IaC Scanning Tools: Checkov vs Trivy vs KICS vs Terrascan

TL;DR: If you are choosing an infrastructure-as-code (IaC) scanner in August 2026, choose from Checkov, Trivy and KICS. All three are Apache 2.0 licensed and published a release in July or August 2026. Terrascan's repository was archived on 20 November 2025, and its last release is from September 2024.¹ Pick Checkov to write policies in Python or YAML, Trivy to scan container images with the same tool, and KICS for the longest list of file formats.

This is for you if you are choosing a scanner for the Terraform, Kubernetes or CloudFormation files in your pipelines, or you still run Terrascan or tfsec. Skip this if you need to monitor live cloud accounts, not files in a repository.

Key points

• Pin every scanner by image digest or commit SHA. In March 2026, an attacker repointed 76 of the 77 version tags of Trivy's GitHub Action.
• Only Trivy scans container images for known vulnerabilities without an account on another service.
• A default Trivy job never fails the build: it exits with code 0 on findings unless you set --exit-code 1.

Which IaC scanners are still maintained?

Checkov, Trivy and KICS are maintained, and Terrascan is not.

On 20 November 2025, Tenable added a notice to Terrascan's README: "This project is no longer maintained. The repository is archived and no further updates, issues, or pull requests will be accepted."¹ Aqua's earlier Terraform scanner, tfsec, "will continue to remain available for the time being", but Aqua directs its "engineering attention" at Trivy. Its migration guide maps tfsec <dir> to trivy config <dir>.²

Which IaC formats does each scanner support?

All four scanners read Terraform, Terraform plan JSON, CloudFormation, Azure Resource Manager (ARM) templates, Kubernetes manifests, Helm charts and Dockerfiles. They differ on four formats.

"Not listed" means absent from the project's documentation (for Terrascan, its source code). Checkov also scans CI workflow files such as GitHub Actions.³ KICS also lists OpenAPI, Pulumi and Crossplane.⁴ Trivy "does not support Kustomize overlays", only base files.⁵

How are custom policies written?

Checkov policies are written in Python or YAML. Its YAML policies "support checking a resource’s connection state", so one policy can test how resources connect.³

Trivy, KICS and Terrascan use Rego, the policy language of Open Policy Agent, but each wraps it in its own metadata and input structure.¹⁴⁵ A policy written for one does not run in another unchanged.

Which scanners fail the build or call the internet by default?

Checkov, KICS and Terrascan fail the build by default, and Trivy does not. All four call the internet by default, and each documents a way to run without it.

Trivy and KICS send data out. Trivy's usage data holds an installation ID, its version, the operating system and scan options, never file paths or image names. KICS's descriptions request carries the IDs of the queries that returned findings. Checkov says its call uses no identifiable customer information.

How do you add an IaC scanner to CI?

All four write SARIF (Static Analysis Results Interchange Format), which GitHub code scanning imports. These commands, from each project's documentation, write it:

hljs sh
# Checkov 3.3.11: writes results.sarif
checkov -d . -o sarif

# Trivy v0.74.0: --exit-code 1 makes findings fail the job
trivy config --exit-code 1 --format sarif -o trivy.sarif .

# KICS v2.1.21: tag shown for readability, pin the image by digest
docker run -t -v "$PWD":/path checkmarx/kics:v2.1.21 scan -p /path -o /path/results --report-formats sarif

Pin each scanner by image digest or commit SHA, because a version tag can be moved. On 19 March 2026, according to Aqua's advisory, an attacker published "a malicious Trivy v0.69.4 release" and force-pushed the version tags of Trivy's GitHub Action.⁶ The hijacked tags were live for about twelve hours.

Checkov vs Trivy: which should you choose?

Choose Checkov for wider IaC format coverage and for policies that check how resources connect. Choose Trivy if your team writes Rego and wants one tool that also scans container images for known vulnerabilities, with no account on another service.⁵ Checkov's image scanning needs a Prisma Cloud API token.³ Test KICS as well if you use Docker Compose, Pulumi or Crossplane, which neither Checkov nor Trivy lists.

What should Terrascan users move to?

Move to KICS or Trivy to keep writing Rego, or to Checkov, the only one of the three that lists every format Terrascan supports. Check which of your custom policies the new tool already covers with a built-in check, and rewrite only the rest.

Method and limits

We compared the tools from each project's documentation and repository at its latest release on or before 18 August 2026. We did not run them, so this post reports no finding counts or false-positive rates. Haxset offers a product in this category.

How Haxset can help

Haxset runs IaC misconfiguration checks in the same scan and report as its AI SAST and secret detection. In scans of web application repositories, the checks cover Terraform, CloudFormation, ARM templates, Bicep, Kubernetes manifests, Helm charts, Dockerfiles, Docker Compose and Ansible files. Pull-request findings appear in Haxset's comment on the pull request. Container image vulnerability scanning is not part of the default scan.

A Dockerfile finding, part of the AI SAST findings.

Haxset does not keep the prompts its AI models process and does not train models on them. It stores only scan metadata and scan results. To try it on your own infrastructure code, contact us.

Related research

• How to Secure AI-Generated Code: What Each Scan Catches
• Security on Every Pull Request, and Every Week: AI CI/CD Scanning and Continuous Monitoring
• What Is AI SAST? What the LLM Actually Does

References

1. Tenable, Terrascan repository at release v1.19.9, GitHub, 18 September 2024. Archive notice added on 20 November 2025 in commit dafb3e0a, and an Internet Archive copy of 14 August 2026 shows "This repository was archived by the owner on Nov 20, 2025". ↩ ↩² ↩³ ↩⁴

2. Aqua Security, tfsec repository, GitHub: README section "tfsec to Trivy Migration" (31 August 2023) and its tfsec-to-Trivy migration guide (May 2023). ↩

3. Palo Alto Networks, Checkov repository and documentation at release 3.3.11, GitHub, 13 August 2026. ↩ ↩² ↩³ ↩⁴

4. Checkmarx, KICS repository and documentation at release v2.1.21, GitHub, 30 July 2026. ↩ ↩² ↩³

5. Aqua Security, Trivy repository and documentation at release v0.74.0, README and documentation pages "Infrastructure as Code", "Kubernetes", "Built-in Checks", "Custom Checks", "Reporting", "Others", "Usage Telemetry" and "Connectivity and Network considerations", GitHub, 14 August 2026. ↩ ↩² ↩³ ↩⁴

6. Aqua Security, GHSA-69fq-xp46-6x23: Trivy ecosystem supply chain temporarily compromised, security advisory, 21 March 2026. ↩