CNCF CKS-Certified Kubernetes Security, Explained
The CNCF Certified Kubernetes Security Specialist (CKS) is the only major hands-on certification for cluster security: a performance exam against live clusters covering hardening, admission control, minimization, and runtime security.
It is the strongest purchasable signal for cluster security competence, which is why the directory counts holders per firm rather than accepting certification logos.
What renders on this page
- ▸Documented CKS staff counts per firm, updated in real time
- ▸Infrastructure-as-Code (IaC) scanning capabilities (Terraform, Helm)
- ▸Runtime security tool support (Falco, eBPF: Tetragon, Tracee)
- ▸Platform matrices, EKS, GKE, AKS, self-managed
- ▸"Request Secure RFP" form pre-wired to the Cloud-Native RFP template
What the CKS exam tests
Cluster setup with CIS Benchmark hardening, admission control configuration, system component minimization, and runtime security monitoring, performed, not multiple-choice. A firm with eight CKS holders can put certified engineers on your engagement on any given week; a firm with one cannot.
IaC scanning as audit surface
Your cluster configuration is mostly your Infrastructure-as-Code. Firms that audit Terraform and Helm directly (misconfigurations, privilege escalations, stale module versions) find issues before they schedule, at a fraction of runtime incident cost.
Runtime security support that matters
Falco rules tuned to your workloads, eBPF-based telemetry (Tetragon, Tracee) where syscall-level truth is required, and Cilium where network policy needs enforcement at the kernel. The tooling matrix records which firms deploy which, and whether case evidence shows them used in real incidents.
Find CKS-certified firms
The cloud-native vertical page aggregates firms with documented CKS staff counts, filtered by platform and specialty. The procurement page for CNCF CKS audits lists firms with IaC and runtime tooling in one view.
Frequently asked questions
How hard is the CKS exam?
It is a two-hour performance exam with a high failure rate on first attempt, which is precisely why holder counts signal competence. Candidates must already hold CKA to sit it.
Does CKS cover managed Kubernetes?
The exam runs against kubeadm clusters, but the domains (hardening, admission, minimization, runtime) transfer directly to EKS, GKE, and AKS. Managed-platform differences are why the directory also tracks platform experience separately from certification.
CKS-certified staff versus a CKS-certified firm, what is the difference?
CNCF certifies individuals, not companies. A firm claiming CKS certification means nothing without holder counts. The directory lists named holders per firm so the claim is checkable.
What does a CKS-staffed security audit cost?
Verified firms run $300–$400+/hour senior rates; a scoped cluster audit typically lands mid four to five figures depending on node count and platform spread. The RFP template captures cluster facts so quotes compare cleanly.