[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ft1lNAFcUgrNJkGa9yG3INnbTVQdyDK7Yv9hdJ6zhCpU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"588027a5-1e97-4dbf-997f-6727dfcf98f9","containerized-cloud-agent-closes-host-level-security-gaps-in-kubernetes-nodes","6c3c01dc-121c-49f8-8c71-dcb83c085f0b","Containerized Cloud Agent Closes Host-Level Security Gaps in Kubernetes Nodes","Kubernetes environments often run on immutable or container-optimized operating systems where traditional agent-based security tools cannot be installed via package managers, leaving host OS vulnerabilities undetected. This gap means that even well-secured workloads can sit on top of unmonitored, vulnerable node operating systems. Qualys's containerized Cloud Agent addresses this blind spot by delivering vulnerability scanning and policy auditing without requiring host-level package installation. The lesson here is that security tooling must evolve alongside infrastructure paradigms—if your scanning solution cannot reach the host, you have an unmonitored attack surface. Organizations adopting Kubernetes must ensure that node-level security coverage is explicitly planned for, not assumed.","**Immediate actions:**\n- Audit all Kubernetes node operating systems to identify any currently unmonitored or unscanned hosts.\n- Deploy a containerized or daemonset-based security agent (such as Qualys Cloud Agent) across all nodes to close host-level visibility gaps.\n\n**Long-term improvements:**\n- Establish a mandatory baseline security policy requiring host OS vulnerability scanning for every node in every cluster, including immutable systems.\n- Integrate node-level vulnerability scan results into your CI\u002FCD pipeline and cluster admission controls to prevent deployment on non-compliant nodes.\n- Maintain a continuously updated inventory of all container host operating systems, architectures, and patch states.\n\n**Detection measures:**\n- Configure alerting for any Kubernetes node that has not reported a vulnerability scan result within a defined SLA window.\n- Implement centralized logging and monitoring of scan findings at the host OS level to detect drift from approved security baselines.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","CIS Control 1: Inventory and Control of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"OWASP A06:2021 Vulnerable and Outdated Components":22,"CIS Control 7: Continuous Vulnerability Management":23,"CIS Control 1: Inventory and Control of Enterprise Assets":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires entities to implement measures for incident handling and vulnerability management across all systems; ungoverned Kubernetes node OSes represent exactly the kind of coverage gap NIS2 obligates organizations to close.","SI-2 requires organizations to identify, report, and correct information system flaws; host OS vulnerabilities on Kubernetes nodes that evade scanning directly violate this control's intent.","Unscanned Kubernetes node operating systems are a direct example of vulnerable or outdated components going undetected, which OWASP A06 specifically calls out as a critical risk in modern application stacks.","Kubernetes nodes running immutable OSes were outside traditional scan coverage; CIS Control 7 requires establishing a continuous vulnerability management process that covers all assets, including those requiring non-traditional scanning methods.","Without an accurate inventory that explicitly includes Kubernetes node operating systems, organizations cannot know which hosts are unmonitored—the foundational gap this article addresses.","This control mandates timely identification and remediation of technical vulnerabilities across all systems, including infrastructure components like Kubernetes node OSes that may not support traditional scanning agents.","Ensuring security tooling can reach and assess every layer of the infrastructure—including container hosts—is a prerequisite for maintaining the protective functions the NIST CSF Protect function demands across all asset types.","published","2026-11-04T17:21:43.215362+00:00","2026-11-04T17:21:43.2+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F11\u002F04\u002Fcloud-agent-now-in-a-container-host-security-for-nodes-you-cant-touch","cloud-agent-now-in-a-container-host-security-for-nodes-you-can-t-touch-d57873","Cloud Agent, now in a Container: Host Security for Nodes You Can’t Touch",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,52,56],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":53,"name":54,"problem":55},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":57,"name":58,"problem":59},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]