Everything you need to audit,
prove, and defend.
One CLI. 54 security controls. PCI-DSS · SOC 2 · ISO 27001. Kafka 2.6 through 4.x — ZooKeeper and KRaft.
Continuous scanning
Run one-shot audits from the CLI, or wire KafkaGuard into CI / cron for continuous verification. Every run produces a structured, diffable report.
Compliance mapping
Every check is mapped to the controls auditors actually ask about. Every report includes PCI-DSS, SOC 2, and ISO 27001 requirement IDs alongside each finding.
Drift & alerting
Know the moment a cluster leaves its baseline. KafkaGuard stores scan history and notifies on meaningful deltas — not every restart.
Enterprise controls
For fleets and regulated industries: centralize scanning, enforce policy, and satisfy auditors without a 50-tab spreadsheet.
Apache Kafka 2.6 through 4.x — ZooKeeper and KRaft
Auto-detects your cluster mode. ZooKeeper controls skip automatically on KRaft clusters. No configuration required.
| Version range | Mode | Status | Notes |
|---|---|---|---|
| Kafka 2.6 – 3.8.x | ZooKeeper | Full support | 44 controls, ZK health checks included |
| Kafka 3.9.x | ZooKeeper or KRaft | Full support | Last ZK release; KRaft also detected |
| Kafka 4.0+ | KRaft (no ZooKeeper) | Full support | ZK controls auto-skip; 3 KRaft controls activate |
| Confluent Platform 7.x – 8.x | ZK or KRaft | Full support | CP version detected; KG-055 version consistency check |
Designed to work with Amazon MSK, Aiven, and Redpanda — any distribution based on Apache Kafka 2.6+ using the standard Kafka Admin API.
Every auth mode your cluster supports
Pass credentials via flags, environment variables, or a config file. No plaintext secrets in shell history.
Four output formats — one scan
Generate multiple formats in a single run. Regenerate any format later from stored scan JSON without re-scanning.
--sign-off "Name, Title") for audit sign-off requirements. Use kafkaguard report generate to regenerate any format from a stored scan.