Skip to content

General AccuKnox & CNAPP

About AccuKnox

1. What is AccuKnox and what problems does it solve?

AccuKnox is an AI-powered Zero Trust Cloud Native Application Protection Platform (CNAPP) founded in August 2020 in partnership with Stanford Research Institute (SRI International). It secures Public, Private, and Hybrid Clouds, Edge/IoT, APIs, 5G workloads, and AI/LLM assets under a single unified control plane.

The core problems AccuKnox solves: + All advanced attacks are runtime attacks — yet most tools focus only on static posture detection and miss threats as they execute. + Disparate tools for AppSec, CloudSec, and AISec create visibility gaps, tool sprawl, and ~100% higher costs in people and tooling. + Disjoint tools for on-prem vs cloud security leave hybrid environments unsecured and unmanageable.

AccuKnox's answer is a unified Zero Trust CNAPP that deploys across all public and private clouds, secures all asset types (K8s, VMs, APIs, Edge), integrates AppSec, CloudSec, and AISec in one platform, and delivers more than 50% savings over equivalent point-solution stacks.

References: - AccuKnox CNAPP Platform - CNAPP Security Overview - AccuKnox Solutions

2. What are AccuKnox's key company credentials and recognitions?

AccuKnox has established strong technical and industry credentials since its founding: + Founding: Founded August 2020 in partnership with Stanford Research Institute (SRI International) — birthplace of the internet and holder of seminal Zero Trust security patents. + Patents: 10+ patents registered with the United States Patent & Trademark Office covering different aspects of Zero Trust Security. + Open Source: Creators and core maintainers of KubeArmor — a CNCF Sandbox project with 2 million+ downloads and 1,000+ GitHub stars. + Publications: 5 books published on Zero Trust Security, available on Amazon Books. + Funding: $15M seed funding from top investment firms including SRI International, NationalGrid Partners, Dolby Family Ventures, Dreamit Ventures, Avanta Ventures, and Z5Capital. + Awards: Security Top 10 Zero Trust Security Solution Provider 2021, NASSCOM Emerge 50, Cloud Native Computing Foundation Incubating Project, SiliconIndia Top 10 AI Enabled Cybersecurity Solutions Providers 2025, BSides Agentic AI Security Startup of the Year 2025. + Certifications: Kubernetes Certified Service Provider, SOC 2, Cloud Native Computing Foundation Silver Member, AWS Partner (Amazon EKS Ready), NVIDIA Inception Program, Nutanix Ready AHV. + Ratings: Rated 4.5/5 on Gartner Peer Insights and 4.⅗ on G2.

References: - AccuKnox Homepage

3. What are all the modules supported by AccuKnox CNAPP?

AccuKnox delivers 12 product offerings across AppSec, CloudSec, and AISec:

Generally Available: + AI Security (AI-SPM) — AI-DR, Prompt Firewall, AI Runtime App Security, Model & Dataset Security, LLM Red Teaming, AI Compliance + API Security — API Discovery and Inventory, Access Control and Enforcement, Static API Security Testing + Cloud Security (CSPM) — Asset Inventory Visibility, Drift Detection & Remediation, Zero Trust Policy Enforcement, Compliance & Audit Benchmarks + Workload Security (CWPP) — Least Permissive Posture Assessment, Securing Secrets Manager, Container & VM Enforcement, Runtime Threat Detection + Kubernetes Security (KSPM) — Cluster Misconfiguration Detection, CIS K8s Benchmark Findings, K8s Identity & Entitlement Management (KIEM), Pod & Network Security Monitoring + Application Security (ASPM) — SAST, DAST, Secret Scans, IaC Scans, SBOM + Runtime Security (CDR) — Automatic Remediation of Public Exposures, Real-Time Cloud Misconfiguration Detection, Unauthorized Access and Geo-Anomaly Detection, Runtime Drift and Policy Enforcement, Fast Incident Response + Secrets Manager — Hardcoded Credential Scanning, Dynamic Secret Generation, Runtime Secrets Hardening + Events Management (SIEM) — Centralized Log Management, Alert Fatigue Reduction, Audit Readiness

Beta: + Cloud Identity Security (CIEM) — Unified Multi-Cloud Entitlement Visibility, Cross-Cloud Identity and Permission Correlation, Consistent Multi-Cloud CIEM Controls + Static Security (SBOM) — Shift Left Security in CI/CD, Supply Chain Visibility, Drift Detection + Threat Modeling (CTEM) — Adversarial Emulation and Validation, Policy Enforcement & Remediation, Real-Time Threat Detection

All modules are backed by GRC with 35+ compliance templates (SOC2, NIST, ISO, GDPR, HIPAA).

