Malware scanning for every container in your cluster
Deploy once as a DaemonSet. Scan every pod automatically.Stay compliant with FedRAMP, CMMC, NIST 800-53, SOC 2, ISO 27001, PCI DSS v4.0, and ISMAP.
What is Guardimesh?
Guardimesh is a container malware scanner for Kubernetes and OpenShift that deploys as a DaemonSet on every node in your cluster. It scans running containers at the point of entry — the node where images are pulled — using ClamAV with custom signatures. Guardimesh detects malware, fileless payloads, executable drift, and obfuscated binaries without modifying application code. Pricing starts at $29 per month for up to 3 nodes, with a 7-day free trial requiring no credit card. It supports air-gapped deployments for disconnected environments and is built with FIPS 140-3 certified cryptographic modules.
How It Works
From deployment to compliance report in three steps.
Deploy
Install the Guardimesh operator on your cluster with a single Helm command. No sidecars, no service mesh required.
Scan
Every new pod is scanned automatically. Schedule recurring scans for long-running workloads. Detect malware, drift, and runtime anomalies.
Review
View findings in the web console. Download compliance reports. Set up alerts when threats are detected.
Why Guardimesh
Automated malware detection for Kubernetes clusters, from single-node development environments to multi-region production deployments.
Compliance Ready
Meet FedRAMP High, DoD CMMC, NIST 800-53 SI-3, SOC 2, ISO 27001, PCI DSS v4.0, CIS v8, and ISMAP antivirus scanning requirements. Scans containers at the point of entry — the node where images are pulled — with audit-ready compliance reports.
Real-Time Reporting
View scan results per cluster and namespace. Push alerts to PagerDuty and Slack in real time. Export reports for audit evidence.
Full Audit Trail
Track every container creation, scan result, and signature update with timestamped, relational logs retained for up to 180 days.
Deploy Once, Scan Everywhere
Install a single DaemonSet across Kubernetes, OpenShift, or GKE. Configure scan schedules and custom signatures from one central console.
Compatibility
Compatible with OCI-compliant container runtimes using the overlay filesystem. Supports both AMD64 and ARM64 architectures, including:
cri-o
Docker
Kubernetes
OpenShift
Podman
Google Kubernetes Engine
Amazon EKS
Azure AKS
Compliance Frameworks
Guardimesh scans containers at the point of entry — the node where images are pulled — satisfying NIST SI-3 malware protection requirements for FedRAMP, CMMC, and global compliance programs.
Pricing
Choose the plan that best fits your container security needs.
Start with a 7-day free trial on any plan. No credit card required.
Individual
Multi-node scanning for individual developers and small projects.
$29/month
Sign Up- Up to 3 nodes
- 90 days log retention
- Email support
- Basic reports
Startup
Multi-node scanning with real-time monitoring for startups.
$99/month
Sign Up- Up to 5 nodes
- 90 days log retention
- Real-time file monitoring
- Priority email support
- Advanced reports
- PagerDuty and Slack integration
Team
Production-grade scanning with advanced reporting for teams.
$349/month
Sign Up- Up to 25 nodes
- 180 days log retention
- Real-time file monitoring
- Priority email support
- Advanced reports
- Custom signatures
- All integrations
Enterprise
Unlimited nodes with dedicated support and SLA guarantee.
Contact us
Contact Sales- Unlimited nodes
- Customizable log retention
- Real-time file monitoring
- Dedicated support
- Custom integrations
- SLA guarantee
- On-premise and air-gap deployment
- FIPS 140-3 and FedRAMP High ready