ARMO Survey Reveals Even Companies that Pay for Commercial Kubernetes Security Also Use Open Source Options

News provided by

Nov 17, 2022, 09:00 ET

A quarter of companies use 5+ open source security tools, but can be hampered by integration challenges

TEL AVIV, Israel, Nov. 17, 2022 /PRNewswire/ -- Open source tools are a key part of the Kubernetes security environment, with most companies using open source Kubernetes security software, research by ARMO has revealed. In a survey of The State of Kubernetes Open Source Security, 55% of respondents said they used at least some open source tools to keep their Kubernetes clusters safe; this includes those who use purely open source and those mix open source and proprietary solutions.

The research revealed it is very common to use more than one open source security offering. Almost a quarter of respondents use five or more different open source security tools for Kubernetes. Many open source tools only do one security-related task, forcing the use of multiple tools to get comprehensive coverage.

However, this mixed approach poses challenges, especially with integration. Users find open source security solutions are difficult to integrate with other DevOps tools (62%), to manage (51%) and to set up (45%). Digging deeper, 69% admit it's difficult or very difficult to integrate open source security tools into their existing Kubernetes stack. These challenges may be exacerbated by the fact that open source tools, by their nature, often have limited documentation, support and guidance.

This fractured security environment can lead to other problems. 68% of practitioners cited "too many alerts" as one of their biggest challenges with Kubernetes security, alongside overly fragmented solutions (62%), complexity (51%) and the lack of comprehensive solutions (47%). The other major problem raised was that security interferes with agility and time-to-market (54%).

However, proprietary solutions have challenges too. 69% of respondents mentioned that proprietary security tools are "black boxes", giving users little insight into how they work and how they are coded, and making them harder to modify to a company's unique needs. Other challenges related to cost, with 62% noting the complex pricing models of paid Kubernetes security solutions and 47% citing the sheer expense.

The survey revealed significant consensus around responsibility for Kubernetes security, with 58% saying it was a DevSecOps responsibility and 63% saying it should be — this does suggest some misalignment in practice. However, this raises the question of what DevSecOps is, precisely, and where it sits in an organization, whether as a subdiscipline of DevOps or a Dev and Ops focused role inside security.

ARMO, the enterprise company behind open source Kubernetes security platform Kubescape, commissioned this research to better understand how companies are using open source tools to secure their Kubernetes clusters and CI/CD pipelines.

"Open source tools are free, flexible and transparent, but they still tend to be narrow, doing only one thing very well," said Craig Box, VP Open Source at Armo. "This survey shows that even organizations who use expensive black-box proprietary solutions often choose to use some open source options too. Another approach some companies are taking is to cobble together full Kubernetes security coverage from multiple tools, but then they run into integration challenges and can find themselves buried in alerts."

The survey was conducted by Global Survey in July–August 2022. Respondents were 200 Kubernetes users in companies that ranged in size from >100 to 5,000+ employees. All were software developers or stakeholders from cybersecurity teams, DevOps and DevSecOps. 57% of respondents were from North America, 29% in Europe, and 14% in APAC.

The full report is available on ARMO's website.

About ARMO

ARMO, the creator of Kubescape, is on a mission to create the first Kubernetes end-to-end open-source security platform, built for devops, and trusted by security.

ARMO takes a broad and comprehensive approach to offering an open-source platform that assures DevOps, DevSecOps, and developers that every workload, cluster, container, and microservice is born and remains secure from development to production, and from configuration to run-time, every time.

Kubescape is a Kubernetes open-source platform providing a multi-cloud Kubernetes single pane of glass, including risk analysis, security compliance, misconfiguration scanning, RBAC visualizer and image vulnerabilities scanning.

Contact:
Lazer Cohen
[email protected]
+1 347-753-8256

SOURCE ARMO