Platform security
IaC scanners that fail the plan before it lands (2026)
A 2026 shortlist of policy-as-code scanners. Public docs, not a cloud-exploit cookbook. Kubernetes overlap declared.
Expertise: Platform security · Level: Intermediate · 12 min read
A CSPM finding after apply is a late ticket.
CSPM reads the live account. IaC scanning reads the plan. Overlap declared. The Kubernetes list already rows admission. This page is the file in git. I will not publish a privilege recipe.
Six scanners. Three open engines. One Trivy (tfsec merged). One Rego runner. One commercial IaC. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Checkov | Open IaC scan you can run in CI | Apache-2.0 |
| KICS | Open queries on IaC you already wrote | Apache-2.0 |
| Terrascan | Open policy runner on Terraform you own | Apache-2.0 |
| Trivy | One binary after tfsec merged in | Apache-2.0 |
| Conftest | Rego on any file you already have | Apache-2.0 |
| Snyk IaC | Commercial IaC next to Snyk OSS | Commercial (free tier) |
Checkov
Best for open IaC scan you can run in CI
Checkov scans Terraform, CloudFormation, Kubernetes YAML, and more. Policies you can extend. Prisma stewards it.
Key features
- Many IaC flavors
- Custom policies
- Apache-2.0
- CI they document
Why we like it
This is the hidden gem. Fail the plan before CSPM opens a Tuesday ticket.
Limits
Noise on generated modules. Prisma gravity. Not a live-account CSPM.
KICS
Best for open queries on IaC you already wrote
Keeping Infrastructure as Code Secure. Query-based. Checkmarx opened it. You run the engine.
Key features
- Query pack
- Many platforms they list
- Apache-2.0
- SARIF out
Why we like it
Second open engine so Checkov is not a one-logo open row.
Limits
Query tuning. You still own false friends.
Terrascan
Best for open policy runner on Terraform you own
Terrascan evaluates IaC against policies. Tenable-adjacent history. You run it in CI.
Key features
- Policy packs
- Terraform-shaped
- Apache-2.0
- CI
Why we like it
Third open runner so the page is not a Checkov recap.
Limits
Mind the project pulse. Read the current repo before you promise it.
Trivy
Best for one binary after tfsec merged in
Trivy scans images, filesystems, and IaC. tfsec merged into it. The SBOM and Kubernetes lists already name Trivy. Here it is the Terraform misconfig scan. Overlap declared.
Key features
- config scan
- Same binary as image scan
- Apache-2.0
- tfsec successor
Why we like it
If Trivy is already in CI, enable config before you add a fourth engine.
Limits
One binary, many jobs. Say which job you turned on.
Conftest
Best for rego on any file you already have
Conftest runs OPA Rego against JSON, YAML, HCL. You write the policy. There is no vendor pack theater unless you add one.
Key features
- You write Rego
- Many inputs
- Apache-2.0
- OPA-shaped
Why we like it
When the rule is yours, a wrapper around Checkov is the wrong door.
Limits
You write Rego. That is the cost and the point.
Snyk IaC
Best for commercial IaC next to Snyk OSS
Snyk IaC is the commercial file scan. If Snyk OSS is already on the PR, this is the sibling. Overlap with SCA is the vendor, not the job.
Key features
- PR annotations
- Terraform and friends
- Same Snyk tenant
- Free and paid
Why we like it
Known desk. Do not add Checkov and Snyk IaC on the same files without a reason.
Limits
Commercial. Noise. We did not run a tenant.
What the internet thinks about IaC scanners
IaC threads treat post-apply CSPM as late. We keep that line. tfsec merged into Trivy. A green plan is not a live-account proof.
Thev00d00 on Hacker News, Nov 2023: “Got a really bad taste when Aqua just dropped support for tfsec entirely, including closing all GitHub issues even unfixed, instead pointing to trivy.”
Prove Checkov still publishes
Confirm Checkov still publishes. Scan a plan or file you own. Do not point it at a stranger’s account.
git ls-remote --heads https://github.com/bridgecrewio/checkov.gitFAQs
Does IaC scanning replace CSPM?
No. The file is the intent. The account is the truth. Link both.
Where did tfsec go?
It merged into Trivy. Use Trivy config scan.
Does this replace Kubernetes admission?
No. Admission is the cluster gate. This is the git file. Link Kubernetes security.
Is this a scored bake-off?
No.
