ARMO

What ARMO does

ARMO (legally Cyber Armor LTD) is an Israel-based cybersecurity company founded in 2019 in Tel Aviv by CEO Shauli Rozen and CTO Ben Hirschberg. It provides a runtime-powered cloud security platform centered on Kubernetes environments, combining the open-source Kubescape scanner — a CNCF Incubating project and the first security and compliance scanner accepted by CNCF — with a commercial ARMO Platform that layers enterprise features including dashboards, RBAC visualization, compliance reporting, and premium support. The technology stack is built on Open Policy Agent (OPA)/Rego for policy authoring and eBPF-based sensors for runtime behavioral detection (1-2.5% CPU overhead), enabling capabilities such as Cloud Application Detection and Response (CADR), Kubernetes Security Posture Management (KSPM), Continuous CSPM, Runtime-based Vulnerability Management with reachability context, and Cloud-Native Security for AI Workloads. Approximately $34M has been raised across a $30M April 2022 Series A led by Tiger Global and Hyperwise Ventures and earlier rounds, with approximately 30 staff as of early 2026.

ARMO operates a hybrid go-to-market: the open-source Kubescape project is distributed free via GitHub to drive developer adoption (11K+ stars, 100K+ deployments, 15M+ scans per month), while the ARMO Platform is sold through enterprise field sales with opaque pricing requiring a demo, deployable as SaaS, on-premises, or air-gapped. Target buyers include DevOps and platform engineering teams, enterprise security and compliance functions, AI/ML teams running Kubernetes workloads, and organizations with sovereign cloud requirements. Named customers span telecommunications (Akamai, Ericsson, Nokia, Allot, Orange Business), technology (Dell, Broadcom, AssemblyAI, Gitpod), healthcare (GoodRX, Akinox), energy (Energi Danmark, Vandebron), financial services (Alter Domus), and education (Stanford University). The company's strategic positioning centers on owning the runtime detection layer for cloud-native workloads, validated by a January 2026 flagship partnership integrating CADR into Rapid7's Exposure Command Ultimate tier.

Name

ARMO

Legal name

Cyber Armor LTD

Website

https://armosec.io

Company type

Private

Founded year

2019

Operating status

Operating

Headcount range

11–50 employees

Short description

ARMO (founded 2019, Tel Aviv) provides a runtime-powered Kubernetes and cloud security platform built on the open-source Kubescape scanner (CNCF Incubating) and commercial ARMO Platform, serving DevOps, enterprise security, and AI-workload teams with customers including Akamai, Ericsson, Nokia, Dell, and Broadcom.

Ownership category

akta.pro rank

Product category

Cloud-Native & Kubernetes Security Software

NAICS

Software Publishers (5132), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182)

SIC

Services-Prepackaged Software (7372)

akta.pro industry

PRIMARYHDADADAE

Kubernetes & Container Security (KSPM/KCSPM, Runtime)

Hardware, Technology & Telecom/Cybersecurity/Cloud Security (CNAPP, CSPM, CWPP)

SECONDARYHDABAJAF

Cloud-Native/Kubernetes Observability

Hardware, Technology & Telecom/Cloud & Data Center Infrastructure/Observability, Monitoring & AIOps for Cloud

SECONDARYHDABABAC

Kubernetes & Container Platform Management (Private Cloud)

Hardware, Technology & Telecom/Cloud & Data Center Infrastructure/Private Cloud & Cloud Management Platforms

SECONDARYHDAEANAG

Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII)

Hardware, Technology & Telecom/Enterprise Platforms & Databases/Artificial Intelligence Platforms for Enterprise

Keywords

• Kubernetes security
• Cloud workload protection
• Runtime threat detection
• Vulnerability management
• Cloud security posture

Headquarters

HQ city

Palo Alto

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure

Revenue model

1. ARMO Platform (SaaS/Enterprise): Hosted, managed security solution powered by Kubescape offered as SaaS or on-premises deployment with enterprise-grade features including dashboards, RBAC visualization, and premium support
2. Open Source (Kubescape): Free open-source Kubescape platform drives adoption and community growth, with conversion path to paid enterprise platform features
3. Professional Services & Support: Enterprise-grade support and professional services bundled with paid platform subscriptions