References: - CNAPP Security Overview - AccuKnox CNAPP Platform

Platforms & Environments

4. What platforms and environments does AccuKnox support?

AccuKnox supports the following environments: + Public Cloud, Private Cloud, Hybrid, Air-Gapped, Edge/IoT

AccuKnox supports the following cloud platforms: + AWS, Azure, GCP, Oracle, OpenStack, OpenShift, Nutanix, VMware, IBM Cloud, DigitalOcean, Alibaba Cloud

Platform-level support: + Kubernetes — Fully supported (EKS, AKS, GKE, OpenShift, Rancher, OKE, and more) + Linux — Supported distributions (Ubuntu, Debian, CentOS, SUSE, Arch Linux, Fedora, Rocky Linux, Red Hat Enterprise Linux, Amazon Linux, Raspberry Pi OS) + VMs and Bare Metal — Fully supported + 5G Workloads and IoT/Edge Sensors — Fully supported + AI Datasets and LLM Models — Fully supported + Serverless — AWS Fargate and ECS supported; others on roadmap + Windows — On roadmap

References: - Deployment Models - On-Prem Overview

5. Where is AccuKnox SaaS deployed and what regions are available?

AccuKnox SaaS is deployed across multiple regions to ensure high availability, low latency, and compliance with regional data regulations:

  • United States (Primary Production) — app.accuknox.com — Primary production deployment serving customers across North America.
  • India — app.in.accuknox.com — Optimized for customers in India and neighboring regions for performance and local data residency compliance.
  • Europe — app.eu.accuknox.com — Designed to comply with GDPR and serve EU customers with minimal latency.
  • Middle East — app.me.accuknox.com — Tailored for enterprises in the Middle East with alignment to regional compliance standards.

For customers requiring data residency within their own environment, AccuKnox also supports fully on-prem and customer-hosted cloud deployments where no data leaves the customer environment.

References: - Deployment Models

6. What are AccuKnox's four deployment models?

AccuKnox supports four deployment models, each delivering the same platform capabilities:

  • AccuKnox SaaS (Cloud Delivered) — AccuKnox hosts and manages the control plane. Customers connect cloud accounts and clusters via agentless or agent-based integrations. Available in US, EU, India, and Middle East regions. Fastest time to value.
  • Customer's On-Prem (VMs, Bare Metal) — AccuKnox control plane deployed in the customer's own data center or private cloud. Agents are deployed into K8s clusters and VMs. Full platform capabilities with no external connectivity required.
  • Customer's Air-Gapped Infrastructure — Full AccuKnox CNAPP deployed in a completely isolated environment with no internet connectivity. All modules (ASPM, CSPM, CWPP, KSPM, GRC) supported. Designed for government, defense, and regulated industries.
  • Customer's Hosted Public & Private Cloud — AccuKnox control plane deployed in the customer's own AWS, Azure, or GCP account. Data never leaves the customer environment. Supports hybrid configurations combining cloud accounts and on-prem clusters.

References: - Deployment Models - On-Prem Overview - Multi-Tenancy

7. What hypervisors and virtualized environments does AccuKnox support?

AccuKnox does not integrate at the VM virtualization layer. Instead, AccuKnox integrates at the operating system layer — ensuring the right hardening and enforcement for process executions, network access, and file access is in place regardless of the underlying virtualization technology.

This means AccuKnox can operate on any virtualization technology — VMware, Hyper-V, KVM, Nutanix AHV, Proxmox — provided the underlying VM uses Linux as its operating system. KubeArmor enforces security policies using Linux Security Modules (LSMs) at the kernel level, making it hypervisor-agnostic by design.

References: - On-Prem Overview - AccuKnox On-Prem Security

Architecture & Control Plane

8. How does AccuKnox multi-tenancy work?

AccuKnox is built on a layered multi-tenancy architecture that supports both hard isolation (dedicated control plane per customer) and soft isolation (shared infrastructure with logical separation):

Tenancy Layers: + Layer 1 — Users, RBAC, and tenant management + Layer 2 — Backend jobs, playbooks, and execution management + Layer 3 — Data isolation between tenants + Layer 4 — Custom reporting, dashboards, and layouts per tenant

Data Isolation: + Different PostgreSQL tables for different tenants on the same DB instance. + Different MongoDB collections per tenant on the same instance. + Every collection and table has its own access control mechanism. + Blast radius reduction — a compromised tenant does not impact other tenants' data.

