cenroq · Product

Capabilities

everything you need to secure and prove.

Every capability runs in a single Kubernetes-native platform: fully on-premises, with no SaaS backend and nothing leaving your environment.

Capability 01 / 06

Runtime Security

Real-time detection of threats inside running containers and pods, mapped to MITRE ATT&CK for Containers.

Behavioral detection inside running pods
Mapped to MITRE ATT&CK for Containers
Alerts the moment behavior deviates

Capability 02 / 06

Contextual Vulnerability Management

CVE triage with deployment context: prioritize what is actually reachable and exploitable, not raw scanner noise.

Reachability-aware CVE prioritization
Cuts scanner noise to what matters
Linked to the workloads actually affected

Capability 03 / 06

Attack Path Discovery

Map lateral-movement paths and blast radius across the cluster graph, before an attacker does.

Visualizes lateral-movement paths
Shows blast radius across the cluster
Highlights the riskiest route to your secrets

Capability 04 / 06

Admission Control

Enforce policy at deploy time: block non-compliant or risky workloads before they ever reach the cluster.

Policy enforced at deploy time
Blocks risky workloads pre-cluster
Guardrails without slowing delivery

Capability 05 / 06

AI-assisted Security

AI-generated VEX statements, dynamic recommendations and automated triage that cut analyst workload.

AI-generated VEX statements
Automated triage of findings
Recommended fixes, in context

Capability 06 / 06

Compliance Audits

Automated checks against FINMA, DORA, NIS-2, IKT-Minimalstandard, BSI C5, CIS Benchmark and NIST SP 800-190.

Mapped to the frameworks you answer to
Always audit-ready evidence
Export reports on demand

How it works · Continuous monitoring

deploy. monitor. prove.

This is how the continuous version runs: once deployed, cenroq stays always-on inside your cluster.

Deploy in your cluster

Install via Helm into any Kubernetes environment: cloud, on-prem or air-gapped. No external connectivity required.

Monitor continuously

cenroq watches runtime behavior, scans workloads and discovers attack paths. All processing stays inside your boundary.

Prove compliance

Export audit-ready evidence against your frameworks on demand, turning supervisory reviews into a report, not a project.

Ways to engage

one-time assessment or continuous monitoring.

Start with a point-in-time snapshot, or run cenroq as always-on assurance. Same platform, two commitments.

One-Time Assessment

Security Snapshot

Fixed-scope engagement

Continuous Monitoring

Always-On Assurance

Ongoing subscription

Deployment

Client-side binary, run on demand

Deployed into your Kubernetes cluster

Cadence

Point-in-time audit

Real-time, continuous

Cluster scan & posture analysis

Compliance gap analysis

Runtime threat detection

—

Automated re-checks on change

—

AI-assisted VEX & triage

—

Output

Findings report + remediation roadmap

Live dashboard + board-ready reporting

Best for

Audit prep · M&A due diligence

Regulated enterprises · critical infrastructure

Open Source

start with our open-source toolkit.

New to cenroq? Start with kubeapt and our open policy bundles: free, self-hosted, Apache-2.0. Step up to continuous monitoring and compliance when you are ready.

kubeapt on GitHub Explore open source →

$ kubeapt scan

→ auditing admission posture...

✓ Pod Security Admission · 9/12 enforced

✓ evaluated locally · 0 bytes egressed

sovereign kubernetes security and compliance that stays inside your infrastructure.