Checkov

What it is

Checkov is a static analysis tool for infrastructure as code. It scans Terraform, CloudFormation, Kubernetes manifests, Helm charts, ARM templates, and Serverless framework configs against a library of policy checks before anything gets deployed. It catches things like open security groups, unencrypted storage, missing IAM boundaries, and privileged containers — the stuff that usually gets found in a security review after it's already in production. Checkov runs as a CLI, in CI pipelines, or as a pre-commit hook, and outputs results in formats that plug into SARIF, JUnit, and most CI dashboards.

Who builds it and why

Checkov was created by Bridgecrew, a cloud security startup that was acquired by Palo Alto Networks in 2021 and folded into Prisma Cloud. Palo Alto continues to maintain and drive the open-source project as a feeder for Prisma Cloud's commercial IaC scanning and policy-as-code offerings. This is a common pattern: open-source tool builds adoption and a check-writing community, commercial platform monetizes the enterprise workflow around it (centralized dashboards, drift detection, remediation guardrails). The open-source core isn't crippled — it's fully functional as a standalone scanner — but the roadmap is shaped by what feeds the commercial product.

Production readiness signal

443 contributors and 8,834 GitHub stars is a solid, active base for a security-focused CLI tool. Commit activity through mid-2026 shows it's still maintained, not coasting on legacy momentum. Apache-2.0 licensing is permissive and safe for enterprise use. Latest release 3.3.6 indicates a mature versioning cadence rather than a project still finding its footing. CNCF maturity level is not publicly available — Checkov isn't a CNCF project, it's vendor-backed open source, which is a different trust model: faster feature velocity, but governance sits with one company rather than a foundation.

Who should use this

• Platform and DevOps teams who need pre-deployment guardrails on Terraform/CloudFormation/K8s manifests without standing up a full commercial security platform.
• Teams already in the Terraform/Helm ecosystem who want policy checks in pre-commit or CI without paying for a SaaS product first.
• Security engineers building custom policies — Checkov supports custom checks in Python or YAML, which matters if your org has org-specific compliance requirements (SOC2 controls, internal naming/tagging standards).
• Anyone who wants a Prisma Cloud on-ramp — if you're evaluating that platform, Checkov is how you test the policy engine for free first.

Who should NOT use this

• Teams needing runtime cloud security posture management (CSPM) — Checkov only scans IaC, it has zero visibility into what's actually deployed and drifted in your cloud accounts.
• Orgs wanting a vendor-neutral governance model — this is Palo Alto-controlled open source, not a foundation project; if that governance risk matters to your procurement process, factor it in.
• Teams that already run tfsec/Trivy or OPA/Conftest pipelines and don't want a third overlapping tool — consolidate rather than stack.
• Anyone expecting enterprise support, SLAs, or a paved-path UI out of the box — that's the paid Prisma Cloud tier, not this repo.

Alternatives

• tfsec / Trivy (Aqua Security) — Trivy absorbed tfsec and now covers IaC scanning plus container/vuln scanning in one binary; better choice if you want fewer tools doing more.
• OPA / Conftest — lower-level policy engine, more flexible but requires you to write Rego policies yourself rather than use a pre-built rule library.
• Terrascan — similar IaC scanning scope to Checkov, smaller community, less commercial backing.

Pricing

Fully open source under Apache-2.0. No paywalled features in the CLI itself. Commercial tier (Prisma Cloud) adds centralized dashboards, drift detection, and enterprise support — pricing for that is not publicly available and requires a Palo Alto Networks sales conversation.