Loading...
cfn-nag is a free Static Application Security Testing tool. Security professionals most commonly compare it with Meterian ISAAC, KICS. All 156 alternatives are matched by shared capabilities, tags, and NIST CSF 2.0 coverage.
A closer look at the 8 most relevant alternatives and competitors to cfn-nag, including their key features and shared capabilities.
IaC scanner detecting misconfigs, vulnerabilities & policy violations in templates.
Shares 4 capabilities with cfn-nag: Security Scanning, DEVSECOPS, Infrastructure As Code, CI/CD
KICS is an open-source Infrastructure as Code security scanner that detects vulnerabilities and misconfigurations through customizable queries and integrates with CI/CD pipelines.
Shares 4 capabilities with cfn-nag: Security Scanning, DEVSECOPS, Infrastructure As Code, CI/CD
Scans IaC files for misconfigurations before deployment to production.
Shares 3 capabilities with cfn-nag: DEVSECOPS, Infrastructure As Code, CI/CD
SAST engine that scans code commits for security vulnerabilities
Shares 3 capabilities with cfn-nag: Security Scanning, DEVSECOPS, CI/CD
An application security platform that combines multiple security scanners including SAST, SCA, container security, and compliance reporting with CI/CD integration capabilities.
Shares 3 capabilities with cfn-nag: Security Scanning, DEVSECOPS, CI/CD
AI-powered AppSec platform with agentic agents for vulnerability prevention & fix
Shares 3 capabilities with cfn-nag: DEVSECOPS, Infrastructure As Code, CI/CD
IaC scanner for Terraform, CloudFormation, and Helm misconfigurations
Shares 3 capabilities with cfn-nag: DEVSECOPS, Infrastructure As Code, CI/CD
Web3 security platform for smart contract analysis and blockchain development
Shares 3 capabilities with cfn-nag: DEVSECOPS, Infrastructure As Code, CI/CD
IaC scanner detecting misconfigs, vulnerabilities & policy violations in templates.
KICS is an open-source Infrastructure as Code security scanner that detects vulnerabilities and misconfigurations through customizable queries and integrates with CI/CD pipelines.
Scans IaC files for misconfigurations before deployment to production.
SAST engine that scans code commits for security vulnerabilities
An application security platform that combines multiple security scanners including SAST, SCA, container security, and compliance reporting with CI/CD integration capabilities.
AI-powered AppSec platform with agentic agents for vulnerability prevention & fix
IaC scanner for Terraform, CloudFormation, and Helm misconfigurations
Web3 security platform for smart contract analysis and blockchain development
SAST platform that runs scans and ingests SARIF results into a unified dashboard.
Scans IaC templates for misconfigs and vulns before deployment.
AI platform for automated code review, security risk detection across the SDLC.
A pre-commit security tool that scans source code repositories to detect and prevent secrets like API keys, passwords, and credentials from being committed to version control systems.
ASH is an automated security scanning tool that integrates multiple open-source security scanners to perform preliminary security checks on code, infrastructure, and IAM configurations during development.
Automated vulnerability remediation tool that fixes code security issues
AI-powered automated code security remediation bot for vulnerability fixes
Automated app security testing platform for Salesforce and B2C Commerce
SAST tool that scans code for vulnerabilities in 30+ languages with CI/CD integration
IaC security scanner detecting vulnerabilities and misconfigurations in templates
AI-powered code review tool providing automated PR feedback and quality analysis
SAST tool that identifies security and quality issues in source code
Code security platform with SAST, SCA, IAST, and IaC security capabilities
SAST tool for identifying security vulnerabilities in source code
Scans code repositories and runtime environments for exposed secrets and credentials
AI-powered code cleanup tool that automatically fixes security and quality issues
App security testing platform with SAST, SCA, secrets detection, and IaC scanning
SAST tool that scans source code and binaries for security vulnerabilities
Continuous AppSec testing platform with zero-touch provisioning for CI/CD
SAST scanner for identifying security vulnerabilities in source code
SAST tool that identifies vulnerabilities in source code across 30+ languages
AI-powered code security platform for detecting and fixing vulnerabilities
Prevents secrets & sensitive data leaks in code at source
AI-powered automated security code reviews for pull requests
Centralizes SAST tools with AI validation & automated fix generation
AI-driven automated vulnerability remediation for DevSecOps workflows
Developer-first SAST tool for finding security & privacy vulns in code.
A Python command line tool that scans directories for AWS credentials in files, designed for CI/CD integration to prevent credential exposure in builds.
Terrascan is a static code analyzer that scans Infrastructure as Code for security misconfigurations and compliance violations across multiple cloud platforms and container environments.
A tool that combines multiple open source Git scanning utilities to detect and list secrets stored in Git repositories for security audits and compliance checks.
