If your pipeline deploys an unencrypted S3 bucket to production, catching it post-deployment is a failure of engineering. Security belongs in the IDE and the continuous integration pipeline, long before terraform apply ever runs.
We are officially past the era of waiting for cloud misconfigurations to hit production. Infrastructure as Code (IaC) security scanners parse your declarative configs—Terraform, CloudFormation, Kubernetes manifests, Helm charts—and flag blatant misconfigurations before a single resource is provisioned.
But the tooling landscape has shifted violently over the last 18 months. Projects that were industry standards just two years ago are now officially abandoned. If your CI/CD relies on tfsec or Terrascan, you are running dead code. Aqua Security sunset tfsec to consolidate into Trivy, while Tenable pulled the plug on Terrascan entirely in late 2025.
Here is the 2026 survival guide for IaC security scanning: what to ditch, what to adopt, and how they stack up.
The Job to Be Done
A practical IaC scanner must meet three criteria for actual engineers to use it:
- Speed: It must run in seconds locally. If it adds three minutes to a pre-commit hook, developers will bypass it.
- Context: A flat list of 800 warnings is useless. It needs to suppress known-good patterns and highlight severe risks (like hardcoded AWS keys or public ingress).
- Multi-Framework: Very few teams use strictly Terraform anymore. A good scanner should parse Kubernetes manifests and Dockerfiles alongside your cloud code.
(For those focusing specifically on cloud infrastructure reconnaissance, pair these static tools with our Mastering Cloud Reconnaissance Methodology.)
1. Checkov (The Heavyweight Standard)
Checkov, maintained by Palo Alto Networks, remains the absolute behemoth of IaC scanning. As of version 3.2.529 (released May 2026), it supports over a dozen frameworks out of the box and features graph-based scanning, meaning it understands resource dependencies (e.g., it knows if a security group attached to an EC2 instance actually exposes port 22).
Command Example:
# Scan a Terraform directory and output findings as a compact CLI table checkov -d ./terraform-prod --quiet --compact
Always use --quiet in local environments to hide the noise of passing checks and focus entirely on failures.
When to reach for it: You have a mature pipeline handling multiple configuration languages (Terraform, CloudFormation, K8s, Helm) and want a strict, graph-aware policy engine. It natively integrates with Checkov's VSCode extension, pulling security left into the IDE seamlessly.
2. Trivy (The Successor)
When Aqua Security acquired tfsec, the writing was on the wall. Rather than maintaining two separate projects, they merged tfsec's logic into Trivy. Trivy was originally famous for container image scanning, but its config subcommand has swallowed the IaC scanning market whole.
Command Example:
# Scan a local Terraform directory for misconfigurations with High/Critical severity trivy config ./infrastructure/ --severity HIGH,CRITICAL
Trivy's ability to filter by severity natively makes pipeline enforcement drastically simpler than parsing raw JSON.
When to reach for it: If you already use Trivy for container image scanning, drop everything else and use trivy config. Consolidating your container vulnerability scanning and IaC misconfiguration scanning into a single binary simplifies CI/CD boilerplate immensely. (If you are curious about container security, check out our Container Security Scanners Roundup.)
A typical DevSecOps workflow integrating Checkov or Trivy as a blocking step prior to staging deployment.
3. KICS (The Verbose Alternative)
KICS (Keeping Infrastructure as Code Secure) by Checkmarx is a robust, heavily updated scanner (latest v2.1.19, Jan 2026). Its defining feature is a massive, aggressive query library written in Rego (the Open Policy Agent language).
Command Example:
# Run KICS against a specific path and output results to a JSON file kics scan -p ./k8s-manifests -o ./results -f json
KICS shines when exporting structured data for ingestion into platforms like DefectDojo or generic SIEMs.
When to reach for it: You need extreme granularity and don't mind tuning out false positives. KICS is famously noisy out of the box, flagging "missing tags" with the same visual urgency as "public S3 bucket." If you have the engineering time to tune its Rego policies, it is incredibly powerful.
The Comparison
| Tool | Status | Best Feature | Biggest Drawback |
|---|---|---|---|
| Checkov | Active | Graph-based dependency awareness. | Python-based; slightly slower than Go binaries. |
| Trivy | Active | All-in-one container + IaC scanner. | Error messages can occasionally lack Terraform context. |
| KICS | Active | Massive default query library. | Excessively noisy without heavy configuration tuning. |
| tfsec | Deprecated | Was the fastest pure-TF scanner. | Dead project; no longer receives security updates. |
| Terrascan | Archived | Good OPA integration. | Completely unmaintained since 2025. |
What I'd Actually Use
If you are building a pipeline from scratch today, use Trivy. The convenience of running one fast Go binary to scan your Dockerfiles for CVEs and your Terraform for CISA Secure by Design violations is unbeatable.
If you have a complex AWS environment where security groups and IAM roles are deeply tangled, use Checkov. Its graph engine catches logical relationship errors that Trivy sometimes misses.
Whatever you choose, strip tfsec and Terrascan out of your pipelines immediately. Security tools that don't receive signature updates are worse than no tools at all—they provide a false sense of security while missing modern attack paths.
References / Further reading
- Bridgecrew/Palo Alto. (2026). Checkov GitHub Repository. https://github.com/bridgecrewio/checkov
- Aqua Security. (2026). Trivy GitHub Repository. https://github.com/aquasecurity/trivy
- Checkmarx. (2026). KICS GitHub Repository. https://github.com/Checkmarx/kics
- Tenable. (2025). Terrascan GitHub Repository. https://github.com/tenable/terrascan
- Cybersecurity and Infrastructure Security Agency (CISA). Secure by Design. https://www.cisa.gov/securebydesign
