After tfsec: two paths forward for Terraform security
tfsec earned its place in many pipelines by making Terraform static analysis fast and frictionless. Its repository now says scanning effort is consolidated in Trivy. If tfsec is in your CI today, you have two paths: follow the move to Trivy, or use the move to upgrade the Terraform part of your pipeline to an engine that reasons across resources for AWS.
The two paths
Neither path rules out the other. Many teams take both.
| Dimension | Path 1 — Trivy | Path 2 — audytx |
|---|---|---|
| What it is | the tool the tfsec repository points to | a context-aware reviewer for AWS Terraform and CloudFormation |
| What you change | the migration guide maps trivy config <dir> to the tfsec command | install the GitHub App; no CI rewrite |
| Scope | images, dependencies, SBOMs, secrets and IaC across clouds | AWS only, reasoned about across resources |
| Findings that do not apply | .trivyignore and .trivyignore.yaml ignore files | set aside by context and listed with the reason |
| Delivery | the trivy command line | GitHub App and hosted MCP server |
Facts about tfsec and Trivy are from the tfsec repository and the Trivy repository and its documentation, checked 2026-10-01. More on the Trivy page; audytx's own measured results are on the benchmark page.
Or run both
A simple landing spot for former tfsec users: Trivy for images and dependencies, audytx for the AWS Terraform and CloudFormation pull requests, where IAM and cross-resource risk concentrate. audytx installs as a GitHub App and needs no change to your existing CI. For CloudFormation, see the CloudFormation benchmark.
Frequently asked questions
Is tfsec deprecated?
tfsec is not archived. Its repository says scanning efforts are consolidated into Trivy and engineering attention is directed there going forward, and it carries a tfsec-to-Trivy migration guide. In practice: tfsec is still available, but new work goes to Trivy.
What should I replace tfsec with?
Two paths: Trivy, which the tfsec repository points to, or audytx for AWS Terraform and CloudFormation review with every set-aside finding explained. Many teams run Trivy for artifacts and audytx for the AWS infrastructure pull requests.
Point audytx at the repo tfsec used to scan
Install the GitHub App and compare verdicts on your next pull request. The Free plan includes 100 scans a month.