Cloud Agent, now in a Container: Host Security for Nodes You Can’t Touch
Qualys Cloud Agent now available as a container image for Kubernetes nodes.
Qualys has released its Cloud Agent as a container image, enabling vulnerability management and policy auditing for Kubernetes nodes. This new deployment method allows the agent to run on immutable and mutable Linux systems without touching the host's package manager, integrating seamlessly with container workloads via DaemonSets and Helm charts. It supports various container-optimized operating systems and architectures, aiming to close security gaps at the host OS level within containerized environments.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Qualys?
Get an email when a new story names Qualys, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonKubernetes environments often run on immutable or container-optimized operating systems where traditional agent-based security tools cannot be installed via package managers, leaving host OS vulnerabilities undetected. This gap means that even well-secured workloads can sit on top of unmonitored, vulnerable node operating systems. Qualys's containerized Cloud Agent addresses this blind spot by delivering vulnerability scanning and policy auditing without requiring host-level package installation. The lesson here is that security tooling must evolve alongside infrastructure paradigms—if your scanning solution cannot reach the host, you have an unmonitored attack surface. Organizations adopting Kubernetes must ensure that node-level security coverage is explicitly planned for, not assumed.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.