Terrascan is archived. Here's where to land.
Terrascan helped establish policy-as-code for infrastructure, and plenty of later tools borrowed from its OPA/Rego foundation. Tenable has now archived the project, and its final release will never receive another rule, fix, or CVE patch. You have to migrate anyway — so it's worth asking whether the replacement should be another pattern matcher, or an engine that reasons about your infrastructure before it judges it.
The measured comparison
We benchmarked Terrascan's final release against audytx on a public corpus before the archive froze its numbers for good. Full tables, methodology, and reproduction steps on the comparison page.
| Dimension | audytx | Terrascan (1.19.9, final) |
|---|---|---|
| IAM privilege-escalation corpus (31 paths) | 100% recall | DNF — exceeded the 5-minute timeout |
| False positives, 21 clean modules | 33 | 454 (14× more) |
| Worst single-module blowup | 6 | 348 HIGH alerts on one module (77% of its total) |
| Maintenance | actively developed; live engine version on /status | archived — frozen at v1.19.9 |
| Delivery | GitHub App + hosted MCP server + offline CLI | local CLI / admission controller |
Benchmark pinned to 2026-06-16, Terrascan 1.19.9 — the archive means these numbers can no longer change. Archive date and read-only status per the repository's own notice.
Map what Terrascan did for you to what's maintained
The useful question isn't "which tool replaces Terrascan" — it's which of its jobs you actually relied on. There were usually three:
"It scanned our Terraform in CI / on PRs" → audytx
This is the main one, and where you can gain the most. audytx reviews every pull request as a GitHub App — one comment, inline annotations, SARIF to GitHub Code Scanning — with cross-resource context deciding which findings are real. Where Terrascan produced 454 clean-module false positives, audytx produces 33, each suppression shown with its rationale. The offline CLI (audytx scan) covers the pre-commit and air-gapped cases.
"We wrote custom Rego policies" → policy-as-code tools
If you invested heavily in custom OPA/Rego policies, a maintained policy engine (Checkov's Python checks, or OPA itself in CI) preserves that investment. audytx takes a different approach: its checks are hand-built with cross-resource reasoning baked in, so the common policies teams wrote by hand — and their false-positive exceptions — come built in and context-aware.
"It scanned Kubernetes manifests and other clouds too" → a breadth tool
Terrascan's multi-format breadth maps to the maintained breadth tools — Checkov or Trivy (benchmarked here). audytx doesn't compete for that job: it's the precision layer for AWS Terraform, where IAM attack paths and cross-resource risk concentrate. Pairing a breadth tool with audytx covers both jobs.
What you gain in the move
Terrascan, like most scanners of its era, judged each resource in isolation. audytx builds relationship graphs first — who invokes what, which roles trust which principals, what's reachable from the internet — and evaluates every finding against that context. It's how the engine reaches 100% recall on the 31 documented IAM privilege-escalation paths (the corpus Terrascan couldn't finish) while firing the fewest false positives of the five tools benchmarked. And because the engine is deterministic Rust with no AI in the pipeline, the same input produces the same verdict, every run — with the reasoning written out where Rego gave you a bare deny.
Frequently asked questions
Is Terrascan still maintained?
No. Tenable archived the repository on November 20, 2025; it is read-only and accepts no further updates, issues, or pull requests. The final release is v1.19.9 from September 2024.
What should I replace Terrascan with?
Start from the job Terrascan was doing for you. For Terraform-on-AWS scanning in CI and PRs, audytx is the context-aware upgrade path (full IAM privesc recall, 14× fewer false positives in the public benchmark). For custom Rego policies or multi-format breadth, a maintained breadth tool like Checkov or Trivy covers that job — and pairs well with audytx as the precision layer.
How does audytx compare to Terrascan?
On the public benchmark: audytx reached 100% recall on the 31-path IAM privilege-escalation corpus that Terrascan timed out on, and fired 33 clean-module false positives to Terrascan's 454. Beyond the numbers, audytx is actively developed and reviews PRs as a GitHub App, while Terrascan is frozen at its final release.
Retire Terrascan in one afternoon
Install the GitHub App and audytx reviews your next pull request — free on every repo during the beta, no CI rewrite needed.