Deepfence ThreatMapper

Deepfence ThreatMapper is a free, self-hosted platform for teams securing container, cloud and on-premise workloads. It suits Linux-centered security programs that want discovery, scanning and prioritization in one console. The trade-off is operating the platform yourself, with Windows Server support still unsuitable for production.

Overview

ThreatMapper discovers pods, containers, applications and infrastructure, mapping topology and attack surface while ranking threats by exploit risk. Its Threat Graph connects vulnerabilities, exposed secrets and compliance findings to live and recent network flows, security groups and current status. That relationship helps security teams focus remediation on issues with plausible exposure instead of treating every alert as equally urgent.

The management console runs as containers on a Docker host or dedicated Kubernetes cluster and provides HTTPS administration plus API automation. One console can manage multiple workload types across cloud and on-premise deployments, a useful arrangement for mixed estates. The self-hosted model, however, makes infrastructure operation part of the product decision.

Key features

Discovery, SBOMs and exposure

Runtime SBOMs cover running pods, containers, serverless applications, applications and operating systems, with matching against multiple vulnerability feeds. Image-build scanning supports CircleCI, Jenkins and GitLab, extending checks into CI/CD rather than waiting for deployment. Secret detection searches containers and host filesystems for exposed keys, tokens and passwords.

Context and controls

Configuration checks evaluate CIS, PCI-DSS, HIPAA and other compliance benchmarks. The Threat Graph adds network and security-group context to those results, while live status helps distinguish active conditions from stale findings. Integrations with Slack, PagerDuty, Jira, Splunk, ELK, Sumo Logic and AWS S3 can connect findings to existing notification, ticketing and logging workflows.

Deployment and sensors

Sensor agents communicate with the console over TLS using a URL and API key. Each sensor requires 0.2 CPU cores, 200 MB to 1 GB of RAM, Linux kernel 4.4 or newer and access to console port 443. Cloud Scanner tasks run locally through Terraform modules, typically use read-only cloud API access, and do not listen for remote connections or control them. Windows Server support is experimental and should not be used for production workloads.

Pricing

ThreatMapper costs free under its sole ThreatMapper plan, with no limits and no hidden features. The free plan includes image scanning, runtime protection, Kubernetes security, registry scanning and SBOM generation. There is no paid tier to add capacity or vendor support, so it is especially compelling for teams able to run open-source infrastructure and accept community-based assistance.

The Apache 2 license permits self-hosted use, while support is provided through GitHub issues and the Deepfence Community Slack channel. Organizations wanting a contracted support arrangement or a managed service should look elsewhere.

Platforms

ThreatMapper is delivered as a self-hosted deployment with API and web access. It runs across Linux-based environments and supports cloud and on-premise workloads from one console. The console requires Docker or a dedicated Kubernetes cluster; sensor requirements are Linux-specific. Windows is supported experimentally only, making the platform a poor production fit for Windows Server estates.

Who it's for

Choose ThreatMapper if your security team manages Kubernetes, containers, serverless applications or mixed cloud and on-premise infrastructure and wants vulnerability, secret and compliance findings prioritized together. It is also a strong fit for organizations that can operate a Docker or Kubernetes-hosted console and connect alerts to existing engineering tools.

It is less suitable for teams seeking a vendor-hosted service, hands-off deployment or dependable Windows Server coverage. The sensor resource and kernel requirements also need to be checked across every Linux workload before rollout.

Pros and cons

Pro: One unlimited free plan combines discovery, runtime SBOMs, vulnerability matching, secret detection and compliance checks.

Pro: Threat Graph correlation adds network-flow, security-group and live-status context to remediation decisions.

Pro: A single console spans multiple workload types and cloud and on-premise deployments.

Pro: CI/CD scanning and broad integrations can feed findings into established build, ticketing and incident workflows.

Con: Self-hosting requires a Docker host or dedicated Kubernetes cluster and ongoing operational ownership.

Con: Sensor deployment depends on Linux kernel 4.4+, defined CPU and memory, and access to port 443.

Con: Experimental Windows Server support rules it out for production Windows coverage.

Con: Support is community-based through GitHub and Slack rather than a paid support plan.

Alternatives

For a broader category comparison, see Container Security Software.

Docker Desktop is a better choice when a freemium developer tool spanning Linux, macOS, Windows and web matters more than ThreatMapper's cross-estate risk graph; its Personal plan is free and Pro costs $9 a month.

Qualys External Attack Surface Management suits teams wanting a commercial external-attack-surface service with a 30-day free trial rather than a permanently free self-hosted console.

Snyk Open Source is preferable for teams focused on software-composition analysis with a hosted freemium workflow; its free plan allows five projects, while Team costs $25 a month.

Kubescape is a focused open-source Kubernetes option with a CLI and operator under Apache 2.0. Trivy and Grype are free open-source vulnerability scanners for teams that need scanning rather than an integrated management console. Kyverno is an Apache 2.0 policy project for teams prioritizing Kubernetes policy enforcement. RapidFort fits teams seeking curated, rebuilt container images; its free plan covers five near-zero-CVE images from a limited catalog.

Verdict

ThreatMapper is a strong choice for Linux-oriented teams that want broad, risk-ranked security coverage at no license cost and can run their own console. Its main reason to choose it is the combination of workload mapping, runtime SBOMs, secrets, compliance and threat correlation in one deployment. Look elsewhere if you need production-grade Windows Server support, managed hosting or contract-backed support.