There is also an implementation difference between the two, while KubeBench requires installation within the cluster, Kubescape runs as CLI from any computer using Kube API, so it can be added to any CI/CD pipeline very easily, also the latest version enables you to scan YAML files before you deploy them so you know early on whether you are compliant.

CIS is very prescriptive. It gives you a list of very specific checks with very little context. NSA, on the other hand, explains the problems and potential attack vectors allowing you to adjust and extend the checks to your specific needs.

The NSA doesn't really do a full coverage of Kubernetes security hardening, but does touch on a lot of the same ground as the CIS benchmark.

It also covers some areas that aren't in-scope of the CIS benchmark, at a high level.