[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIajq9txJk_azlFfZaDNcPRKTu6j_yjbKX5ijqc7CFu0":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"6c3c01dc-121c-49f8-8c71-dcb83c085f0b","Cloud Agent, now in a Container: Host Security for Nodes You Can’t Touch","cloud-agent-now-in-a-container-host-security-for-nodes-you-can-t-touch-d57873","A single container image that brings Vulnerability Management and Policy Audit to every Kubernetes node, on immutable and mutable Linux alike, deployed the way your container workloads already are. Key Takeaways The Qualys Cloud Agent is now available as a container image on Docker Hub, bringing host-based Vulnerability Management and Policy Audit to every Kubernetes […]","Qualys has released its Cloud Agent as a container image, enabling vulnerability management and policy auditing for Kubernetes nodes. This new deployment method allows the agent to run on immutable and mutable Linux systems without touching the host's package manager, integrating seamlessly with container workloads via DaemonSets and Helm charts. It supports various container-optimized operating systems and architectures, aiming to close security gaps at the host OS level within containerized environments.","Qualys Cloud Agent now available as a container image for Kubernetes nodes.","https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F11\u002F04\u002Fcloud-agent-now-in-a-container-host-security-for-nodes-you-cant-touch","https:\u002F\u002Fblog.qualys.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FBlog-Images-1080x1080.Cloud_.Agent_.2025.Updates-5-7.png","2026-11-04T16:00:00+00:00","2026-11-04T17:00:28.203474+00:00",7,[17,20,23,25],{"name":18,"type":19},"Qualys Cloud Agent","product",{"name":21,"type":22},"Kubernetes","technology",{"name":24,"type":19},"Qualys TotalCloud Kubernetes and Container Security",{"name":26,"type":27},"Qualys","vendor","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":28,"icon":30,"name":31,"slug":32},null,"Tools","tools",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[26,18,24],{"controls":49,"vendors":132},[50,78,103],{"slug":51,"name":52,"problem":53,"products":54},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":72,"vendor_name":26,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":79,"name":80,"problem":81,"products":82},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[83,90,98],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":85,"url":88,"description":89},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":99,"product_name":100,"url":101,"description":102},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":104,"name":105,"problem":106,"products":107},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",[133],{"slug":72,"name":26,"logo_path":73,"roles":134},[135],"reported_by",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":148},"containerized-cloud-agent-closes-host-level-security-gaps-in-kubernetes-nodes","Containerized Cloud Agent Closes Host-Level Security Gaps in Kubernetes Nodes","Kubernetes environments often run on immutable or container-optimized operating systems where traditional agent-based security tools cannot be installed via package managers, leaving host OS vulnerabilities undetected. This gap means that even well-secured workloads can sit on top of unmonitored, vulnerable node operating systems. Qualys's containerized Cloud Agent addresses this blind spot by delivering vulnerability scanning and policy auditing without requiring host-level package installation. The lesson here is that security tooling must evolve alongside infrastructure paradigms—if your scanning solution cannot reach the host, you have an unmonitored attack surface. Organizations adopting Kubernetes must ensure that node-level security coverage is explicitly planned for, not assumed.",[141,142,143,144,145,146,147],"CIS Control 7: Continuous Vulnerability Management","CIS Control 1: Inventory and Control of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":149,"NIST SP 800-53 SI-2: Flaw Remediation":150,"OWASP A06:2021 Vulnerable and Outdated Components":151,"CIS Control 7: Continuous Vulnerability Management":152,"CIS Control 1: Inventory and Control of Enterprise Assets":153,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":154,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":155},"NIS2 requires entities to implement measures for incident handling and vulnerability management across all systems; ungoverned Kubernetes node OSes represent exactly the kind of coverage gap NIS2 obligates organizations to close.","SI-2 requires organizations to identify, report, and correct information system flaws; host OS vulnerabilities on Kubernetes nodes that evade scanning directly violate this control's intent.","Unscanned Kubernetes node operating systems are a direct example of vulnerable or outdated components going undetected, which OWASP A06 specifically calls out as a critical risk in modern application stacks.","Kubernetes nodes running immutable OSes were outside traditional scan coverage; CIS Control 7 requires establishing a continuous vulnerability management process that covers all assets, including those requiring non-traditional scanning methods.","Without an accurate inventory that explicitly includes Kubernetes node operating systems, organizations cannot know which hosts are unmonitored—the foundational gap this article addresses.","This control mandates timely identification and remediation of technical vulnerabilities across all systems, including infrastructure components like Kubernetes node OSes that may not support traditional scanning agents.","Ensuring security tooling can reach and assess every layer of the infrastructure—including container hosts—is a prerequisite for maintaining the protective functions the NIST CSF Protect function demands across all asset types."]