Resource Isolation: + Kueue for cluster-wide fair resource sharing across tenants — prevents any single tenant's playbook execution from starving others. + Isolated namespace-based replicasets for per-tenant parser task management.

User Permissions: + A single user can belong to multiple tenants with different RBAC rules in each. + Within a tenant, users can be restricted to specific assets based on labels. + MSSPs can manage multiple customer tenants from a single control plane with read or admin permissions per customer.

Per-tenant custom views allow enabling or disabling specific security modules, so each tenant's dashboard only shows the services they have opted into.

References: - Multi-Tenancy - Control Plane Architecture

Open Source vs Enterprise

9. What is KubeArmor and how does it relate to AccuKnox?

KubeArmor is a CNCF Sandbox open-source project created and maintained by AccuKnox. It is a cloud-native runtime security enforcement system that restricts the behavior of pods, containers, and nodes (VMs) at the system level using Linux Security Modules (LSMs) and eBPF.

KubeArmor provides: + Kernel-level syscall filtering, file access control, process execution control, and network access control. + Real-time policy violation alerts with container and workload identity context. + Auto-detection of normal application behavior to generate least-privilege baseline policies. + Support for Kubernetes, VMs, and bare-metal Linux workloads.

AccuKnox Enterprise extends KubeArmor with: + A centralized control plane, multi-tenancy, and RBAC for managing policies across thousands of clusters. + CSPM, KSPM, ASPM, API Security, AI-SPM, GRC, and all other CNAPP modules in a unified platform. + Auto-discovery of workload behaviors and auto-generation of least-privilege policies at scale. + Compliance reporting, posture dashboards, ticketing integrations, SIEM connectors, and AI-powered co-pilot.

References: - Open Source vs Enterprise - KubeArmor Open Source

10. Should I use KubeArmor (open source) or AccuKnox Enterprise?

Use KubeArmor open source if you need runtime security enforcement for a single cluster and are comfortable managing policies manually via YAML and CLI. KubeArmor is free, transparent, and community-supported through the CNCF ecosystem.

Use AccuKnox Enterprise if you need: + Centralized management of policies across multiple clusters, clouds, and environments. + Full CNAPP coverage — CSPM, CWPP, KSPM, ASPM, AI-SPM, API Security, GRC — in one platform. + Auto-discovery of cloud assets and workloads without manual onboarding of each resource. + Compliance posture dashboards with audit-ready evidence for SOC 2, HIPAA, PCI DSS, NIST, and 30+ other frameworks. + Ticketing, SIEM, and DevSecOps integrations for enterprise-scale remediation workflows. + Multi-tenancy for MSSP or multi-team environments with per-tenant RBAC and reporting. + Commercial SLAs, dedicated TAM support, and 24/7 incident response.

References: - Open Source vs Enterprise

Asset Discovery & Monitoring

11. Does AccuKnox provide auto-discovery of assets and workloads?

Yes. AccuKnox performs automatic asset discovery across cloud accounts and on-prem environments:

  • Cloud Assets (Agentless): Connect an AWS, Azure, or GCP account via IAM role or service principal. AccuKnox automatically inventories all cloud resources — compute instances, storage buckets, databases, networking resources, IAM roles, and AI/ML assets — without any additional configuration.
  • Workloads (Agent-based): Deploying AccuKnox agents (KubeArmor) into K8s clusters and VMs provides continuous workload visibility — process execution, file access, network connections, and behavioral baselines.
  • AI Assets: Cloud account onboarding automatically discovers AI/ML assets including SageMaker endpoints, Azure AI Foundry, Vertex AI models, and local AI assets such as Ollama and MCP servers.
  • Shadow Resources: Public asset tagging auto-flags externally reachable cloud resources during every scan — so misconfigured public-facing assets appear in the inventory immediately.

References: - CNAPP Security Overview - On-Prem Overview

12. Do I need to enable native AWS security services to use AccuKnox?

No. AccuKnox only requires an IAM role with read-only access to get data from AWS. No native AWS security services need to be enabled or purchased for AccuKnox to function.

Optionally, enabling AWS Security Hub and Amazon Macie allows AccuKnox to gather richer telemetry with additional context — surfacing security findings from those services alongside AccuKnox's own detections in a unified dashboard. These are additive sources, not requirements.