A secrets detection tool that scans GitHub, GitLab, and Bitbucket repositories to identify API keys, access tokens, and other sensitive information in source code.
AI-native SAST tool providing contextual code security analysis in pull requests
AI-powered SAST tool that finds and auto-fixes code vulnerabilities in real-time
AI-driven code analysis tool for API discovery and vulnerability detection
Code quality and security platform with SAST, SCA, and AI-powered remediation
Static code analyzer & SAST tool for C, C++, Java, JavaScript, Python, Kotlin
Cloud-based SAST platform for code quality and security analysis
SAST solution that scans 30+ languages to find and fix code vulnerabilities
Full-cycle app security platform with SAST, DAST, MAST, SCA & binary analysis
AI-native AppSec platform for code security analysis and vulnerability detection
IDE plugin for SAST and SCA scanning with real-time vulnerability detection
SAST tool that detects vulnerabilities and malicious code in custom source code
Detects and prevents secrets leakage across the software development lifecycle
Detects hardcoded secrets in code repos, commits, and containers
Scans code for exposed API keys, credentials, and tokens in repos and CI/CD.
Unified engine correlating static & runtime analysis for app security
Code analysis tool that maps software architecture and components via AST.
AI-powered SAST tool for scanning code vulnerabilities with low false positives
Detects secrets and credentials in code using AI/ML and Code Property Graph
SAST tool for continuous source code vulnerability scanning and remediation
AI-powered SAST tool for code vulnerability detection and automated fixing
Scans and detects hardcoded secrets across SDLC and dev tools
SAST tool for finding code quality & security defects in large-scale software
SAST tool with SCA, SBOM generation, and attack path analysis capabilities
Code security platform for AI-generated and traditional code with runtime intel
AI-powered SAST tool that triages findings and provides remediation guidance
Scans source code repositories for exposed secrets and sensitive data
Application security testing product from Trace Security
AI-powered automated code fix generation for security vulnerabilities
Source code malware scanner detecting backdoors and malicious code in repos
AI-native SAST tool that finds and fixes code vulnerabilities using LLMs
AI-powered code security fix generator for developer workflows
Detects exposed API keys, tokens, credentials & PII in code repositories
Enterprise security tools for smart contract vulnerability detection in Web3/DeFi
Risk-driven cybersecurity DevOps platform for automotive product lifecycle
AI-powered SAST tool for detecting vulnerabilities in application code
AI-powered policy engine for defining and enforcing custom code security rules
AI-powered secret detection tool for real-time credential scanning in code
AI-powered SAST tool for vulnerability detection, triaging, and patching
Source code verification tool that finds bugs and security vulnerabilities
Analyzes leaked secrets to reveal ownership, access scope, and permissions
Detects exposed API keys and credentials across multiple cloud services
Continuous secret scanning and leak detection tool with precommit checks
Python3 code protection against reverse engineering via opcode obfuscation.
Automotive DevSecOps platform integrating TARA, SAST, SCA, and fuzz testing.
AI-powered AppSec platform for code, supply chain, secrets & DAST.
Real-time vulnerability detection and automated fixing for AI-generated code
Code security and quality platform with SAST, SCA, DAST, and AI code protection
Static analysis tool enforcing OWASP Top 10 security rules for Rust code.
Open-source CLI tool for privacy code scanning and data flow analysis.
Bearer CLI is a static application security testing tool that scans source code across multiple programming languages to identify and prioritize OWASP Top 10 and CWE Top 25 security vulnerabilities through data flow analysis.
Static security code scanner (SAST) for Node.js applications with Docker support and integrations with Slack.
Insider is an open-source CLI tool that performs static source code analysis to detect OWASP Top 10 vulnerabilities across multiple programming languages including Java, Kotlin, Swift, .NET, C#, and JavaScript.
Betterscan is an orchestration toolchain that coordinates multiple security tools to scan source code and infrastructure as code for security vulnerabilities, compliance risks, secrets, and misconfigurations.
DumpsterDiver analyzes large datasets to detect hardcoded secrets, keys, and passwords using entropy calculations and customizable search rules.
A sensitive data detection tool for scanning source code repositories
Octoscan is a static analysis tool that scans GitHub Actions workflows for security vulnerabilities and misconfigurations.
SAST tool that detects logical flaws and business logic vulnerabilities
DevSecOps platform for vulnerability detection and developer security training
AI-powered code analysis platform for security, quality, and developer insights
AI-powered reverse engineering tool for analyzing compiled binaries
Smart contract security audit service for DeFi blockchain platforms
SAST tool using virtual compilers to analyze source code for vulnerabilities
Generates test cases by injecting known bugs into code for testing DevSecOps.
