Articles

Build a Container Security Maturity Roadmap with Aqua (2026)

April 16, 2026 5 min read

Aqua Security is a platform that helps organizations improve their container security posture. It offers a comprehensive suite of tools for vulnerability scanning, compliance, runtime protection, and more.

Here’s a breakdown of how you can build a container security maturity roadmap using Aqua Security:

Stage 1: Basic Visibility and Vulnerability Management

Goal: Understand what you have and what the immediate risks are.

  • What Aqua does: Aqua scans your container images for known vulnerabilities (CVEs) and misconfigurations in your Dockerfiles and Kubernetes manifests.
  • How to implement:
    1. Integrate with your CI/CD pipeline: Connect Aqua to your Jenkins, GitLab CI, GitHub Actions, etc.
      • Command Example (GitLab CI):
        stages:
  - build
  - scan
  - deploy

build_image:
  stage: build
  script:
    - docker build -t my-app:latest .
    - docker push my-app:latest

scan_image:
  stage: scan
  script:
    - aqua-scanner --host $AQUA_HOST --token $AQUA_TOKEN --image my-app:latest --output json > aqua-report.json
    - cat aqua-report.json # Review the report for critical/high vulnerabilities
  variables:
    AQUA_HOST: "your-aqua-server.example.com"
    AQUA_TOKEN: "your-aqua-api-token"
      • Why it works: This automatically scans images before they get deployed, providing early feedback to developers.
    2. Scan running workloads: Deploy Aqua’s node-scanner or kube-hunter to continuously scan images already deployed in your Kubernetes cluster.
      • Check: In the Aqua UI, navigate to "Images" and filter by "Scanned Date" to see what’s being analyzed.
      • Why it works: This catches images that might have bypassed CI/CD scans or whose vulnerabilities were discovered after deployment.
    3. Establish a baseline: Set policies to alert on critical and high vulnerabilities. Don’t block deployments yet, just get visibility.
      • Aqua Policy Example (UI): Create a new policy, set "Vulnerability Threshold" to "Critical" and "High," and enable "Alert Only."
      • Why it works: This avoids overwhelming developers with immediate blockers while allowing security teams to understand the scope of the problem.

Stage 2: Policy Enforcement and Drift Detection

Goal: Prevent insecure images from running and detect unauthorized changes.

  • What Aqua does: Aqua enforces policies to block deployments of vulnerable images and detects runtime drift (unexpected changes to running containers).
  • How to implement:
    1. Implement admission control: Configure Aqua’s admission controller (e.g., for Kubernetes) to block deployments that violate your vulnerability policies.
      • Aqua Admission Controller Config Snippet (Kubernetes):
        apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: aqua-admission-controller
webhooks:
  - name: aqua-admission-webhook.aqua.svc.cluster.local
    clientConfig:
      service:
        name: aqua-admission-service
        namespace: aqua
        path: "/v1/admission/pods"
      caBundle: "YOUR_CA_BUNDLE"
    rules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
        resources: ["pods"]
      • Why it works: This acts as a gatekeeper, preventing insecure containers from entering your environment.
    2. Define compliance benchmarks: Use Aqua’s built-in CIS benchmarks for Docker and Kubernetes to ensure your infrastructure adheres to security best practices.
      • Aqua Policy Example (UI): Enable the "CIS Docker Benchmark" and "CIS Kubernetes Benchmark" compliance checks within a policy.
      • Why it works: This standardizes your environment and reduces the attack surface by enforcing known good configurations.
    3. Enable runtime drift detection: Configure Aqua to monitor running containers for unauthorized file modifications, process executions, or network connections.
      • Aqua Runtime Policy Example (UI): Create a runtime policy that alerts on "File Integrity Monitoring" violations or "Unexpected Process Execution."
      • Why it works: This catches in-progress attacks or insider threats that exploit running applications.

Stage 3: Advanced Runtime Protection and Threat Detection

Goal: Proactively defend against active threats and detect sophisticated attacks.

  • What Aqua does: Aqua provides advanced runtime protection, including behavioral analysis, malware scanning, and threat intelligence integration.
  • How to implement:
    1. Deploy Aqua’s Runtime Protection agent: Install the agent on your worker nodes to monitor container behavior in real-time.
      • Kubernetes DaemonSet Snippet (Aqua Agent):
        apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: aqua-agent
  namespace: aqua
spec:
  selector:
    matchLabels:
      app: aqua-agent
  template:
    metadata:
      labels:
        app: aqua-agent
    spec:
      containers:
        - name: aqua-agent
          image: aquasec/aqua-agent:latest
          securityContext:
            privileged: true
          volumeMounts:
            - name: host-os
              mountPath: /host
      hostNetwork: true
      hostPID: true
      • Why it works: The agent has deep visibility into the host OS and container activity, allowing for sophisticated threat detection.
    2. Configure behavioral anomaly detection: Set up Aqua to learn normal container behavior and alert on deviations.
      • Aqua Runtime Policy Example (UI): Enable "Behavioral Anomaly Detection" and fine-tune baselines for critical applications.
      • Why it works: This can detect zero-day exploits or novel attack techniques that don’t match known signatures.
    3. Integrate with SIEM/SOAR: Forward Aqua’s alerts and events to your Security Information and Event Management (SIEM) or Security Orchestration, Automation, and Response (SOAR) platform for centralized monitoring and automated response.
      • Check: In Aqua UI, go to "Settings" -> "Integrations" and configure your SIEM (e.g., Splunk, QRadar) or SOAR (e.g., Palo Alto XSOAR, Splunk Phantom) connection.
      • Why it works: This consolidates security data and enables faster, more coordinated incident response.

Stage 4: Cloud-Native Application Protection Platform (CNAPP) and Governance

Goal: Achieve a holistic view of cloud-native security and mature governance.

  • What Aqua does: Aqua consolidates vulnerability management, compliance, runtime security, and cloud security posture management (CSPM) into a single platform.
  • How to implement:
    1. Extend to cloud infrastructure scanning: Use Aqua to scan your cloud accounts (AWS, Azure, GCP) for misconfigurations in services like S3 buckets, IAM roles, and network security groups.
      • Aqua CSPM Configuration Example (UI): Navigate to "Cloud Accounts," add your cloud provider credentials, and enable "Cloud Security Posture Management."
      • Why it works: This provides a unified view of security risks across your containerized applications and the underlying cloud infrastructure.
    2. Automate compliance reporting: Generate reports for regulatory compliance (e.g., PCI DSS, HIPAA, SOC 2) based on Aqua’s scan data.
      • Aqua Report Example (UI): Go to "Reports" -> "Compliance Reports" and select your desired framework.
      • Why it works: This significantly reduces the manual effort required for audits and compliance checks.
    3. Implement granular RBAC: Define roles and permissions within Aqua to ensure only authorized personnel can view or modify security policies.
      • Aqua RBAC Example (UI): Go to "Users & Access" -> "Roles" and create custom roles with specific permissions (e.g., "Image Scanner," "Runtime Analyst").
      • Why it works: This enforces the principle of least privilege and strengthens your overall security governance.

The next challenge you’ll face is integrating Aqua’s findings with your broader DevSecOps workflows to automate remediation and continuous improvement.

Want structured learning?

Take the full Aqua course →