CIS, NSA/CISA, and PSA.
CIS Benchmark & Misconfiguration Scan
Automated scans with kube-bench (CIS), kube-hunter (pen test), Trivy (CVEs and misconfigurations), Polaris and KubeLinter (workload best practices), and Pluto (deprecated APIs) - every finding triaged for blast radius and exploitability, not raw CVSS.
Performance & Capacity
Resource request and limit tuning (Goldilocks / VPA), CPU CFS throttling detection, HPA / VPA / KEDA effectiveness, node-pool sizing, image-pull latency, control-plane health, and capacity planning - so workloads run reliably without paying for headroom you don't need.
Cost Optimisation
Identifies over-provisioned workloads, idle namespaces, orphaned PVs and LoadBalancers, and node-pool inefficiencies - using Kubecost / OpenCost data where available, with Karpenter, Cluster Autoscaler, Spot / Preemptible, and KEDA recommendations and quantified $/month savings.
Reliability & Resilience
Pod Disruption Budgets, topology spread constraints, pod anti-affinity, multi-AZ posture, liveness / readiness / startup probes, restart and OOMKill patterns, GitOps drift (ArgoCD / Flux), and disaster-recovery (Velero, etcd backups) - surfacing the gaps that turn a small incident into an outage.
Audit Score & Remediation Roadmap
A Kubernetes Audit Score (0-100) across Security, Reliability, and Cost with per-area Crawl / Walk / Run maturity, a prioritised remediation backlog, and a 30 / 60 / 90-day roadmap your platform team can ticket and ship.
Raw tools give you alerts. This gives you a plan.
| Running the tools yourself | OpsHero Kubernetes Audit | |
|---|---|---|
| Findings triaged by real blast radius | raw CVSS noise | |
| False positives removed by a human | senior engineer | |
| Security + reliability + cost in one pass | separate tools | |
| Prioritised, ticket-ready roadmap | 30/60/90-day | |
| Quantified $/month savings | ||
| Live walkthrough with an engineer | 45 min | |
| Your time spent | days of setup & reading | one read-only grant |
What You Get
Your report will include the following deliverables.
Find the gaps before they become a 3 a.m. page.
Get a senior-engineer-verified Kubernetes audit covering security hardening, reliability, and cost - with a Kubernetes Audit Score, prioritised remediation backlog, and live debrief, completely free.
Get My Kubernetes Audit ReportHow We Handle Your Cluster Data
A cluster audit should never become a cluster incident. Here is exactly what we read - and what never leaves your environment.
Read-Only kubeconfig or ServiceAccount
We use a read-only kubeconfig or a least-privileged ServiceAccount with cluster-wide get / list / watch verbs only - scoped to the audit window and time-limited. We can never apply manifests, exec into pods, port-forward, modify RBAC, or restart workloads.
No Workload Data or Secrets Read
We never read the contents of Secrets, ConfigMaps used as secrets, or PersistentVolume data. The audit reads cluster, workload, and policy specs plus aggregated metrics only - never the application data, environment variables, or live traffic of your workloads.
Auto-Revoked & Destroyed After Audit
As soon as your report is delivered, the ServiceAccount or kubeconfig is revoked, the analysis sandbox is destroyed, and your manifest exports are deleted. Only aggregate, anonymised findings are retained for QA - never namespace, workload, or RBAC details.
Frequently Asked Questions
The most common questions we hear from teams running this assessment.
What access do you actually need? Does any workload data or secret leave our environment?
A read-only kubeconfig or a ServiceAccount with cluster-wide get / list / watch verbs only, scoped to the audit window. We never apply, exec, port-forward, or modify anything. We do not read Secret data, the contents of ConfigMaps used as secrets, or PersistentVolume contents - only cluster, workload, and policy specs plus aggregated utilisation metrics. Step-by-step setup guides are included for EKS, GKE, AKS, OpenShift, Rancher, and self-managed clusters.
Which Kubernetes distributions and managed services do you support?
