Your Last Compliance Scan Is Only True for the Day It Ran

Most teams run a compliance scan before an audit or a client’s security review. The report comes back mostly clean, the flags get fixed, and nothing gets checked again for months.

That report tells you your clusters met the baseline on one day. It doesn’t tell you where you stand today.

Why It Drifts

Clusters change every week. A config gets edited, a new namespace gets created, a workload goes out with settings nobody reviewed. None of it shows up until the next scan. Across a dozen clusters, nobody can say which policies are failing right now, and where.

By the next audit, the honest answer to “are we compliant?” is “we were, a few months ago.”

Check It Yourself in 10 Minutes

Pick one production cluster:

1. List namespaces created in the last 90 days: kubectl get ns --sort-by=.metadata.creationTimestamp
2. Check whether your last scan covered them. Any namespace newer than the scan has never been checked.
3. Find the date of your last full policy check. If you can’t find it quickly, that’s your answer.
4. Look at the failing policies. If a failure has no named owner, it will likely stay open until the next audit.

Repeat it on a second cluster and notice how long the same check takes when each cluster is looked at separately.

What Closes the Gap

• A live pass/fail count per policy, not one overall score
• Every cluster in one view
• Policies grouped by category, so each failure reaches the right owner

How ApexKube Handles This

ApexKube’s policy dashboard shows the current pass and fail count for every policy, across every cluster, broken down by category. You open it and see where you stand today, without running a scan or waiting for a report.

We use it on our own clusters and our clients’. It replaced a manual check that happened before audits and not much in between.

If your honest answer to “are we still compliant?” is “we were last time we checked,” fix that before someone else asks.

Schedule a meeting →