Developer Tools·Standings

Compare IaC Security Scanners

IaC security scanners check infrastructure-as-code files for security issues; compare the frameworks they support and how they fit into your workflow.

The board shows a signal score out of 10, plus marks for a public API, open-source code and a free tier. IaC means infrastructure as code: files used to define and manage infrastructure.

  • 16 platforms
  • 1 with a public API on this page
  • 15 with a free tier
  • Checked 7 Oct 2026
  1. 1
    K
    Kubescapekubescape.io

    A free, open-source Kubernetes security tool that scans manifests, Helm charts, live clusters, and container images.

    7.6 APIOpenFree Free tier · from $30/mo
  2. 2
    D
    DeepSourcedeepsource.com

    An AI code review service that flags coding patterns and security risks; free plan, paid from $24/user monthly.

    6.7 APIOpenFree Free tier · from $30/mo
  3. 3
    FP
    Fairwinds Polarisfairwinds.com

    A free, open-source tool that checks and remediates Kubernetes settings, with built-in and custom policies.

    6.7 APIOpenFree Free tier
  4. 4
    T
    Trivytrivy.dev

    A free, open-source scanner for code, binaries, container images, and Kubernetes clusters.

    6.6 APIOpenFree Free tier
  5. 5
    KS
    kube-scorekube-score.com

    A free, open-source checker for Kubernetes definitions, with a browser demo that keeps files in your browser.

    6.6 APIOpenFree Free tier
  6. 6
    P
    Pulumipulumi.com

    Pulumi helps engineers ship infrastructure faster with Infrastructure as Code in general-purpose languages.

    6.3 APIOpenFree Free tier · from $40/mo
  7. 7
    T
    TFLintgithub.com

    A free Terraform checker with plugins for cloud-specific errors and rules for syntax and naming practices.

    6.1 APIOpenFree Free tier
  8. 8
    C
    Checkovcheckov.io

    A free scanner for Terraform, CloudFormation, Kubernetes, and other infrastructure files, with custom policies.

    6.0 APIOpenFree Free tier
  9. 9
    K
    KubeLintergithub.com

    A free, open-source checker for Kubernetes YAML, Helm, and Kustomize files that reports fixes for failed checks.

    6.0 APIOpenFree Free tier
  10. 10
    CN
    cfn-naggithub.com

    A free scanner for CloudFormation files that flags potentially insecure settings, including permissive access rules.

    6.0 APIOpenFree Free tier
  11. 11
    TC
    terraform-complianceterraform-compliance.com

    A free security test tool for Terraform setups, with checks before deployment and in automated workflows.

    5.8 APIOpenFree Free tier
  12. 12
    AC
    AWS CDK Naggithub.com

    A free, open-source scanner for AWS CDK apps and CloudFormation templates with custom policies and fix suggestions.

    5.1 APIOpenFree Free tier
  13. 13
    PF
    PSRule for Azureazure.github.io
    5.1 APIOpenFree Free tier
  14. 14
    SI
    Safeguard IaC Securitysafeguard.sh

    A web-based infrastructure security tool with Terraform analysis and custom policies; free plan, paid from $9 monthly.

    4.9 APIOpenFree Free tier
  15. 15
    SI
    Snyk IaCsnyk.io
    4.9 APIOpenFree Free tier
  16. 16
    AC
    AWS CloudFormation Guardgithub.com

    A free, open-source policy checker for CloudFormation, Terraform JSON, and Kubernetes configurations.

    4.3 APIOpenFree —

Places #1, #2, #3, #4, #5 on this board are open to sponsors. Take #1 · Other ways to advertise

How to choose

Which IaC frameworks does it need to support?

Choose a scanner that supports the frameworks you use. The board compares IaC frameworks, so check that field against your infrastructure files before deciding.

How will it fit into my code review workflow?

Compare CI/PR integration if you want checks to fit into continuous integration or pull request review. These are automated steps that check proposed code changes.

Can I set custom security policies?

Check the custom policies field if your team needs rules beyond a scanner's built-in checks. Fix suggestions and drift detection are also listed for comparison.

Can I try it before paying?

Compare the free plan, paid starting price and trial information. The board also marks whether an open-source option is available; check the individual listing for its terms.

Where can I run the scanner?

Check the platform details for Linux, macOS, Windows, self-hosted, web or API support. An API is a way for software to connect to another service; self-hosted means running it on infrastructure you manage.

Questions

What should I compare in an IaC security scanner?

Compare supported IaC frameworks, custom policies, CI/PR integration, fix suggestions, drift detection, platforms, and the free and paid options.

Are IaC security scanners free?

The board lists free-plan availability and paid starting prices. It also compares free trials and open-source options.

What does drift detection mean in IaC security?

Drift detection checks for differences between infrastructure described in code and infrastructure as it exists. The board compares this feature.

What does an open-source mark mean?

It indicates an open-source option. Check the individual listing for the available code and its licence.

Can I use an IaC scanner in pull request reviews?

The board compares CI/PR integration. Check a tool's listing to see whether it fits your code review workflow.

Some top positions on this board can be paid placements, standing where they were sold. The facts on each platform are not for sale. How we rank · Disclosure