All major distributions: Amazon EKS, Google GKE (including Autopilot), Azure AKS, Red Hat OpenShift / OKD, Rancher / RKE / RKE2 / K3s, and self-managed Kubernetes (kubeadm, kops). The audit also covers common platform add-ons - Istio and Linkerd (service mesh), Cilium and Calico (CNI / network policy), ArgoCD and Flux (GitOps), Karpenter and Cluster Autoscaler (scaling), Kyverno and OPA/Gatekeeper (admission), Falco (runtime), and Kubecost / OpenCost (cost).
Do you align with the CIS Kubernetes Benchmark and NSA/CISA Hardening Guide?
Yes. Findings are mapped to specific controls in the CIS Kubernetes Benchmark, the NSA/CISA Kubernetes Hardening Guide, and the Pod Security Admission restricted profile, plus the relevant SDLC controls in SOC 2 CC8.1, ISO 27001, PCI-DSS 6, and HIPAA technical safeguards. The output is designed to drop directly into auditor evidence packs.
How is this different from running kube-bench or Trivy in CI?
Those tools produce raw findings; this audit interprets them. A senior Kubernetes engineer triages every finding for actual blast radius and exploitability against your context, removes false positives (e.g. permissive workloads with compensating controls), and combines results across kube-bench, kube-hunter, Trivy, Polaris, Pluto, KubeLinter, and Goldilocks with a manual review of admission control, networking, GitOps, and cost posture - into a prioritised, ticket-ready remediation plan rather than a 4,000-line report.
Can the audit cover cost optimisation as well as security?
Yes - most teams see 20-40% over-provisioned compute on first audit. We use Kubecost / OpenCost data where you have it, profile request-vs-usage with Goldilocks / VPA, and recommend Karpenter, Cluster Autoscaler, Spot / Preemptible, and KEDA changes with quantified $/month savings. You can also choose a cost-first focus during scoping if cost is the primary driver.
Will the audit affect performance or workload availability?
No. The audit is fully read-only and works against the API server's get / list / watch verbs at a controlled rate. Nothing we do can drain a node, evict a pod, modify RBAC, or trigger autoscaling. You can run the audit during normal business hours with zero risk to delivery.
How do you handle multi-cluster fleets?
We can audit a single cluster, a representative sample, or a full fleet. For fleet-wide audits we deduplicate findings (e.g. a misconfiguration shared across 30 clusters becomes one finding with affected-cluster list), surface drift between clusters that should be identical (production / staging parity), and prioritise based on environment criticality and exposure.
How long until we receive the report?
Typical turnaround is 1-2 business days from the moment read-only access is granted, plus a 45-minute live findings walkthrough at a time that suits your team. Larger fleets with dozens of clusters can take a little longer; we confirm the timeline as soon as we see the scope.
Get your free Kubernetes Audit report
In 1–2 business days, with a 45-minute live walkthrough. No credit card.
- Read-only, NDA-backed access. We sign an NDA before anything runs — nothing in your environment changes.
- Verified by a senior engineer. You get answers and a prioritised fix list, not a raw-scanner dump.
- Zero data retention. The isolated sandbox is permanently deleted once your report is generated.
“We've relied on OpsHero across several key projects for well-known financial institutions. They're proactive, fast on complex problems, and deep across cloud, Kubernetes, and DevOps. We count on them to get the job done.”
Todor TashevCommercial Director · Paraflow CommunicationsYou Might Also Be Interested In
Pipeline Inspector
Find every weak link in your CI/CD - automated scanning across GitHub Actions, GitLab, Jenkins, Bitbucket, and Azure DevOps, verified by a senior platform engineer.
FinOps Review
Cut cloud waste and build a real FinOps practice - automated AWS, Azure, and GCP cost analysis verified by a senior FinOps engineer, with quantified monthly savings and a 30/60/90 day roadmap.
LLM Token Optimizer
Find where LLM and AI agent costs can be cut - often 30-70% in prior assessments, with no measurable quality drop - token-usage analysis across Anthropic, OpenAI, Gemini, AWS Bedrock, and Vertex AI, verified by a senior AI engineer with eval-backed recommendations.