AppSecNews

IaC Security

Infrastructure as Code Security

Catch misconfigurations in Terraform, Kubernetes manifests and cloud templates before deploy.

17 tools profiled

How it differs Scans Terraform, Kubernetes manifests and other infrastructure definitions before they are applied. Scanning the built images is container security.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

10 tools match

Active Self hosted Clear all

  • Checkov

    Prisma Cloud (Palo Alto Networks), originally Bridgecrew

    IaC Security

    A Python-based static analyzer that parses infrastructure as code into a graph and checks it against built-in and custom misconfiguration policies.

    Open source
    Established Verified

  • Falco

    The Falco Project (CNCF)

    IaC Security

    A CNCF runtime security engine that taps Linux kernel syscalls with eBPF and raises alerts when activity matches a rule.

    Open source
    Established

  • KICS

    Checkmarx

    IaC Security

    An open-source scanner from Checkmarx that parses many infrastructure formats into a common model and evaluates Rego queries against it.

    Open source
    Established Verified

  • KubeArmor

    AccuKnox (CNCF project)

    IaC Security

    A CNCF runtime security engine that uses Linux security modules and eBPF to block, not just alert on, disallowed behavior inside workloads.

    Open source
    Growing

  • Kubescape

    ARMO (CNCF project)

    IaC Security

    A CNCF tool that scans Kubernetes clusters and manifests against control frameworks such as NSA-CISA hardening guidance and CIS benchmarks.

    Open source
    Growing Verified

  • Checkov

    Prisma Cloud (Palo Alto Networks), originally Bridgecrew

    A Python-based static analyzer that parses infrastructure as code into a graph and checks it against built-in and custom misconfiguration policies.

    Open source Established
    IaC Security

  • Falco

    The Falco Project (CNCF)

    A CNCF runtime security engine that taps Linux kernel syscalls with eBPF and raises alerts when activity matches a rule.

    Open source Established
    IaC Security

  • KICS

    Checkmarx

    An open-source scanner from Checkmarx that parses many infrastructure formats into a common model and evaluates Rego queries against it.

    Open source Established
    IaC Security

  • KubeArmor

    AccuKnox (CNCF project)

    A CNCF runtime security engine that uses Linux security modules and eBPF to block, not just alert on, disallowed behavior inside workloads.

    Open source Growing
    IaC Security

  • Kubescape

    ARMO (CNCF project)

    A CNCF tool that scans Kubernetes clusters and manifests against control frameworks such as NSA-CISA hardening guidance and CIS benchmarks.

    Open source Growing
    IaC Security

  • Prisma Cloud

    Palo Alto Networks

    IaC Security

    Palo Alto Networks' cloud-native application protection platform, spanning posture management, workload defense, IaC scanning and code-to-cloud tracing.

    Commercial
    Established

  • Sysdig Secure

    Sysdig

    IaC Security

    A commercial cloud and container security platform built on Falco, combining runtime detection with posture, vulnerability management and capture-based forensics.

    Commercial
    Established

  • Terrascan

    Tenable

    IaC Security

    A Go-based static analyzer for infrastructure as code that normalizes multiple formats and evaluates them against Rego policies.

    Open source
    Established

  • tfsec

    Aqua Security

    IaC Security

    A Terraform-specific static analyzer that evaluates HCL against cloud misconfiguration checks, now consolidated into Aqua's Trivy.

    Open source
    Established

  • Trivy

    Aqua Security

    IaC Security

    An open-source scanner that finds vulnerabilities, misconfigurations, secrets and license issues across container images, filesystems, repositories and IaC.

    Open source
    Established Verified

  • Prisma Cloud

    Palo Alto Networks

    Palo Alto Networks' cloud-native application protection platform, spanning posture management, workload defense, IaC scanning and code-to-cloud tracing.

    Commercial Established
    IaC Security

  • Sysdig Secure

    Sysdig

    A commercial cloud and container security platform built on Falco, combining runtime detection with posture, vulnerability management and capture-based forensics.

    Commercial Established
    IaC Security

  • Terrascan

    Tenable

    A Go-based static analyzer for infrastructure as code that normalizes multiple formats and evaluates them against Rego policies.

    Open source Established
    IaC Security

  • tfsec

    Aqua Security

    A Terraform-specific static analyzer that evaluates HCL against cloud misconfiguration checks, now consolidated into Aqua's Trivy.

    Open source Established
    IaC Security

  • Trivy

    Aqua Security

    An open-source scanner that finds vulnerabilities, misconfigurations, secrets and license issues across container images, filesystems, repositories and IaC.

    Open source Established
    IaC Security
Tick up to 4 tools above.