AppSecNews

IaC Security

Infrastructure as Code Security

Catch misconfigurations in Terraform, Kubernetes manifests and cloud templates before deploy.

17 tools profiled

How it differs Scans Terraform, Kubernetes manifests and other infrastructure definitions before they are applied. Scanning the built images is container security.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

6 tools match

Active Prometheus Clear all

  • Falco

    The Falco Project (CNCF)

    IaC Security

    A CNCF runtime security engine that taps Linux kernel syscalls with eBPF and raises alerts when activity matches a rule.

    Open source
    Established

  • KubeArmor

    AccuKnox (CNCF project)

    IaC Security

    A CNCF runtime security engine that uses Linux security modules and eBPF to block, not just alert on, disallowed behavior inside workloads.

    Open source
    Growing

  • Kubescape

    ARMO (CNCF project)

    IaC Security

    A CNCF tool that scans Kubernetes clusters and manifests against control frameworks such as NSA-CISA hardening guidance and CIS benchmarks.

    Open source
    Growing Verified

  • Falco

    The Falco Project (CNCF)

    A CNCF runtime security engine that taps Linux kernel syscalls with eBPF and raises alerts when activity matches a rule.

    Open source Established
    IaC Security

  • KubeArmor

    AccuKnox (CNCF project)

    A CNCF runtime security engine that uses Linux security modules and eBPF to block, not just alert on, disallowed behavior inside workloads.

    Open source Growing
    IaC Security

  • Kubescape

    ARMO (CNCF project)

    A CNCF tool that scans Kubernetes clusters and manifests against control frameworks such as NSA-CISA hardening guidance and CIS benchmarks.

    Open source Growing
    IaC Security

  • Kyverno

    The Kyverno Project (CNCF)

    IaC Security

    A Kubernetes-native policy engine that enforces, mutates and generates resources through admission webhooks, with policies written as YAML.

    Open source
    Established Verified

  • OPA Gatekeeper

    Open Policy Agent (CNCF)

    IaC Security

    The Kubernetes admission controller for Open Policy Agent, packaging Rego policies as reusable constraint templates and cluster-scoped constraints.

    Open source
    Established Verified

  • Sysdig Secure

    Sysdig

    IaC Security

    A commercial cloud and container security platform built on Falco, combining runtime detection with posture, vulnerability management and capture-based forensics.

    Commercial
    Established

  • Kyverno

    The Kyverno Project (CNCF)

    A Kubernetes-native policy engine that enforces, mutates and generates resources through admission webhooks, with policies written as YAML.

    Open source Established
    IaC Security

  • OPA Gatekeeper

    Open Policy Agent (CNCF)

    The Kubernetes admission controller for Open Policy Agent, packaging Rego policies as reusable constraint templates and cluster-scoped constraints.

    Open source Established
    IaC Security

  • Sysdig Secure

    Sysdig

    A commercial cloud and container security platform built on Falco, combining runtime detection with posture, vulnerability management and capture-based forensics.

    Commercial Established
    IaC Security
Tick up to 4 tools above.