ARMO
Runtime-based cloud and Kubernetes security from the team behind the open source Kubescape project
Quick Overview
| Company | Cyber Armor Ltd (ARMO) |
|---|---|
| Category | Cloud Security Platforms (CNAPP) |
| Headquarters | Israel, Israel |
| Founded | Not stated |
| EU Presence | Yes - Israel |
| Data Location | SaaS, or on-premises for Kubernetes |
| Open Source | Kubescape core (open source) |
| GDPR Compliant | Yes |
| Self-Hosting | On-premises Kubernetes security offered |
| Main Features | Cloud application detection and response, Kubernetes posture management, cloud posture management, runtime vulnerability prioritisation, eBPF sensor, agentless cloud scanning, compliance frameworks |
| Pricing | Quote based on vCPUs and cloud resources |
| Best For | Kubernetes-heavy teams that want runtime context behind every finding |
| Replaces | Wiz, Prisma Cloud, Sysdig |
Detailed Review
ARMO sells the commercial platform around Kubescape, which its site describes as a CNCF incubating project with more than 11,000 GitHub stars. Teams that already run the free scanner get a route to a managed console, runtime detection and prioritisation.
The company behind the website is Cyber Armor Ltd, trading as ARMO, registered in Israel according to its privacy policy.
Runtime reachability instead of CVE lists
The vulnerability view ranks findings by whether the vulnerable code is loaded and reachable at runtime. ARMO states this cuts CVE-related work by over 90 percent, a vendor figure we have not tested.
For a cluster with thousands of image findings, that ordering is the main reason to evaluate the platform over a posture-only scanner.
Detection from an eBPF sensor
An eBPF sensor learns normal behaviour per workload and flags anomalies, with automatic responses such as quarantine. The product page calls this cloud application detection and response.
Because the sensor sits on the node, it needs deployment into each cluster, unlike a pure API-based scan.
Cloud posture and on-premises clusters
Agentless scanning with runtime insight covers cloud accounts, and the site also lists a mode for on-premises Kubernetes aimed at sovereign infrastructure with full data control.
Compliance mapping covers NIST, NSA-CISA and MITRE frameworks plus ARMO's own baseline.
Limitations to Consider
Pricing is only by quote, tied to vCPUs and cloud resources, so cost is hard to estimate in advance. The strongest features assume Kubernetes; teams on virtual machines or serverless only will find less. The ARMO platform is a smaller vendor than the large CNAPP suites, so integrations and partner services are fewer. The 90 percent noise figure is a vendor claim.
Who Should Use ARMO
Platform and security teams running Kubernetes who want to start free with Kubescape and move to a managed runtime platform later.
Pros and Cons
Pros
- Open source Kubescape core with a CNCF incubating project
- Reachability-based CVE ranking
- eBPF runtime detection with response
- On-premises option for sovereign setups
- Free start path through Kubescape
Cons
- Quote-only pricing
- Kubernetes-centred
- Sensor deployment needed
- Smaller ecosystem than the large suites
Alternatives to ARMO
Other European cloud security platforms (cnapp) worth comparing before you decide:
Aikido Security
Belgium · Ghent platform that joins code, container and cloud posture checks
Sweet Security
Israel · Runtime-first CNAPP that reasons from live workload behaviour
Orca Security
Israel · Agentless SideScanning CNAPP from Tel Aviv across six clouds
Aqua Security
Israel · Agent-based runtime enforcement for containers, serverless and VMs
See all European cloud security platforms (cnapp) or compare them directly against Wiz on our alternatives page.
Frequently Asked Questions
Kubescape is the open source Kubernetes security project and ARMO is the commercial platform built around it. The ARMO site offers a comparison between the two.
No. The pricing page asks for a meeting and says the model depends on factors such as the number of vCPUs and other cloud resources.
The site lists an on-premises mode for Kubernetes aimed at sovereign cloud infrastructure with full data control.