From raw cluster reality to a ranked, explainable task list
Six layers, one direction of flow. Nothing above the prioritization engine is allowed to touch the score.
Every score is arithmetic you can check
Each finding is a control Praxis recommends for a specific workload, image or binding. Its score combines four reasons to act now with one reason to wait:
How bad the attack the control stops is — the control’s baseline tier and the MITRE ATT&CK techniques it covers.
Whether the workload is reachable: a LoadBalancer or NodePort Service, an Ingress, host networking.
Whether the workload handles sensitive data — from labels and namespaces you mark, never guessed.
What a compromise reaches: privileged containers, host namespaces, the container runtime socket, broad RBAC.
How disruptive applying the control is likely to be. It lowers the score, so quick wins rise.
Weights are fixed and documented. The same input always produces the same ranking, and every item carries the trail of reasons that produced its score.
Six layers, one flow
Running code, verified against real clusters and real consoles
Executive summary
Tier distribution, namespace breakdown, compliance coverage and the resources most at risk — one self-contained page that also opens offline.
Findings explorer
Every recommendation grouped by the resource it is for, with the reasons trail, MITRE technique and evidence behind each score.
Compliance mapping
Requirement-level references for PCI-DSS v4.0 and ISO/IEC 27001:2022; article references for BDDK and KVKK, read from the regulation text.
Deploy plans
The ranked list as ready-to-review policy files — for example KubeArmorPolicy YAML per resource, or a scoped image or runtime policy. Audit mode, never applied by Praxis.
Optional AI rationale
A local model, your own endpoint, or none at all. It explains a score in plain language; it cannot change it, and falls back to a template if unreachable.
Fleet, history and evidence
In Enterprise: many clusters in one view, what changed between runs, evidence reports and signed audit packages.
One adapter per vendor, one engine for all
Two integration patterns cover the CNAPP category: REST APIs, the shape most image-assurance and posture consoles expose, and Kubernetes-native policy objects, which runtime tools deployed as cluster operators create. Status today:
| Aqua SecurityREST API | Validated |
| AccuKnox / KubeArmorKubernetes-native policy objects | Validated |
| Prisma CloudREST API | Connector ready |
| Kubernetes itselfTopology, RBAC, workload security settings | Validated |
“Validated” means tested against a real console or cluster we operate. “Connector ready” means the collector is built from the vendor’s published API, and its control mapping is confirmed against a customer’s own tenant. None of this is a claim of partnership or certification by any vendor.
Package it the way your platform team deploys everything else
Helm chart
An hourly CronJob with a minimal read-only ClusterRole. Optionally reports each run to a central Praxis Enterprise server with a per-cluster token.
Signed offline bundle
Container image, chart and SBOM with signed checksums, for clusters that cannot reach the internet.
Container image
Non-root, read-only collector on a minimal base, built from a hash-locked dependency set.
See your own clusters ranked
Bring one cluster. We run the read-only collector with you and walk through the list it produces.