Freedom251 › IT & Infrastructure
Free and open first
Best Cloud Vulnerability Scanners in 2026
Cloud vulnerability scanners help you examine security across cloud platforms, infrastructure-as-code, identities, and workloads. Compared on attack path analysis, identity analysis, IaC scanning, and workload scanning, the entries also indicate supported cloud platforms and deployment models. Free-plan availability and paid-from pricing add cost context. Intruder, Mondoo CSPM, and Trivy are among the options to compare, along with Grype and Kubescape. Consider the environments you need to assess and which kinds of scanning are relevant to your work; the listed coverage and deployment details offer concrete ways to evaluate fit.
- 28 apps
- Research read 23 Sept 2026
- How the order is worked out
- 1
Grype
Free plan Open source LinuxMacSelf-hosted+1Grype covers a broad range of scan targets and package ecosystems, with several output formats and vulnerability prioritization options.
- 2
Kubescape
Free plan Open source APILinuxMac+2Choose Kubescape if you want a free, self-hosted Kubernetes security platform with configuration, image, compliance, and runtime coverage.
- 3
Mondoo CSPM
Free plan Open source APIExtensionLinux+3Mondoo CSPM pairs cloud scanning and risk prioritization with reviewable remediation proposals and evidence tracking.
- 4
AccuKnox
Free plan LinuxSelf-hostedWebAccuKnox combines visibility and enforcement with several deployment models and broad stated compliance coverage.
- 5
Intruder
Free plan APILinuxMac+2Intruder combines continuous scanning with prioritization and remediation guidance across several kinds of targets.
- 6
Onam Security API Security
Free plan APILinuxMac+3Choose Onam Security API Security if your team needs to discover and assess API exposure across cloud environments, with configuration scans that do not send traffic to APIs.
- 7
Cy5 Cloud-Native Vulnerability Management
Free plan WebCy5 combines cloud workload scanning, risk prioritization, and compliance reporting across three named cloud providers.
- 8
Prowler Cloud
Free plan APILinuxSelf-hosted+1Choose Prowler Cloud if your team wants managed scans, compliance coverage, prioritized findings, and remediation guidance across cloud and related environments.
- 9
RapidFort
Free plan LinuxSelf-hostedWebRapidFort combines container vulnerability analysis, runtime profiling, image hardening, and compliance features in one offering.
- 10
Trivy
Free plan LinuxMacSelf-hosted+1Trivy combines several scanner types with broad installation and integration options, and it can generate SBOMs.
- 11
ZeusCloud
Free plan Self-hostedWebZeusCloud combines AWS asset visibility with risk analysis, rule controls and remediation guidance. It is self-hosted, and the project cautions users not to expose it to the public internet.
- 12
Anchore Enterprise
Free trial APILinuxSelf-hosted+1Choose Anchore Enterprise if your organization needs SBOM-driven security and compliance controls across software and runtime images.
- 13
Alibaba Cloud Security Center
Free plan WebConsider Security Center if you want web-based security coverage for one of its supported cloud platforms, with a free Basic plan or paid editions for additional capabilities.
- 14
OpenCNAPP
Free plan Self-hostedOpenCNAPP spans cloud posture, pipeline security, and runtime protection, with broad deployment options listed.
- 15
Amazon Inspector
Free trial APIWebAmazon Inspector brings workload, container, serverless, repository, and supported Azure scanning into a cloud service with risk prioritization and AWS integrations.
- 16
Astra Security
Free trial APIWebAstra Security combines automated scanning with human-led penetration testing and coverage for APIs and cloud infrastructure.
- 17
- 18
Cyscale CSPM
Free trial APIWebCyscale CSPM combines multi-cloud checks, risk prioritization, compliance mapping and tracked remediation.
- 19
Holm Security Cloud Security
Free trial APIWebChoose Holm Security Cloud Security if you need cloud posture assessments across its supported platforms, with continuous asset discovery and a risk remediation workflow.
- 20
Google Artifact Analysis
Paid APILinuxMac+1Artifact Analysis combines package and image scanning with metadata storage and access through Google Cloud interfaces.
- 21
Qualys TotalCloud
Free trial APIWebTotalCloud brings multiple cloud security functions and providers into one platform, with scanning and automated response options.
- 22
Tencent Cloud Security Center
Free plan WebChoose Tencent Cloud Security Center if your cloud security work spans Tencent Cloud or other cloud platforms and needs the four named scanning and analysis areas.
- 23
Datadog Cloud Security Management
Paid LinuxWebWindows - 24
Tenable One Cloud Security
Paid WebChoose Tenable One Cloud Exposure if your organization needs cloud asset visibility and risk analysis across multi-cloud or hybrid environments, with IaC scanning and guided remediation.
- 25
Huawei Host Security Service
Paid LinuxWebWindows
#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price
More in IT & Infrastructure
- CMDB Software39
- Competitor Price Monitoring Software39
- Container Management Software28
- Database Activity Monitoring Software23
- Database Performance Monitoring Software25
- Database Vulnerability Scanners27
- Data Center Infrastructure Management Software24
- Data Discovery and Classification Software29
- Data Masking Software26
- Data Security Posture Management Software34
- DDoS Protection Software37
- Desktop as a Service Software25