Checkov
Open-source static analysis for infrastructure as code security
Founded
2019
Starting Price
Free
Category
Developer Tools
Last updated April 5, 2026
About Checkov
Checkov is a free, open-source static code analysis tool for infrastructure as code (IaC). It scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, ARM Templates, and more to detect security misconfigurations and compliance violations before deployment. With 1,000+ built-in policies, graph-based scanning, and CI/CD integration, Checkov is the most widely adopted open-source IaC scanner.
Pros & Cons
Pros
- Completely free and open source with no feature limitations
- Broadest IaC framework coverage of any scanner
- 1,000+ built-in policies with compliance mapping
- Graph-based scanning catches complex cross-resource misconfigurations
- Active community with frequent updates and new policies
Key Features
Multi-Framework Scanning
Scans Terraform, CloudFormation, Kubernetes, Helm, Kustomize, Dockerfile, Serverless, Bicep, OpenAPI, ARM Templates, and OpenTofu
1,000+ Built-in Policies
Pre-built security and compliance checks covering CIS benchmarks, SOC 2, HIPAA, PCI-DSS, and cloud provider best practices
Graph-Based Analysis
Analyzes relationships between cloud resources to detect complex misconfigurations that simple pattern matching misses
Custom Policies
Write custom rules as Python code or declarative YAML files to enforce organization-specific standards
CI/CD Integration
Integrates with GitHub Actions, GitLab CI, Bitbucket Pipelines, Jenkins, and other CI/CD systems
SCA Scanning
Software composition analysis for container images and open-source packages to detect CVEs
Fix Suggestions
Provides actionable remediation guidance with suggested code fixes for detected issues
Pricing
Open Source
Free/forever
- All scanning capabilities
- 1,000+ built-in policies
- Custom policy support
- CI/CD integration
- CLI and IDE plugins
Best For
CI/CD Pipeline Security
Scan IaC templates in pull requests to catch misconfigurations before they reach production
Compliance Validation
Validate infrastructure against CIS, SOC 2, HIPAA, and PCI-DSS benchmarks automatically
Developer Security
Enable developers to catch security issues in their IDE before committing code
Multi-Cloud Governance
Enforce consistent security standards across AWS, Azure, and GCP infrastructure