References: - CNAPP Security Overview - Deployment Models

13. Can AccuKnox help with monitoring and drift detection?

Yes. AccuKnox provides several monitoring capabilities: + Asset Monitors: Create monitors for assets or groups of assets to receive alerts when metadata changes — software version updates, configuration changes, or new resource creation. + Drift Detection: Continuously monitors compliance checks between scans — flagging controls that have changed from pass to fail since the last scan, giving a real-time view of posture regression. + Runtime Alerts: Collects alerts and telemetry from KubeArmor and Cilium for events that have violated or complied with a security policy. These alerts form the core of the CWPP offering. + Notification Channels: Alerts can be routed to Slack, email, PagerDuty, Jira, and other channels for real-time operational response. + Cloud Misconfiguration Monitoring: Real-time detection of cloud configuration changes that introduce new risk, with automated remediation options for supported resource types.

References: - CNAPP Security Overview - Findings Lifecycle

Findings Lifecycle & Ticketing

14. How does the findings lifecycle work in AccuKnox?

AccuKnox manages security findings through a structured lifecycle from detection to remediation and closure:

  • Detection: Findings are generated by continuous scans — CSPM, KSPM, ASPM, CWPP runtime, container scanning, IaC scanning, secrets scanning, and API security — and ingested into the AccuKnox control plane.
  • Triage: Findings are deduplicated, correlated across scan types, and enriched with asset context, severity scoring, compliance framework mapping, and exploitability data.
  • Prioritization: AI-powered risk scoring surfaces the highest-priority findings based on exploitability, asset criticality, exposure, and runtime reachability.
  • Assignment: Findings can be manually assigned or automatically routed via playbooks to the responsible team or individual.
  • Remediation: Findings include actionable remediation guidance. Auto-remediation can be triggered for supported resource types. GitOps PRs are generated for IaC findings.
  • Verification: After remediation, a rescan validates that the issue is resolved. Once confirmed, the finding is closed and the closure is recorded with a timestamp for audit purposes.
  • False Positive Management: Findings can be marked as exceptions with documented justification — tracked transparently without polluting compliance scores.

References: - Findings Lifecycle

15. How does AccuKnox create and manage tickets for security findings?

AccuKnox supports bi-directional ticketing integration with leading platforms:

  • Supported Ticketing Tools: Jira, ServiceNow, FreshService, Connectwise, Zendesk
  • Ticket Templates: AccuKnox provides customizable ticket templates that define how findings map to ticket fields — severity, description, asset context, remediation guidance, compliance reference, and assignee — for each integration.
  • Bi-Directional Sync: When a ticket is resolved in Jira or ServiceNow, AccuKnox marks the corresponding finding as remediated. When a finding re-appears in a subsequent scan, AccuKnox can re-open the associated ticket automatically.
  • Playbook-Driven Ticketing: ASPM and CNAPP playbooks automate ticket creation — for example, creating a Jira ticket automatically whenever a new critical severity finding appears in a production-tagged asset.
  • Bulk Operations: Findings can be batch-assigned or batch-ticketed across multiple findings simultaneously.

References: - Ticket Template Integration

On-Prem Security

16. How does AccuKnox secure on-prem workloads without cloud connectivity?

AccuKnox provides full security coverage for on-prem environments through agent-based deployment with no external connectivity requirement:

  • KubeArmor Deployment: Deploy AccuKnox agents (KubeArmor) into target K8s clusters and VMs. Agents operate independently — collecting telemetry, enforcing policies, and generating alerts locally.
  • eBPF Telemetry: Linux-native agents leverage eBPF for kernel-level telemetry collection, providing granular insights into process execution, file access, and network behavior without performance overhead.
  • SPIFFE Identity: AccuKnox uses SPIFFE to assign unique cryptographic identities to all workloads regardless of where they run — eliminating hard-coded credentials and enabling zero-trust workload authentication.
  • Local Control Plane: The AccuKnox control plane can be deployed on-prem in the customer's data center, managing policies, collecting telemetry, and generating compliance reports entirely within the customer's environment.
  • Air-Gapped Support: For fully isolated environments, AccuKnox supports air-gapped deployment with all CNAPP modules functioning without any internet connectivity.
  • CI/CD Integration: Shift-left security scanning (SAST, DAST, SCA, IaC, container) integrates into on-prem CI/CD pipelines, establishing a proactive security posture from code to runtime.

References: - On-Prem Overview - AccuKnox On-Prem Security

17. What will happen to my application running on a VM when AccuKnox is deployed?

Your application continues to run normally. AccuKnox VM security operates non-intrusively at the OS layer without modifying the application itself.

