Can CISGuard scan Kubernetes?

More context

Kubernetes is harder to harden than a single host because its security is distributed across several layers that fail independently. The control plane components decide who can do what to the cluster, namespace-level policy governs isolation between tenants and workloads, and each pod carries its own security context and capabilities. A misconfiguration at any one of these levels can undermine the others, which is why the benchmark spans all of them rather than checking a single config file.

For a compliance program the important point is that container platforms should not be a blind spot assessed by a separate niche tool. Bringing clusters into the same benchmark scanning and reporting as servers and cloud accounts means a team sees one consistent posture across its estate, and evidence for Kubernetes lands in the same framework reports as everything else instead of living in an isolated cloud-native corner.