After tfsec: two paths forward for Terraform security
tfsec earned its place in thousands of pipelines by making Terraform static analysis fast and frictionless. Aqua has since folded its development into Trivy, and new capability ships there now. So if tfsec is in your CI today, you have two options: follow the official consolidation into Trivy, or use the forced change to upgrade the Terraform part of your pipeline to an engine that reasons about resources instead of pattern-matching them.
Path 1 — follow the consolidation into Trivy
Same checks, new binary
tfsec's Terraform engine lives on inside Trivy (trivy config), and Aqua's
migration guide maps the flags and config across. If tfsec was doing exactly what you
needed, this path preserves it with a maintained toolchain — and adds container, image,
and SBOM scanning in the same binary. It also inherits the engine's design: single-resource
pattern matching. In our public benchmark, Trivy's Terraform scanning fires
175 false positives on 21 clean modules and detects 0 of the 31 documented IAM
privilege-escalation paths — the closest measurement we have for what the
tfsec engine's approach can see. Full context on the Trivy page.
Path 2 — upgrade the Terraform slice to a reasoning engine
audytx — context-aware review, not another checklist
audytx came later, and it's built around a different core: map how resources relate (invocation, IAM trust, encryption, exposure, lifetime), let rules fire naively, and let context decide what survives — every suppression shown with its written reason. On the same public corpus, that design reaches 100% recall on all 31 IAM privilege-escalation paths with 33 clean-module false positives — the fewest of the five tools benchmarked. It ships as a GitHub App (one comment per PR, SARIF to Code Scanning), a hosted MCP server for AI coding agents, and an offline CLI for pre-commit gates.
The measured difference
tfsec itself no longer receives new checks, so the comparison that matters is between its successor engine (inside Trivy) and audytx. Numbers from the pinned public benchmark — methodology and reproduction on the comparison page.
| Dimension | audytx | Trivy (tfsec's successor engine) |
|---|---|---|
| IAM privilege-escalation recall (31 paths) | 100% | 0% |
| False positives, 21 clean modules | 33 | 175 |
| False-positive handling | context-proven suppression, rationale shown | inline ignore comments |
| Scope | AWS Terraform, reasoned about deeply | containers, images, SBOMs, K8s, multi-cloud IaC |
| Delivery | GitHub App + hosted MCP server + offline CLI | CLI / CI step |
tfsec was not separately benchmarked — its repository directs new work to Trivy, so Trivy's measured row stands in for it. Trivy scope per its repository (actively maintained by Aqua Security).
Or run both paths at once
The two paths also combine well. Trivy is very good at consolidating
containers, images, and SBOMs into one binary — surfaces audytx doesn't cover. A clean
landing spot for former tfsec users: Trivy for the artifact surface, audytx for
the Terraform, where IAM attack paths and cross-resource risk concentrate.
audytx installs as a GitHub App in about a minute, needs no CI rewrite, and its offline
CLI (audytx scan) slots into the same pre-commit hook tfsec used to occupy.
Frequently asked questions
Is tfsec deprecated?
Aqua has not archived tfsec, but its repository states that scanning efforts are consolidated into Trivy and engineering attention is directed there going forward, with an official tfsec-to-Trivy migration guide. In practice: tfsec still runs, but new capability ships in Trivy.
What should I replace tfsec with?
Two paths: Trivy (the official successor — same engine lineage, plus container/image/SBOM scanning) or audytx (a context-aware engine for AWS Terraform — 100% IAM privilege-escalation recall and the fewest clean-module false positives in our public benchmark). Many teams run Trivy for artifacts and audytx for Terraform.
Is audytx a tfsec alternative?
For AWS Terraform, yes — and a bigger step than swapping one linter for another: audytx reasons across resources (IAM trust graphs, invocation chains, exposure) instead of pattern-matching single blocks, which is how it reaches full IAM privesc recall at the lowest false-positive count of the five tools benchmarked.
Point audytx at the repo tfsec used to scan
Install the GitHub App and compare verdicts on your next pull request — free on every repo during the beta.