Software portfolio governance platform for code quality and security analysis
AI-powered code analysis platform for technical due diligence and audits
Detects hardcoded secrets in code using semantic analysis & validation
Binary code analysis service for security testing compiled applications
SAST tool for mobile apps that identifies vulnerabilities in source code
Proactive security tools for identifying & fixing code vulnerabilities in real-time
Software assurance services using static & dynamic code analysis techniques
GenAI-powered pre-silicon security verification suite for SoC designs
Detects API keys, passwords, and tokens in code with AI-based false positive filtering.
Credential verification service that validates leaked secrets for liveness
Hardware security verification platform for chip design lifecycle
Static analysis tool for C/C++ and enterprise languages, now part of AdaCore
Exploit mitigation tool for C/C++ firmware on embedded systems.
Automated C code analysis and repair tool benchmarked against NIST SAMATE.
Formal verification tools & services for C/Rust software security & safety.
A secret scanning tool that examines NPM modules and ZIP files for exposed credentials and sensitive information using nuclei templates.
SearchCode is an extensive code search engine that indexes 75 billion lines of code from millions of projects to help developers find coding examples and libraries.
A Nuxt 3 security module that automatically implements OWASP security patterns through HTTP headers, middleware, and various protection mechanisms including CSP, XSS validation, CORS, and CSRF protection.
A security-focused general purpose memory allocator providing the malloc API with hardening against heap corruption vulnerabilities.
A CLI tool that performs security assessments on Joi validator schemas by testing them against various attack vectors including XSS, SQL injection, RCE, and SSRF.
A key and secret validation workflow tool built in Rust, supporting over 30 providers and exporting to JSON or CSV.
A Node.js library for validating environment variables and providing immutable access to configuration values in applications.
A Fastify plugin that provides utilities and middleware to protect web applications against Cross-Site Request Forgery (CSRF) attacks.
A static analysis tool that detects Common Weakness Enumerations (CWEs) in ELF binaries across multiple CPU architectures using Ghidra-based disassembly and various analysis techniques.
JAADAS is a powerful tool for static analysis of Android applications, providing features like API misuse analysis and inter-procedure dataflow analysis.
JSON.parse() drop-in replacement with prototype poisoning protection.
A library for generating random numbers and strings of various strengths, useful in security contexts.
A library for forward compatibility with PHP password functions.
Detect trojan source attacks that employ unicode bidi attacks to inject malicious code.
ESLint plugin to prevent Trojan Source attacks.
Dependencies is an open-source modern replacement for Dependency Walker that helps Windows developers analyze and troubleshoot DLL load dependency issues.
UglifyJS 3 is a JavaScript toolkit that provides parsing, minification, compression, and beautification capabilities for JavaScript code optimization and processing.
A PHP 5.x polyfill for random_bytes() and random_int() created by Paragon Initiative Enterprises.
DroidRA is an instrumentation-based Android security analysis tool that improves the accuracy of reflective call analysis through composite constant propagation techniques.
A bash script that analyzes executable files to check security properties like PIE, RELRO, canaries, ASLR, and Fortify Source protections.
Protect against Prototype Pollution vulnerabilities in your application by freezing JavaScript objects.
A collection of vulnerable web application test cases designed to benchmark and evaluate the effectiveness of static security analyzers and penetration testing tools.
StaCoAn is a cross-platform tool for static code analysis on mobile applications, emphasizing the identification of security vulnerabilities.
Prevents you from committing passwords and other sensitive information to a git repository.
Gitleaks is a SAST tool for detecting and preventing hardcoded secrets in git repos.
A static code analysis tool for parsing common data formats to detect hardcoded credentials and dangerous functions.
Argus-SAF is a static analysis framework for security vetting Android applications.
Using high-quality entropy sources for CSPRNG seeding is crucial for security.
A static analysis tool for Android apps that detects malware and other malicious code
A security feature to prevent unexpected manipulation of fetched resources.
A tool for redirecting HTTP and HTTPS requests to other URLs.
FlowDroid is a context-, flow-, field-, object-sensitive and lifecycle-aware static taint analysis tool for Android applications.
A tool that reveals invisible links within JavaScript files
A tool for identifying potential security vulnerabilities in web applications
A free online tool to scan for DOM-based XSS vulnerabilities in HTML, JavaScript, and CSS files.
A suite of secret scanners built in Rust for performance.
Common questions security professionals ask when evaluating alternatives and competitors to cfn-nag.
The most popular alternatives to cfn-nag include Meterian ISAAC, KICS, Snyk Infrastructure as Code, DeepSource SAST, and AquilaX. These Static Application Security Testing tools offer similar capabilities and are frequently compared by security professionals evaluating their options.