What AccuKnox adds to VM security: + CSPM: Continuous misconfiguration scanning and drift detection for the VM's cloud configuration. + Host Scanning: Vulnerability scanning for OS packages and installed software. + Malware Scanning: Detection of malicious processes and files on the host. + CWPP Runtime Enforcement: KubeArmor enforces least-privilege policies — controlling which processes can run, which files can be accessed, and which network connections are permitted. Violations are logged and alerted in real time. + Host Hardening: STIGs-based and CIS-based hardening checks with remediation guidance. + Compliance Benchmarking: Continuous validation against NIST, CIS, MITRE, STIG, and other applicable standards. + Anomaly Detection: Behavioral baseline is established from observed normal activity. Deviations trigger alerts for investigation.

Integrations & Tools

18. What integration tools and registries does AccuKnox support?

AccuKnox supports 50+ integrations across all major security and DevOps tooling categories:

  • SIEM / Security Events: Splunk, Rsyslog, AWS CloudWatch, Elasticsearch, Azure Sentinel, Microsoft Sentinel, Webhooks
  • Notification Tools: Slack, Email, PagerDuty
  • Ticketing Tools: Jira, ServiceNow, FreshService, Connectwise, Zendesk
  • Container Registries: Amazon ECR, Azure Container Registry, Google Container Registry, Google Cloud Artifact Registry, Docker Hub, Docker Registry, JFrog Artifactory, Harbor, Sonatype Nexus, Quay, OpenShift Registry
  • CI/CD: GitHub Actions, GitLab CI/CD, Jenkins, Azure DevOps, AWS CodePipeline, CircleCI, Harness, GCP Cloud Build, Bitbucket
  • Security Scanners (SAST/DAST/SCA): Checkmarx, Snyk, ZAP, Burp Suite, Veracode, SonarQube, Semgrep, Fortify, Nuclei, CLOC
  • IaC Tools: Checkov, Tfsec, Terraform, Ansible
  • Compliance/Posture: Steampipe, CloudSploit, AWS Security Hub
  • Observability: Grafana, Elastic, Splunk, Datadog

The full and up-to-date integration list is at accuknox.com/integrations.

References: - AccuKnox Integrations

POC & Getting Started

19. What does an AccuKnox POC look like and how long does it take?

AccuKnox follows a structured, time-boxed 5-day POC process:

  • Day 1 (Monday) — Onboarding: Complete cloud account onboarding, agent deployment, and control plane activation. Day 1 onboarding completes at 100% by end of day.
  • Day 2-3 (Tuesday/Wednesday) — Scan Results: Security scans run across all connected assets. Initial findings from CSPM, KSPM, ASPM, and runtime modules appear in the dashboard. Split 50/50 across days 2 and 3.
  • Day 3-4 (Wednesday/Thursday) — Asset Inventory: Full asset inventory is built and populated. 70% complete by Wednesday, 30% finalized by Thursday.
  • Day 4-5 (Thursday/Friday) — Findings Categorization: Findings are categorized by severity, type, and compliance mapping. 100% complete by Friday.
  • Day 2-5 — Dashboards & Reports: Posture dashboards, compliance reports, and custom reporting begin populating from Day 2 and reach 65% build by end of week.

The POC is designed to deliver tangible, demonstrable security value within a single business week — not weeks of setup before any output.

20. What are the 6 core reasons AccuKnox is a strong security partner?

AccuKnox positions itself on six core differentiation pillars:

  • Effortless: Agentless onboarding for cloud assets means customers can detect and protect in minutes — no weeks-long deployment projects before seeing value.
  • Extensive: The most comprehensive AppSec (ASPM), CloudSec (CWPP, CSPM, KSPM), API Security, and AISec (AI-SPM) in the industry — all public clouds, private cloud, and air-gapped deployment supported.
  • Exhaustive: End-to-end coverage from code to runtime across all workload types — K8s, VMs, containers, APIs, Edge/IoT, and AI/LLM models.
  • Effective: Runtime security with inline mitigation via eBPF and KubeArmor — blocking zero-day attacks at the kernel level before they cause damage, not just detecting them after the fact.
  • Innovative: R&D partnership with Stanford Research Institute and 10+ patents on Zero Trust Security — ensuring the platform is built on deep technical foundations, not marketing features.
  • Partner First: Over 150 partnerships with systems integrators, MSSPs, cloud marketplaces, and technology vendors — ensuring customers get the best value and ROI from their investment.

References: - AccuKnox Homepage - Open Source vs Enterprise

SCHEDULE DEMO