Static analysis for infrastructure as code
Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.
Checkov scans infrastructure-as-code files for misconfigurations before they are deployed. It ships with a large library of built-in policies and supports custom policies in Python or YAML, including graph-based policies that look at relationships between resources.
It also covers Dockerfiles, CI configuration files and some secrets and dependency scanning. Checkov was created by Bridgecrew, now part of Palo Alto Networks.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
No published advisory found for Checkov in GitHub repository advisories and OSV.dev. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
Cloud security posture and compliance checks
Open-source cloud security platform that runs hundreds of checks against AWS, Azure, Google Cloud, Kubernetes and Microsoft 365, mapped to compliance frameworks.
Multi-cloud security auditing tool
NCC Group's multi-cloud auditing tool that collects configuration data through cloud APIs and highlights risk areas in an offline HTML report.
Infrastructure-as-code scanner with Rego queries
Checkmarx's open-source scanner for security issues and misconfigurations in IaC, with queries written in Rego across many platforms.
Kubernetes security posture and compliance scanner
CNCF project that scans clusters, manifests and Helm charts against frameworks such as the NSA-CISA guidance and CIS Benchmarks, and scans images.
Vulnerability scanner for images, file systems and SBOMs
Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.
