Tool profile
Red Hat Advanced Cluster Security: cost, fit and limits
Red Hat Advanced Cluster Security for Kubernetes is a container and cluster security product from Red Hat, part of IBM, that scans images, checks Kubernetes configuration and compliance, simulates network policy and detects runtime threats with eBPF.
What to know first
Red Hat Advanced Cluster Security is bundled with Red Hat OpenShift Platform Plus and can also run as a managed cloud service bought through AWS Marketplace. The datasheet lists vulnerability management, compliance checks, network segmentation, runtime detection and configuration risk profiling. No prices or tiers appear on the pages read, and a 60-day self-supported trial is offered, so most buyers meet it through an OpenShift subscription.
Red Hat Advanced Cluster Security at a glance
| Maker | Red Hat, United States |
|---|---|
| Free plan | Free trial only |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI Container Security Software in 2026, rank 8 of 10 |
| Website | redhat.com |
Who Red Hat Advanced Cluster Security is best for
OpenShift operators
Because the product is included with OpenShift Platform Plus, a team already on that subscription can turn on image scanning and runtime detection without a separate vendor contract.
Teams auditing cluster compliance
The datasheet lists checks for CIS, PCI, NIST SP 800-53, DISA STIG and NERC-CIP, with exportable evidence for auditors and scheduled scans for recurring reviews.
GitOps shops
Policies can be defined as Kubernetes custom resources through Red Hat GitOps and Argo CD, so security rules go through the same review path as application manifests.
Red Hat Advanced Cluster Security plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| OpenShift Platform Plus | Bundled, price not shown | Advanced Cluster Security is included with this Red Hat OpenShift subscription, according to the product page, and no separate price is printed. |
| Managed cloud service | Via AWS Marketplace, price not shown | A fully managed SaaS delivery of the product, purchasable through AWS Marketplace, with no tiers or amounts listed on the pages read. |
| Self-managed | Quote only | Runs in your own Kubernetes infrastructure, with documentation linked from the product page. Subscription tiers are not described. |
| 60-day trial | $0 | A self-supported trial lasting 60 days is offered on the product page, with no support from Red Hat during the period. |
Checked November 2026.
What Red Hat Advanced Cluster Security does
- Vulnerability management
- The product scans container and VM images, host-level issues in Red Hat Enterprise Linux CoreOS, repositories and pipelines, ranks the riskiest findings and can enforce policy at build, deploy and runtime.
- Runtime detection with eBPF
- Runtime events are captured with eBPF and without sidecars, mapped to MITRE ATT&CK for Containers, with process allowlists and non-destructive automated responses, so analysts see events tied to known attack techniques.
- Network segmentation
- The console visualizes allowed versus active traffic, flags forbidden connections and can simulate a network policy change before it is deployed to the cluster, which lowers the risk of blocking legitimate traffic.
- AI workload guardrails
- Red Hat describes guardrails across clusters meant to keep AI and agent workloads from damaging or reaching sensitive systems. The product page itself described no AI assistant for the security console.
How Red Hat Advanced Cluster Security handles your data
The product pages read do not state where the managed cloud service stores data, which certifications cover it or whether customer data is used for AI. They say the service is offered as managed SaaS and through AWS Marketplace. The self-managed option runs inside your own Kubernetes infrastructure, which keeps scan results in your environment. Red Hat's company page states it is headquartered in Raleigh, North Carolina and part of IBM since 2019. Retention, regions, sub-processors and AI training: the vendor's policy was not checked for this, so ask Red Hat for the data processing terms of the managed service.
Where Red Hat Advanced Cluster Security falls short in practice
- Best value on OpenShift. The bundle logic favors OpenShift Platform Plus customers. A team on EKS, GKE or AKS without OpenShift has to buy separately and may find fewer ready-made integrations.
- No prices on the pages. The product page and datasheet list no tiers or amounts, and the documentation pages returned an access error during our read. Plan a sales conversation before budgeting.
- AI is light. The pages describe AI workload guardrails but no assistant, agent or model-driven triage for the console, so buyers who want AI help with findings should check the roadmap.
Works with
Alternatives to Red Hat Advanced Cluster Security
Red Hat Advanced Cluster Security: common questions
Is Advanced Cluster Security included with OpenShift?
The product page says it is included with Red Hat OpenShift Platform Plus. It is also offered as a cloud service through AWS Marketplace. Check which OpenShift edition you hold, because lower editions may not include it and the pages read give no standalone price.
How does Red Hat detect threats at runtime?
The datasheet says runtime detection uses eBPF to capture system-level events without sidecars, maps detections to MITRE ATT&CK for Containers, builds process allowlists and supports non-destructive automated responses. A kernel and platform compatibility check is still prudent before rollout, since eBPF depends on kernel support.
Can I try Advanced Cluster Security before buying?
Yes. Both pages mention a 60-day, self-supported free trial. Self-supported means no vendor help during the period, so assign an engineer who can deploy the components and test image scanning, admission policies and runtime detection against a non-production cluster during those 60 days.
Which compliance frameworks does it check?
The datasheet lists CIS, PCI, NIST SP 800-53, DISA STIG and NERC-CIP, with evidence export and scheduled scans for auditors. A product check is not a certification of your cluster, so map each control to your own evidence process and review.
Does it work without OpenShift?
The pages describe Kubernetes clusters in general, plus self-managed and SaaS delivery, but they stress OpenShift and Red Hat Enterprise Linux CoreOS. Support for other distributions was not detailed, so confirm your Kubernetes distribution and version with Red Hat before committing.