17.9
Aikido CSPM gives teams a consolidated view of cloud misconfigurations, exposures, overly permissive IAM, and compliance gaps.
Free planWebAPILinux
Alternatives to DryRun Security IaC Security
27.7
Kyverno is a free, open-source policy engine designed for Kubernetes.
Free planOpen sourceWebAPILinux
37.5
Snyk Open Source is a software composition analysis tool for finding and addressing security vulnerabilities and license issues in open source dependencies.
Free planWebAPILinux
- 4
Fairwinds Polaris
Fairwinds Polaris is an open source policy engine that validates and can remediate Kubernetes resource configuration.
Free planWebLinuxmacOSSelf-hosted7.1Free plan - 5
KloudSec IaC Security
KloudSec IaC Security scans Terraform and CloudFormation changes in pull requests to identify infrastructure misconfigurations before merge.
Free planWebAPILinuxmacOS7.0From $79 a month - 6
kube-score
kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience.
Free planWebLinuxmacOSSelf-hosted6.9Free plan - 7
Trivy
Trivy is a free, Apache-2.0-licensed scanner for code repositories, binary artifacts, container images, and Kubernetes clusters.
Free planLinuxmacOSSelf-hostedWindows6.9Free plan - 8
Conftest
Conftest is a free utility for testing structured configuration data, designed especially for CI environments.
Free planLinuxmacOSWindows6.8Free plan - 9
AWS CloudFormation
AWS CloudFormation models, provisions, and manages related AWS and third-party resources as infrastructure as code.
Free planWebAPILinuxmacOS6.7Free plan - 10
audytx
audytx analyzes AWS infrastructure code and Terraform pull requests, presenting security and cost findings in GitHub and to coding agents.
Free planWebAPI6.6From $20 a month - 11
Kubescape
Kubescape is an open-source Kubernetes security platform for coverage across configuration, vulnerabilities, compliance, and runtime activity.
Free planAPILinuxmacOSSelf-hosted6.6Free plan - 12
Checkov
Checkov is a free infrastructure-as-code scanner that identifies misconfigurations that may create security or compliance problems.
Free planLinuxmacOS6.2Free plan - 13
Gomboc AI Code Security Platform
Gomboc AI Code Security Platform analyzes infrastructure-as-code and creates fixes as pull requests for developers to review and merge, rather than changing code directly.
Free planWebAPIExtension6.2Free plan - 14
KubeLinter
KubeLinter is a free, open-source tool for statically checking Kubernetes YAML files, Helm charts and Kustomize manifests for production-readiness and security practices.
Free planLinuxmacOSSelf-hosted6.2Free plan - 15
cfn-nag
cfn-nag is a free static analysis tool that scans CloudFormation templates for patterns that may indicate insecure infrastructure.
Free planLinuxmacOSSelf-hosted6.0Free plan - 16
CFRipper
CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates.
Free planLinuxmacOSSelf-hostedWindows6.0Free plan - 17
Safeguard DAST
Safeguard DAST is web-based security software with authenticated scanning, API testing, and CI/CD integration.
WebSelf-hosted5.9 - 18
Winfunc Infrastructure Scanner
Winfunc Infrastructure Scanner analyzes infrastructure-as-code, cloud configurations, and container definitions before production.
WebAPISelf-hosted5.9$500, paid once - 19
TigerGate Code Quality
TigerGate Code Quality analyzes software to track technical debt, detect code smells, measure complexity, and enforce standards in pull-request workflows.
WebSelf-hosted5.7 - 20
c7n-left
c7n-left evaluates Cloud Custodian policies against Terraform infrastructure-as-code assets, so teams can check cloud resource definitions before applying them.
LinuxmacOSSelf-hostedWindows5.5 - 21
4.8