Pricing tiers

Go-to-market motion3 records

Distribution channels6 records

Marketing channels8 records

Core offering

ARMO builds and sells the ARMO Platform, an enterprise Kubernetes and cloud-native security solution powered by the open-source Kubescape scanner. The platform delivers runtime behavioral Cloud Application Detection and Response (CADR) via eBPF sensors, Kubernetes Security Posture Management, runtime-based vulnerability management, continuous CSPM, runtime hardening and remediation, and specialized modules for AI workloads and on-premises/sovereign cloud deployments.

Product overview

ARMO offers a unified cloud-native security platform centered on its open-source Kubescape project and commercial ARMO Platform. The architecture consists of the open-source Kubescape scanner (CNCF incubating project) as the foundational layer, with the commercial ARMO Platform providing enterprise-grade management, reporting, and support on top. The platform modules include Cloud Application Detection and Response (CADR) for runtime behavioral protection powered by eBPF, Kubernetes Security Posture Management (KSPM), Continuous CSPM with agentless scanning, Runtime-based Vulnerability Management with reachability analysis, Runtime-based Cloud Hardening and Remediation, Cloud-Native Security for AI Workloads, and On-Premises Kubernetes Security. The portfolio spans the full cloud security lifecycle from CI/CD scanning through runtime protection, with AI-specific capabilities for securing AI agents and orchestration infrastructure introduced in Kubescape 4.0.

Differentiator

Problem solved

Functional benefit

Brands

• Kubescape: Open-source Kubernetes security platform that scans configurations and clusters to identify vulnerabilities, providing security management features for DevOps-first Kubernetes security.
• ARMO Platform
• CADR (Cloud Application Detection & Response)

Products and services

• ARMO Platform Enterprise Kubernetes and cloud-native security platform hosted as SaaS or on-premises, powered by the open-source Kubescape scanner. Provides unified security spanning vulnerability management, KSPM, CSPM and runtime protection with full dashboards, RBAC visualization, automated compliance reporting and enterprise-grade premium support for DevOps and security teams.
• Kubescape Open-source Kubernetes security platform that scans configurations and clusters to identify vulnerabilities, supports multiple security frameworks (CIS, NSA-CISA, MITRE ATT&CK), and provides compliance scanning. CNCF Incubating project used by 40,000+ companies as the free foundation for Kubernetes and cloud-native security.
• Cloud Application Detection and Response (CADR) Runtime behavioral cloud application detection and response solution providing real-time threat detection and automatic response based on anomaly analysis powered by an eBPF sensor. Marketed as the first runtime behavioral CADR solution, enabling zero-day protection for cloud applications and integrating with the Rapid7 Command Platform via the Exposure Command Ultimate tier.
• Kubernetes Security Posture Management (KSPM) Security posture management for Kubernetes environments that reveals, prioritizes and remediates security issues while automating compliance for clusters, containers and workloads.
• Runtime-based Vulnerability Management Vulnerability management solution that prioritizes critical vulnerabilities using runtime reachability analysis and threat intelligence, reducing CVE-related work by 90%+ and integrating runtime signals to focus remediation effort on reachable exposures.
• Continuous Cloud Security Posture Management (CSPM) Continuous CSPM solution that detects, contextualizes and remediates cloud risks across multiple cloud providers using agentless scanning combined with runtime insights from the ARMO Platform.
• Runtime-based Cloud Hardening and Remediation Runtime hardening and automated remediation capabilities that continuously minimize cloud attack surface, with automatic response to detected security issues across cloud workloads.
• Cloud-Native Security for AI Workloads Security solution specifically designed for AI workloads running in Kubernetes, providing behavioral baselines, drift detection and runtime protection for AI agents and orchestration infrastructure.
• On-Premises Kubernetes Security Security solution for on-premises Kubernetes environments supporting sovereign cloud infrastructure with full data control, deployed for organizations with on-premises and air-gapped requirements such as Orange Business's managed Kubernetes services.

