Kubernetes · Helm · DaemonSet · Zero Config

Kubernetes security agent
for every node in your cluster

Defensia deploys as a DaemonSet and protects every node in your cluster. Ingress WAF, pod crash detection, NetworkPolicy audit, CVE scanning — all in one lightweight agent.

Start Free
Deploy via Helm1 command
$ helm install defensia-agent \
oci://ghcr.io/defensia/charts/defensia-agent \
--set token=YOUR_TOKEN
# Deploys as DaemonSet — one agent per node
# Privileged + hostNetwork for full node visibility

What Defensia detects on K8s

Host-level security + Kubernetes-native awareness. Nobody else combines both.

🛡

Ingress WAF

Reads nginx-ingress and Traefik access logs. One agent on the ingress node protects ALL services behind it. SQL injection, XSS, RCE, path traversal — detected and blocked.

📦

Pod crash detection

Watches K8s events for CrashLoopBackOff, OOMKilled, ImagePullFailed, and pod evictions. Alerts in the same security dashboard.

🔒

NetworkPolicy audit

Detects namespaces without NetworkPolicy — the #1 K8s security misconfiguration. Shown as warnings in the dashboard.

🔍

CVE scanning

Matches installed software versions against NVD + EPSS + CISA KEV. Flags vulnerabilities before they are exploited.

🚫

SSH node protection

Even in K8s, nodes have SSH. Defensia detects brute force attacks on node SSH with 15 patterns and auto-bans attackers.

🌐

Ingress host discovery

Auto-discovers all Ingress hosts via K8s API. Each domain is monitored by WAF without any configuration.

"Falco tells you something happened. Kubescape tells you what's misconfigured. Defensia tells you both — and blocks the attack automatically."

Defensia vs K8s security tools

Most tools do one thing. Defensia covers the full stack at a fraction of the price.

FeatureDefensiaFalcoKubescapeCrowdSec
SSH brute force protectionYesNoNoPartial
WAF (web attack blocking)YesNoNoPartial
Ingress WAF (cluster-wide)YesNoNoNo
Pod event monitoringYesYesNoNo
CVE scanningYesNoYesNo
NetworkPolicy auditYesNoYesNo
Automatic IP blockingYesNoNoYes
Web dashboardYesPartialYesPartial
Multi-cluster viewYesNoYesNo
Open source agentMITApache 2.0Apache 2.0MIT
Pricing€9/nodeFreeFree + paid$900+/mo

How it works

DaemonSet deploys one agent per node. Each agent reads host logs, queries the K8s API, and blocks attackers at 3 layers.

DEPLOY

Helm install as DaemonSet

One command deploys an agent on every node. Privileged container with hostNetwork and hostPID for full node visibility. Auto-scales with your cluster.

DETECT

K8s API + ingress logs

Reads nginx-ingress/Traefik access logs for WAF analysis. Watches K8s events for CrashLoop and OOM. Audits NetworkPolicy. Monitors SSH on each node.

BLOCK

3-layer firewall

Layer 1: iptables blocks SSH attacks on the node. Layer 2: ConfigMap deny list blocks web traffic at the ingress controller. Layer 3: WebSocket propagates bans across all nodes and servers.

3-layer blocking — how bans work on Kubernetes
Attacker sends HTTP request to your cluster

LAYER 1
SSH to nodeiptables INPUTDROP
Protects SSH access to every node in the cluster
LAYER 2
HTTP to ingressnginx-ingress reads ConfigMap403 Forbidden
Agent writes deny <IP>; to ConfigMap → nginx blocks before reaching any pod
LAYER 3
Cross-cluster propagationWebSocket broadcastAll nodes + servers ban the IP
One detection on one node → instant ban across your entire infrastructure
CNI-agnostic — works with Cilium, Calico, Flannel, or any networking plugin. Read-only ClusterRole + one ConfigMap write permission.

Simple pricing

Per-node, same as bare metal. No per-pod or per-namespace fees.

FREE
1 node

1 domain protected by WAF

Perfect for minikube / testing
PRO
€9/node/mo

10 domains per node

Full WAF + CVE + alerts
ANNUAL
€7/node/mo

Billed annually

Save 22% vs monthly

Frequently asked questions

Does Defensia require cluster-admin privileges?

No. The agent uses a ClusterRole with read-only access: pods, nodes, events, ingresses, namespaces, networkpolicies, and configmaps. It never creates, modifies, or deletes any Kubernetes resource.

How big is the agent binary?

The K8s binary is ~33MB (includes client-go). The container image is based on Alpine and weighs about 40MB. Memory usage is typically 50-100MB per node.

Does it work with managed K8s (EKS, GKE, AKS, DOKS)?

Yes. The DaemonSet runs on worker nodes in any K8s cluster. Tested on DigitalOcean DOKS, and compatible with EKS, GKE, AKS, and self-managed clusters.

How does the Ingress WAF work?

The agent on the ingress controller node reads nginx-ingress or Traefik access logs directly from container log files (/var/log/pods/). When it detects an attack, the IP is blocked at 3 layers: iptables on the node (SSH protection), a ConfigMap with nginx deny rules (ingress-level blocking — the attacker gets 403 before reaching any pod), and WebSocket propagation to all other nodes and servers.

What happens when I add more nodes?

The DaemonSet automatically schedules an agent on the new node. It registers with Defensia using your API key. If you exceed your paid node slots, registration is blocked until you upgrade.

Can I use it alongside Falco or Kubescape?

Yes. Defensia operates at a different layer — it reads access logs and blocks IPs via iptables. Falco monitors syscalls. Kubescape scans configurations. They complement each other.

What about the 10 domain limit per node?

Free: 1 domain per node. Pro: 10 domains per node. If your ingress has more than 10 domains, the extra ones are detected but not protected by WAF until you add another node slot.

Secure your cluster today

One Helm command. DaemonSet on every node. Free for your first node.

Start Free See Pricing