Everything you need to audit,
prove, and defend.
One CLI. 55 security controls. PCI-DSS · SOC 2 · ISO 27001. Kafka 2.6 through 4.x — ZooKeeper and KRaft.
Continuous scanning
Run one-shot audits from the CLI, or wire KafkaGuard into CI / cron for continuous verification. Every run produces a structured, diffable report.
Compliance mapping
Every check is mapped to the controls auditors actually ask about. Every report includes PCI-DSS, SOC 2, and ISO 27001 requirement IDs alongside each finding.
Drift & alerting
Know the moment a cluster leaves its baseline. KafkaGuard stores scan history and notifies on meaningful deltas — not every restart.
Enterprise controls
For fleets and regulated industries: centralize scanning, enforce policy, and satisfy auditors without a 50-tab spreadsheet.
Apache Kafka 2.6 through 4.x — ZooKeeper and KRaft
Auto-detects your cluster mode. ZooKeeper controls skip automatically on KRaft clusters. No configuration required.
| Version range | Mode | Status | Notes |
|---|---|---|---|
| Kafka 2.6 – 3.8.x | ZooKeeper | Full support | 45 controls, ZK health checks included |
| Kafka 3.9.x | ZooKeeper or KRaft | Full support | Last ZK release; KRaft also detected |
| Kafka 4.0+ | KRaft (no ZooKeeper) | Full support | ZK controls auto-skip; 3 KRaft controls activate |
| Confluent Platform 7.x – 8.x | ZK or KRaft | Full support | CP version detected; KG-055 version consistency check |
Designed to work with Amazon MSK, Aiven, and Redpanda — any distribution based on Apache Kafka 2.6+ using the standard Kafka Admin API.
Every auth mode your cluster supports
Pass credentials via flags, environment variables, or a config file. No plaintext secrets in shell history.
Four output formats — one scan
Generate multiple formats in a single run. Regenerate any format later from stored scan JSON without re-scanning.
--sign-off "Name, Title") for audit sign-off requirements. Use kafkaguard report generate to regenerate any format from a stored scan.Common questions
Why not just use bash scripts + OPA?
Many teams try. Here's what DIY actually costs.
| Capability | Bash + OPA | KafkaGuard |
|---|---|---|
| Time to first security report | ❌ 2–3 weeks of engineering | ✅ 90 seconds |
| PCI-DSS / SOC 2 / ISO 27001 mapping | ❌ Manual — research each control | ✅ Built-in, pre-mapped |
| KRaft + ZooKeeper mode detection | ❌ Write it yourself | ✅ Automatic |
| SASL/SCRAM, mTLS, Kerberos auth | ❌ Implement each connector | ✅ All supported out of the box |
| PDF/HTML report for auditors | ❌ Build a report template | ✅ Generated automatically |
| Drift alerting (Slack / Teams) | ❌ Set up webhooks + cron | ✅ One flag: --alert-slack-webhook |
| Maintained as Kafka evolves | ❌ Your team's responsibility | ✅ We track every Kafka release |
| Cost | ❌ Engineering hours ($50k+/year) | ✅ From $0 (Community) |
Free Kafka Security Checklist
55 controls auditors check — mapped to PCI-DSS 4.0, SOC 2, and ISO 27001. Get the PDF free.
Used by 200+ platform and security engineers