Summary
cnspec is an open-source security and compliance scanner from Mondoo. It evaluates infrastructure against policies expressed as code—security benchmarks, hardening guides, and compliance controls—and reports clear pass/fail results, which fits continuous checks in CI/CD pipelines.
What is cnspec?
cnspec applies policy-as-code across multiple layers: operating systems and VMs (for example CIS benchmarks), Docker runtimes, container images, and application dependencies. It can scan running systems, cloud accounts, and Kubernetes clusters, and integrates into build pipelines—including a Packer plugin that scans golden images during the build itself.
Built on the same engine as cnquery, cnspec turns discovery into enforcement: cnquery asks open questions, cnspec asserts that defined controls hold and flags drift over time. This makes it a practical instrument for automating the technical checks behind regulatory requirements—such as aspects of NIS2 or EU AI Act compliance—in CI/CD rather than leaving them as documentation. Mondoo was founded by the creator of InSpec, and cnspec continues that lineage of executable compliance.
Why is cnspec relevant?
- Policy as code: Security and compliance controls become versioned, testable, and automatable
- Continuous compliance: Pass/fail checks run in CI/CD and detect drift, not just point-in-time audits
- Multi-layer coverage: OS, cloud, containers, images, and Kubernetes in one tool
- Supports compliance work: Automates technical checks relevant to NIS2 and EU AI Act compliance in the delivery pipeline