Nirmata

• The organization is not using Kyverno and does not plan to adopt it; Nirmata’s primary value is Kyverno-native governance.
• The primary requirement is a full CNAPP with runtime threat detection and response; vendors such as Prisma Cloud, Aqua, and Sysdig may be more appropriate.
• Procurement requires extensive peer reviews on public review platforms; Nirmata has limited public review volume in accessible sources.
• The buyer needs transparent self-serve pricing for enterprise features; Nirmata’s Control Hub and many enterprise features are quote-based.
• The requirement is only basic IaC scanning without runtime admission control or multi-cluster governance; simpler IaC-focused tools may be more appropriate.

• Relationship to Kyverno: Nirmata is identified in vendor materials as a creator and maintainer of Kyverno; this may provide influence over the Kyverno roadmap and product alignment for enterprise needs.
• Enterprise Kyverno distribution (referred to in vendor materials as N4K): vendor documentation references long-term support windows (for example, an 18-month LTS) and security hardening options for paid tiers.
• Centralized governance layer (Control Hub): features include multi-cluster policy and exception management, centralized compliance reporting, and workflow integrations with ITSM and source control systems.
• AWS Marketplace availability and PAYG pricing: an AWS Marketplace listing provides a node/hour price for Enterprise Kyverno in a pay-as-you-go model.

Independent review platform coverage was limited in the retrieved sources; commonly used review platforms did not surface clearly accessible product review pages during the searches performed. This pattern can occur with niche infrastructure tooling or enterprise-direct sales models.

This section therefore draws on:

• Vendor-supplied testimonials (subject to vendor bias)
• Aggregated analyst/review portal signals where available
• Marketplace signals from public marketplace listings

• A gaming company (vendor testimonial): the vendor-supplied anecdote described a very fast onboarding experience, citing an onboarding window measured in hours. This is a single-customer anecdote; onboarding times vary with environment complexity.
• A large healthcare organization (vendor materials): vendor materials include a customer quote stating a meaningful reduction in notification alerts. The underlying methodology and baseline are not provided in public materials.

Nirmata provides Kubernetes-native governance, security, and compliance automation using Policy-as-Code (PaC) built on Kyverno (a CNCF policy engine created and maintained by Nirmata). Its commercial offerings focus on:

• Enterprise Kyverno distribution and lifecycle operations (hardening, LTS, performance tuning, CVE SLAs)
• Centralized multi-cluster policy management and reporting (Control Hub)
• Shift-left scanning and remediation workflows via a CLI (nctl) that can scan IaC artifacts and publish results
• An AI-assisted workflow to assist in generating and validating policies and proposing fixes

Nirmata positions itself primarily as an enterprise-focused provider for Kyverno operations, centralized governance, and workflow automation rather than a general-purpose CSPM.

Official vendor positioning is that the product writes, runs, and validates policy-as-code across infrastructure and aims to reduce mean time to repair and security risk while improving audit readiness. Vendor-stated performance metrics (for example, messages citing reductions in MTTR) are presented without public methodology and should be treated as directional claims rather than independently verified results.

• Primary buyers: Platform Engineering, DevSecOps, Security Engineering, Cloud Center of Excellence
• Primary environments: Kubernetes-heavy organizations (EKS/AKS/GKE/OpenShift/Rancher/on-prem)
• Typical scenarios: Organizations that have standardized, or plan to standardize, on Kyverno and require an enterprise control plane, multi-cluster governance, reporting, exception workflows, and support.

Nirmata distinguishes its focus from CSPM by concentrating on workload configuration inside Kubernetes clusters using admission control and policy enforcement; CSPM typically targets cloud account and infrastructure posture.