You install a single Helm chart, give it one org API key and one cluster name, and the cluster auto-registers on the agent’s first report — no per-cluster registration step. See Install with Helm.
What you get
| Capability | What it does |
|---|---|
| Cluster posture scan | Read-only pass over the API server: workload misconfigurations, unsafe defaults, Pod Security Standards (PSS) coverage, network-policy gaps. |
| CIS & NSA benchmarks | CIS Kubernetes Benchmark + NSA-CISA hardening controls scored PASS/FAIL per control, with a per-framework score rolled up per cluster. |
| KIEM — RBAC exposure | Flattens every Role / ClusterRole and binding into a risk-scored subject → permission graph; inventories service accounts and flags excessive or unused permissions. |
| Admission control | A validating webhook checks every pod against Pod Security, image-trust, and your custom policy — in audit (warn) or enforce (deny) mode. |
| Image vulnerabilities (CVEs) | Scans running images by digest for CVEs and generates an SBOM; de-duplicated so each unique image is scanned once. |
| Configuration drift | Hashes workload and network-policy specs each scan and surfaces added / changed / removed resources with a before/after diff. |
| Custom rules | Org-defined declarative rules (no Rego), optionally AI-drafted from a plain-English description — evaluated by both the scanner (detection) and the admission webhook (enforcement). |
| AI-assisted remediation (optional) | Generate → dry-run preview → apply a fix for a finding, with full per-workload attempt history. Off by default — the only write-capable component in the chart. |
| Runtime (optional) | The same chart can deploy the TigerGate eBPF runtime sensor for process/file/network/privilege telemetry. See Runtime. |