Evaluate KubeScape as a NeuVector replacement

[noahpb]

https://kubescape.io/

Evaluate:

Community adoption
Chainguard/Ironbank support
Feature parity with NeuVector
Out of the box experience and alignment with deployment methodology (helm, config as code)
Definition of done: A scorecard evaluating the above criteria.

[noahpb]

Criteria	KubeScape	NeuVector
Pros	- Strong adoption, CNCF Sandbox, 10k stars, very active community	- Full end-to-end security, including runtime, network, and vulnerability protection
	- Uses existing open source tools	- Network segmentation with zero-trust enforcement
	- Modular stack - only desired components can be configured	- Enterprise-ready with compliance, vulnerability scanning, and firewall features
	- Has built in scans for various compliance frameworks	- Integrated enforcement, blocking malicious behavior in real-time
	- Has Kubernetes Objects/CRDs for all security reports/scans
	- Can automatically generate Kubernetes Network Policies by observing application behavior
Cons	- No user interface	- Heavier resource consumption due to the extensive feature set
	- No runtime prevention	- Complexity may overwhelm smaller deployments
	- Some overlap with existing functionality in UDS Core	- Full enterprise features require a commercial version
Community Adoption	10k stars, Slack channel, adopted by several major companies, community office hours, frequent webinars/talks	Enterprise focus, strong post-acquisition support by SUSE; less adoption in the general open-source community
Chainguard / IronBank Support	No Chainguard support	NeuVector is supported in IronBank (DoD-approved hardened container registry), suitable for government use
Runtime Detection	Monitors network, process, file and kernel behavior. Includes behavioral learning and anomoly detection	Behavioral learning with runtime detection for container processes, files, and network traffic
Network Security	Autogenerates least-permissive Network Policies based on application behavior, can detect anomolous network activity	Provides network-layer security, including segmentation, DPI (Deep Packet Inspection), and zero-trust policies
Compliance & Vulnerability Scanning	Supports scanning container images and Kubernetes objects against various frameworks	Built-in vulnerability scanning, compliance checks for PCI-DSS, GDPR, NIST, HIPAA
Enforcement	Detection and alerting only	Native enforcement engine to block network, process, and container-level threats in real-time
Out-of-the-Box Experience	Helm chart, cli tool for bootstrapping, default configurations available on GitHub	Comprehensive out-of-the-box security, with network policies, vulnerability scans, and compliance reports pre-configured
Helm / Config as Code Alignment	Official Helm chart available or install script	Helm chart available, configuration-as-code support with advanced controls; more complex due to the breadth of features
Ease of Use / Learning Curve	Rego based, so there is a steep learning curve but there are plenty of examples as rego is widely adopted	Steeper learning curve due to the full feature set (network, compliance, runtime) but offers behavioral learning to automate setup
Resource Consumption	Low profile, default to 500MB Memory and 500m CPU	Resource-intensive, especially with network security, DPI, and multi-layer enforcement
Integration with CI/CD	Is frequently used in CI/CD pipelines to scan for misconfigurations in helm charts or K8s YAML	Integrates well with CI/CD tools, can block non-compliant containers at runtime and during image scans
Policy Management	Deploys an admission controller, has a policy library. Rego based.	Automated policy learning with ability to create manual policies, suitable for both network and runtime security
Enterprise Support / Features	Open Source, more features available (like a UI) from Armo Sec	Full enterprise support, including multi-cloud deployments, built-in compliance management, and security dashboards
Service Mesh Compatibility	No native integration	Provides strong integration with service meshes, enforcing network security and segmentation policies within service mesh traffic
Logging and Reporting	Native Integration with Prometheus	Built-in real-time dashboards for network and runtime events; advanced reporting for compliance and threat detection
Cloud Provider Compatibility	Works across all CNCF K8s distributions	Optimized for multi-cloud (AWS, GCP, Azure) and hybrid environments; certified for key public cloud providers and supports multi-cluster setups