Compliance

Checkov

A static analysis tool for Infrastructure as Code that scans Terraform, CloudFormation, Kubernetes, Helm, ARM, and Serverless configurations for security misconfigurations and compliance violations.

Prowler

An open-source cloud security assessment tool that performs automated auditing of AWS, Azure, GCP, and Kubernetes environments against hundreds of security best-practice checks.

Snyk

Developer security platform providing software composition analysis, static code analysis, container scanning, and IaC security testing integrated into the development workflow.

SonarQube

The most widely deployed platform for continuous code quality and security analysis, performing static analysis across 30+ languages to detect bugs, vulnerabilities, and code smells.

Trivy

A comprehensive open-source security scanner for containers, filesystems, Git repositories, and Infrastructure as Code, detecting vulnerabilities, misconfigurations, and exposed secrets.

Wazuh

An open-source security platform providing unified host-based intrusion detection, vulnerability assessment, compliance auditing, and threat detection across endpoints, servers, and cloud workloads.

Acunetix

Commercial DAST/IAST web application security scanner with proof-based scanning, DeepScan JavaScript rendering, and optional grey-box AcuSensor agent for code-level precision.

GFI LanGuard

Commercial network security scanner and patch management platform that audits, identifies, and remediates vulnerabilities across Windows, macOS, and Linux endpoints.

Invicti (Netsparker)

Enterprise-grade DAST platform using proof-based scanning to automatically confirm exploitable vulnerabilities in web applications and APIs with near-zero false positives.

Nexpose

Rapid7's on-premise vulnerability management scanner with Active Risk scoring, continuous asset discovery, and compliance benchmarking across network infrastructure and endpoints.

Qualys

Cloud-native enterprise security platform delivering continuous vulnerability management, web application scanning, and compliance auditing across IT assets and cloud workloads.

Nessus

The industry standard for vulnerability assessment, providing deep scanning capabilities for IT assets and compliance.