I'm starting to build out a DevSecOps workflow for my team. We're using Python for automation and our main deployment target is Kubernetes (EKS). I'm looking at Tenable Cloud Security but wanted to ask about alternatives.
For those with experience, what are the leading platforms you'd compare it to? I'm particularly interested in how well they integrate into CI/CD pipelines using Python scripts and how they handle scanning container images and K8s manifests. Are there any that feel more native to this kind of stack?
I'm pretty new to this space myself, but I've been digging into the same question for our stack (Python + EKS). A couple that kept coming up in my research were Aqua Security and Sysdig. They both have Python SDKs and decent hooks into CI/CD pipelines. Aqua's admission controller felt pretty native for K8s manifests, like you could run it as a pre-deployment check in a Jenkins job or GitHub Actions without too much friction.
For container scanning specifically, I've seen people mention that Trivy (open source, by Aqua) has a Python wrapper that makes it trivial to script. If you're not married to a SaaS platform, Trivy + a simple policy engine like OPA/Gatekeeper might be worth a look. But I'm curious about your experience with Tenable's Python integration - did you run into any blockers with their API?