The scanner landscape

tfsec/Trivy, Terrascan, KICS, Snyk.

Advanced14 min · lesson 9 of 12

Checkov is one of several IaC scanners, and knowing the landscape helps you choose and combine them. tfsec was the popular Terraform-focused scanner; it has been merged into Trivy, which is now a single tool spanning IaC misconfig, image/OS vulnerabilities, secrets, and SBOM. Terrascan (Tenable) uses OPA/Rego under the hood for its policies. KICS (Checkmarx) covers a very wide set of IaC and query types. Snyk IaC is the commercial option with a managed catalog.

The IaC scanner family

broad, multi-purpose

Checkov

many frameworks, big catalog

Trivy (absorbed tfsec)

IaC + images + secrets + SBOM

KICS

very wide IaC coverage

policy-engine / commercial

Terrascan

OPA/Rego-backed rules

Snyk IaC

managed catalog, commercial

They overlap heavily. Pick one primary scanner for consistency; Trivy is attractive because it also does images/secrets in one tool.

Choosing and not over-stacking

Because these tools overlap so much, running all of them multiplies noise and maintenance for little added coverage. Pick one primary IaC scanner (Checkov for breadth and custom policies, or Trivy if you want IaC plus image/secret scanning unified), standardize your team on its findings format and suppression syntax, and only add a second scanner for a specific gap it uniquely fills. Consistency beats coverage-by-accumulation.

terminal

# Trivy also scans IaC config (the ex-tfsec engine) — one tool, several jobs
$ trivy config .                 # IaC misconfigurations
$ trivy fs --scanners secret .   # leaked secrets in the repo
$ trivy image registry.internal/app:1.4.2   # image vulnerabilities

More scanners is more noise, not more security

Stacking Checkov + Trivy + Terrascan + KICS on the same repo produces overlapping, differently-worded findings and quadruples the suppressions to maintain — which drives alert fatigue and gets the whole gate disabled. Choose a primary scanner deliberately, add others only for a distinct capability, and invest the saved effort in tuning and remediation rather than running everything.

Baselines & incremental adoptionSecrets, SBOM & image overlap