Infrastructure as Code (IaC) misconfiguration scanner
IaC scanners safeguard cloud infrastructure by identifying misconfigurations before deployment, preventing vulnerabilities in your operational environment.
IaC misconfiguration scanners safeguard your cloud infrastructure by identifying security risks and compliance violations in your Infrastructure as Code templates prior to deployment. By shifting security left, this closes the gap between code-time definitions and production-time security posture, preventing overly permissive policies, unencrypted buckets, or privileged containers from silently propagating into live environments.
The IaC Misconfigurations page consolidates all scanner-detected issues across monitored repositories into a single view where you can prioritize, investigate, remediate, and track SLA compliance.
Supported frameworks and languages
Refer to Supported frameworks and languages for information.
Workflows
Prerequisites
License
An active Cortex Cloud license with Application Security add-on entitlements
RBAC Role
The AppSec Admin or SOC Analyst role, or an equivalent custom role with issue management permissions. The Developer role grants read-only access
VCS Integration
At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active
IaC Scanner
The IaC scanner enabled for the target repositories. For supported frameworks, see Supported frameworks and languages
Periodic or PR Scan
At least one completed periodic scan or PR scan that includes IaC scanning results
YOR tags (for Urgency)
YOR trace tags applied to IaC resources. Without YOR tags, the Asset Lineage Graph cannot link the template to the deployed resource, and the deployment-dependent Urgency metrics cannot be computed
Core achievements and use cases
Shifting security left and developer integration: Detecting infrastructure misconfigurations at code-time, before cloud resources are provisioned, reduces the cost and risk of post-deployment remediation. IaC scans identify and flag critical issues such as insecure defaults and compliance violations directly within your IaC templates across various supported frameworks. This scanning integrates seamlessly into development workflows. Developers can detect findings locally using the Cortex CLI or directly within supported IDEs (Visual Studio Code, JetBrains) via plugins, providing real-time security feedback as they write code
Accelerating issue remediation: Automated fix pull requests and manual fix guidance enable developers to resolve IaC misconfigurations directly in the source repository without context-switching to external tools. All Critical and High IaC misconfiguration findings are categorized as actionable issues. The platform streamlines remediation efforts by offering automated fixes that can modify the configuration directly
Reducing misconfiguration noise: Urgency-based prioritization isolates the IaC misconfigurations that affect deployed, internet-exposed, or business-critical assets from low-risk findings in development environments
Establishing compliance baselines and policy enforcement: Mapping IaC misconfigurations to detection rules (such as
CKV_K8S_16, CKV_AWS_1) provides auditable evidence of compliance with CIS Benchmarks and organizational security policies. Furthermore, you can create and apply custom policies and rules that define how the system responds to IaC threats, allowing for tailored security checks and automated actions, such as blocking CI runs or pull requests based on detected misconfigurations
Last updated
Was this helpful?