IaC Security Tools

Acquired by Google. Wiz is the leader in having an all-in-one cloud security platform by expanding into CTEM, ASPM, and Runtime capabilities all within a single dashboard. Their posture and vulnerability capabilities remain the strongest, but their Code and Defend offerings are competitive in their own right.

Aikido provides everything the average startup to mid-market company needs for security in a box - every code and cloud security scanner under the sun without much feature compromise, alongside a surprisingly robust runtime application solution for things like bot prevention. A no-nonsense replacement for a lot of more "specialized" solutions that tend to slow developers down.

Cycode offers a holistic all-in-one ASPM tool with their in house scanners alongside the ability to import third party findings. They offer about every scanner and feature you could need out of an AppSec tool.

Apiiro has built an all-in-one application security management solution that is especially strong at managing application security results at enterprise scale. They focus on building robust relationships between code assets to manage application security programs at scale.

Corgea provides a robust bundling of AI first scanning tools - from AI SAST to SCA and Secrets scanning. Corgea's especially strong at discovering vulnerabilities via AI scanning, and AI based prioritization for false positive analysis.

Ox provides an all-in-one application security solution that provides their own scanners combined with the ability to import third party findings. They also have a robust API for managing the data in the tool.

Orca offers the standard suite of CNAPP features with a focus on agentless scanning. They're a good all around CNAPP offering mostly focused on the posture side.

Checkmarx has adapted well to the DevSecOps model, offering a lighter weight scanner in the Checkmarx One platform, that integrates well into the larger stack. They don't have all the latest features of some newer companies, but they certainly get the job done for diverse enterprises. I would not suggest venturing off Checkmarx One though.

Legit Security offers a holistic ASPM platform that focuses more on pipeline discovery, security, and third party data ingestion than native scanning solutions.

Tenable offers a robust ecosystem of vulnerability scanning solutions, most recently consolidated with their Tenable One Exposure Management platform. Tenable offers scanning from cloud to DAST to network scanning, and is widely deployed across enterprises in order to consolidate different scanners. Their exposure management platform has done a great job bringing together their various data points, creating a more unified experience that the platform had been missing.

Arnica is a holistic application security solution that focuses primarily on providing a strong developer experience. They have robust policy and attribution engines to build detail oriented workflows getting the right finding to the right person at the right time.

Aqua Security built a lot of the open source projects that power modern cloud security, and can go feature for feature with most other CNAPP platforms. The downside of the CNAPP has been the UI/UX, and the focus has always been on container protection more than holistic cloud security features.

Cortex Cloud is a security operations platform that integrates cloud and application security capabilities into their larger security operations offerings. This provides a single hub for managing first and third party findings across vulnerabilities and runtime events.

Xygeni offers a robust ASPM solution for managing and scanning for vulnerabilities, and mapping component relationships in your software. They have strong coverage for looking for active attacks to your supply chain.

Boost Security has a shared vision for all in one configuration scanning out to runtime. They have smart kubernetes & Istio integrations for runtime context, alongside the standard suite of SCA, SDLC, SAST, IaC, Secrets, and Containers based on a combination of open source and in house built tools. I appreciate the openness of their rule set in their documentation.

Datadog offers a complete suite a security offerings that are a great fit for developer focused teams not looking for the most mature details in each area. They offer most scanning types, runtime detections, and a full SIEM, and you're probably already sending them your logs. It's a great runtime choice to meet developers where they work, but the UX is built primarily for developers.

JIT built a holistic ASPM scanning solution, and has sense heavily invested in AI workflows. They consolidate scanners and create workflows and prioritization for developers. The JIT scanner is unique in that it's a wrapper for other scanners that you run in your own pipelines - an approach with pros and cons.

Checkov is the leader in IaC scanning as an open source solution.

Acquired by Cloudflare. Kivera is not strictly speaking a CSPM, but provides granular controls over what cloud API calls are permissible within your environment. This allows instant enforcement of custom rules and policies, giving the same outcomes as CSPMs without the alert explosion. The downside of using them as a sole CSPM would be missing out on more holistic CNAPP features and visibility, but they run well alongside other providers.

Start Left brings SAST, SCA, Container, and IaC scanning in a single platform. They also have AI code remediation recommendations, and provide a docker image for running local scans.

Nirmata is a platform built for enforcing policies in your cloud environnment (but mostly Kubernetes). It functions as an admission controller and policy engine, allowing you to enforce checks for all your Kubernetes changes.

Codacy is a code quality and scanning toolbox similar to SonarQube for code scanning. They support many languages via open source scanning tools and have a developer focus.

Zest provides contextual IaC fixes for your deployed cloud infrastructure.

Blast provides preventative security controls to protect cloud environments based helping organizations deploy and manage different guardrails like SCP and IaC.

KICS is another solid open source solution; however, they're more easily adopted into traditional security review models.

Gomboc promises a unique approach to IaC in that it goes beyond traditional regex based rules.

We're pending hands on time with the tool for more information.

Qwiet takes a unique approach to scanning that starts with a map of your application, and scans within that context. They have smart prioritization filters combined with the standard suite of SCA, container, SAST, Secrets, and IaC scanning. They don't offer "pipeline-less" scanning via webhooks if that's a requirement for you.

Rainforest combines all in one code vulnerable scanning with brand protection capabilities. They instrument via an on premise VM allowing you to scan everything in your own environment.

Trivy is an amazing open source container, SCA, and IaC scanner provided by the team at Aqua Security. This awesome scanner powers a lot of tools under the hoods and is a great resource for the community.