Infrastructure as code security
Visit WebsiteFreeVisit Website
Tracked since2026
0 reviews trackedThe Bottom Line
Entry price
Free, no paid tier
Biggest pro
IaC security scanning
Biggest con
False positives
TL;DR - Checkov
- Free open-source infrastructure-as-code security scanner by Bridgecrew (Prisma Cloud)
- 1000+ built-in policies for Terraform, CloudFormation, Kubernetes, and Dockerfile
- Graph-based scanning for CIS, NIST, HIPAA, GDPR compliance with CI/CD integration
Pricing: Free forever
Best for: Individuals & startups
What is Checkov?
Checkov is an open-source static analysis tool for infrastructure as code. Scan Terraform, CloudFormation, Kubernetes, and Dockerfiles for security and compliance issues. 1,000+ built-in policies cover common misconfigurations. Custom policies extend coverage to your organization's requirements. Integrates with CI/CD pipelines to prevent insecure infrastructure. Shift security left by catching issues before they reach production.
Available on: Web, macOS, Linux, Windows
Pros & Cons
Pros
- IaC security scanning
- Many frameworks
- Open source
- Policy as code
- CI/CD integration
Cons
- False positives
- Learning curve
- Output verbose
- Custom policies complex
- Documentation gaps
Key Features
IaC scanningPolicy as codeMulti-frameworkCI/CD integrationCustom policiesOpen source
Pricing Plans
Pricing checked Jul 14, 2026
Open Source
Free
- 750+ built-in policies
- CIS, PCI, HIPAA compliance
- Custom policies (Python/YAML)
- CLI and VS Code extension
- CI/CD integration
- Free forever
Prisma Cloud
Contact sales
- All open source features
- Runtime scanning
- Pull request annotations
- Repository badges
- Compliance reports
- Enterprise support
Reviews
$99Free with your review
Write a reviewReview Checkov, get a free AI guide
Share your experience and we will send you Improve Your Thinking Patterns Using ChatGPT, free.
Best Checkov Alternatives
Top alternatives based on features, pricing, and user needs.
Prisma CloudPaid
Cloud-native security platform
InfracostFreemium
Shift FinOps Left: Proactively find and fix cloud cost issues before deployment.
tfsecFree
Security scanner for your Terraform code.
TerrascanFree
Detect compliance and security violations across Infrastructure as Code (IaC) to mitigate risk.
Still deciding?
Most buyers shortlist 2 or 3 tools before committing. Pull a side-by-side comparison or browse the full alternatives shortlist below.
Explore More
Checkov FAQ
How does Checkov help secure infrastructure as code?
Checkov is an open-source static analysis tool that scans Terraform, CloudFormation, Kubernetes, and Dockerfiles for security and compliance issues. It includes over 1,000 built-in policies to identify common misconfigurations, helping to prevent insecure infrastructure from reaching production.
Which teams benefit most from using Checkov?
Checkov is ideal for development and operations teams that manage infrastructure as code and prioritize shifting security left in their development lifecycle. It helps these teams integrate security scanning directly into their CI/CD pipelines.
How is Checkov priced?
Checkov is free to use, as it is an open-source tool. There is no paid plan required to access its features for infrastructure as code security scanning.
Can Checkov be integrated into existing development workflows?
Yes, Checkov is designed to integrate with CI/CD pipelines. This allows organizations to catch security and compliance issues early in the development process, before infrastructure is deployed to production environments.
What kind of infrastructure as code frameworks does Checkov support?
Checkov supports scanning for security and compliance issues across multiple infrastructure as code frameworks. These include Terraform, CloudFormation, Kubernetes, and Dockerfiles.
How does Checkov compare to Terrascan for IaC security?
Checkov offers a broader range of supported frameworks, including Kubernetes and Dockerfiles, in addition to Terraform and CloudFormation. Both tools focus on IaC security scanning, but Checkov also emphasizes its extensive built-in policy library and custom policy capabilities.
What are the main trade-offs when implementing Checkov?
Implementing Checkov may involve a learning curve, and users might encounter false positives in its output. Additionally, creating custom policies can be complex, and some users have noted gaps in the documentation.
Source: checkov.io