Quantifiable outcome

• 90%+ reduction in CVE-related work through runtime reachability prioritization
• +4 more outcomes

Named customers16 records

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration3 records

AI capability7 records

Feature7 records

Partnerships

Three partnerships are on record, tiered flagship and core.

• Rapid7flagshipStrategic or Co-development Partner · 14 January 2026Strategic partnership to integrate ARMO's Cloud Application Detection and Response (CADR) technology into Rapid7 Command Platform. The integration adds continuous anomaly detection and real-time threat detection across active cloud assets and workloads. ARMO's runtime security technology combined with Rapid7's exposure management platform provides unified security across application-level to cloud-level threats. Available through Rapid7's Exposure Command Ultimate suite.
• Orange BusinesscoreStrategic or Co-development Partner · 13 November 2024ARMO selected by Orange Business to secure its managed Kubernetes services. Partnership provides on-premises Kubernetes security for Orange Business customers with sovereign cloud infrastructure requirements and full data control. ARMO Platform supports sovereign cloud deployments with compliance including NIST, NSA-CISA, MITRE, and ARMO's own stringent baseline.
• Rapid7 (Integration Partnership)flagshipTechnology or IntegrationCloud Runtime Security integration with Rapid7 Exposure Command Ultimate through partnership with ARMO, announced Q1 2026

Scale indicators8 records

Recent moves7 records

Expansion highlights5 records

Direct peers

• Tigera (Calico): Tigera provides Kubernetes-native network security and observability through the Calico platform. Comparable in Kubernetes-first security positioning and overlap with ARMO's runtime and posture management for K8s environments.
• Snyk: Snyk offers developer security including container and Kubernetes security posture management as part of its broader platform. Comparable to ARMO's KSPM and vulnerability management capabilities, with a stronger PLG motion and developer-first brand.
• Lacework: Lacework offers a data-driven CNAPP with workload security, Kubernetes posture management, and runtime threat detection. Comparable to ARMO's CSPM, KSPM, and runtime capabilities with a behavior-based detection approach.
• Sysdig: Sysdig Secure provides Kubernetes security posture management, runtime threat detection (also based on eBPF/Falco), and vulnerability management. A direct peer given the shared eBPF-based runtime technology and Kubernetes-first security positioning.
• Orca Security: Orca Security provides agentless cloud security posture management, vulnerability management, and runtime threat detection across multi-cloud and Kubernetes environments. Comparable to ARMO's CSPM and runtime modules with a side-scanning approach.
• Aqua Security: Aqua Security is a dedicated cloud-native application protection platform (CNAPP) specializing in Kubernetes and container security. Directly comparable to ARMO across KSPM, container vulnerability scanning, and runtime protection, with overlapping target customers in DevOps and platform engineering teams.

Broad incumbents

• CrowdStrike Falcon Cloud Security: CrowdStrike's cloud security module provides agentless CSPM, container security, and runtime threat detection integrated into the Falcon platform. Comparable in runtime and Kubernetes security capabilities, with a much larger enterprise security footprint.
• Trend Micro Cloud One: Trend Micro Cloud One offers container and Kubernetes security among broader hybrid cloud security services. Comparable runtime and posture management capabilities, but as part of a long-established endpoint and cloud security vendor.
• Wiz: Wiz is a leading CNAPP platform offering agentless cloud security posture management, vulnerability management, and runtime threat detection across AWS, Azure, GCP, and Kubernetes. Directly comparable to ARMO's CSPM and KSPM capabilities, with a much broader cloud security portfolio and significantly larger scale.
• Palo Alto Prisma Cloud: Prisma Cloud is Palo Alto Networks' CNAPP platform covering CSPM, CWPP, KSPM, and runtime protection. Comparable to ARMO's full platform scope, but as part of a much broader enterprise security portfolio from a tier-1 incumbent.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/kubescape
• Xx.com/armosec

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles9 records

Funding overview

Funding rounds4 records

Investors5 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ARMO