[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-571773-105":3,"detail-sidebar-cat-1-en-105":80,"doc-detail-571773-en":126},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":73,"head_meta":75,"extra_data":77,"updated_unix":79},105,"en","a-comparison-of-kubernetes-compliance-standards-and-configuration-scanners-systematic-comparison-and-empirical-evaluation","A Comparison of Kubernetes Compliance Standards and Configuration Scanners - Systematic Comparison and Empirical Evaluation","","Kubernetes has become the de facto standard for orchestrating containers in microservice-based architectures, yet hardening guidelines and scanning tools often provide differing guidance and outputs, causing inconsistent configuration and prioritization. This work systematically compares eight widely used Kubernetes hardening guidelines, derives a benchmark of 79 configuration recommendations, and evaluates ten static configuration scanners. Results show large disparities in configuration-issue coverage and inconsistencies in how issues are scored and ranked, underscoring the need for more standardized, transparent, and consistent risk and severity assessment.",{"@graph":14,"@context":72},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/general/","General",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/a-comparison-of-kubernetes-compliance-standards-and-configuration-scanners-systematic-comparison-and-empirical-evaluation/571773/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/a-comparison-of-kubernetes-compliance-standards-and-configuration-scanners-systematic-comparison-and-empirical-evaluation/571773.png","ImageObject",442,249,{"name":42,"@type":43},"kopisore","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":22},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68],{"name":59,"@type":60,"acceptedAnswer":61},"What problem does the paper address about Kubernetes security guidance?","Question",{"text":62,"@type":63},"It addresses how differing hardening guidelines and scanning tools yield inconsistent configuration and prioritization, due to coverage gaps and non-uniform outputs.","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"How many hardening guidelines, recommendations, and scanners are evaluated?",{"text":67,"@type":63},"The study compares eight hardening guidelines, compiles a benchmark of 79 configuration recommendations, and evaluates ten popular static configuration scanning tools.",{"name":69,"@type":60,"acceptedAnswer":70},"What do the findings reveal about scanners and guidelines?",{"text":71,"@type":63},"They reveal substantial disparities in coverage across guidelines and scanners, and inconsistencies in severity or risk scoring and ranking of configuration issues.","https://schema.org",{"og:url":32,"og:type":74,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":76,"canonical":32},"index,follow",{"doc_id":78,"site_id":7},571773,1792481827,{"code":4,"msg":81,"data":82},"success",[83,88,93,98,103,108,113,118,123],{"id":84,"doc_module":22,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},11,"Presentations",90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":4,"slug":125},158,"general-158",{"code":4,"msg":81,"data":127},{"doc_id":78,"user_id":128,"nickname":42,"user_avatar":129,"doc_module":22,"category_id":124,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":22,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":135,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":141},962090880963,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","arXiv :2606 .24438v1 [ cs .CR] 23 Jun 2026  \nA Comparison of Kubernetes Compliance Standards and Configuration Scanners  \nMichael Krieger 1, Markus Gierlinger2, Farooq Shaikh 1, and Mario  \nKahlhofer 1  \n1 Dynatrace Research, Linz, Austria {michael.krieger, farooq.shaikh, [mario.kahlhofer}@dynatrace.com](mario.kahlhofer}@dynatrace.com)  \n[https://research.dynatrace.com](https://research.dynatrace.com)  \n2 Independent Researcher, Linz, Austria  \n[ma.gierlinger@gmail.com](ma.gierlinger@gmail.com)  \nAbstract. Kubernetes has become the industry standard for orchestrating containers in microservice-based software architectures. While several hardening guidelines and scanning tools for securing Kubernetes clusters and deployments have emerged in recent years, their differing guidance and outputs often lead to inconsistent configuration and prioritization decisions. This work presents a systematic comparison of eight commonly used Kubernetes hardening guidelines. Through this comparison and the inclusion of best practices, we established a benchmark of 79 Kubernetes configuration recommendations and conducted the a structured empirical evaluation of ten popular static configuration scanning tools and their scoring outputs. Our findings reveal substantial disparities in the coverage of configuration issues across hardening guidelines and scanners, as well as inconsistencies in how configuration issues are scored and ranked by different scanners. These results highlight the need for more standardized, transparent, and consistent approaches to risk and severity assessment of Kubernetes configuration issues.  \nKeywords: Kubernetes · Security Configuration · Hardening Guidelines  \n· Static Analysis · Configuration Scanning  \n1 Introduction  \nKubernetes (k8s) is an open-source platform for automating the deployment, scaling, and management of containerized applications. Its resiliency and flexibility have driven widespread adoption across diverse domains, including 5G networks [8,42] and Internet of Things (IoT) environments such as software-defined vehicles [45] . Its greatest impact, however, has been in cloud environments, where it has become the de facto standard for service deployment.  \nIn Kubernetes, application workloads are defined declaratively using manifests that describe a desired system state, which Kubernetes continuously reconciles with the actual cluster state. While this model integrates well with automation and simplifies operations, it requires substantial expertise. Developers  \n2 M. Krieger et al.  \nmust understand numerous configuration options, their defaults, and their security implications. Consequently, secure system configuration remains challenging beyond writing secure code [16], and misconfigurations often surface only after deployment in complex environments.  \nThese challenges have led to the emergence of multiple Kubernetes hardening guidelines and standards, including the CIS Kubernetes Benchmark [10], the NSA/CISA Kubernetes Hardening Guide [36], and the Kubernetes Security Technical Implementation Guide (STIG) [1] . Developed by different organizations, these guidelines vary in scope, level of detail, update frequency, and focus, ranging from high-level best practices to detailed configuration recommendations. The challenges posed by this fragmented landscape manifest in two ways. First, practitioners who rely on a single hardening guideline or scanner may develop a false sense of security, unaware of the significant coverage gaps that individual guidelines and tools exhibit. Second, achieving broad coverage requires combining multiple guidelines and tools, which substantially increases the operational workload. Depending on regulatory and organizational requirements, practitioners may further need to satisfy additional standards, compounding this effort.  \nPrior work has studied Kubernetes security practices and scanner performance [47,40,7,28], but has neither systematically compared hardening guideli","cbCaiiQIm1iS3VMz","https://ap.wps.com/l/cbCaiiQIm1iS3VMz","pdf",609680,22,"English","# Abstract\n# Introduction\n# Research Questions\n# Main Contributions\n# Kubernetes Architecture, Hardening Guidelines, and Scanners","[{\"question\":\"What problem does the paper address about Kubernetes security guidance?\",\"answer\":\"It addresses how differing hardening guidelines and scanning tools yield inconsistent configuration and prioritization, due to coverage gaps and non-uniform outputs.\"},{\"question\":\"How many hardening guidelines, recommendations, and scanners are evaluated?\",\"answer\":\"The study compares eight hardening guidelines, compiles a benchmark of 79 configuration recommendations, and evaluates ten popular static configuration scanning tools.\"},{\"question\":\"What do the findings reveal about scanners and guidelines?\",\"answer\":\"They reveal substantial disparities in coverage across guidelines and scanners, and inconsistencies in severity or risk scoring and ranking of configuration issues.\"}]","A Comparison of Kubernetes Compliance Standards and Configuration Scanners - Systematic Comparison and Empirical Evaluation | PDF",1791923667,8]