Security Posture Assessment
Rate each control area. The assessment scores overall maturity, highlights the weakest domains, and produces a prioritized remediation roadmap — computed locally, no data leaves your browser.
01Is Kubernetes RBAC scoped to least privilege (no cluster-admin for workloads/teams)?
02Do workloads use short-lived, scoped identities rather than static shared credentials?
03Are default-deny network policies applied with explicit allow-lists and restricted egress?
04Is the restricted Pod Security Standard enforced (no privileged pods / hostPath)?
05Is policy-as-code admission control enforcing image and resource policy?
06Are container images signed, scanned, pinned by digest, and verified at admission?
07Is model/dataset provenance tracked and are artifacts scanned before serving?
08Do RAG/agent workloads have guardrails against prompt injection and unsafe tool use?
09Are secrets stored in a managed vault (never in images/manifests) and rotated?
10Is data encrypted in transit and at rest (volumes, object storage, etcd)?
11Are tenants isolated at namespace/node/GPU level, with GPU memory handled safely?
12Is runtime threat detection deployed (including GPU-abuse / crypto-mining)?
13Are images, drivers, and OS continuously scanned and patched on an SLA?
14Is API audit logging enabled with immutable, correlated retention?
15Are GPU nodes hardened to a CIS baseline with secured BMC/firmware?
16Do you have tested incident-response runbooks and recovery procedures?