TY  - JOUR
AU  - Roe, Harry
AU  - Gogate, Mandar
AU  - Dashtipour, Kia
PY  - 2026
DA  - 2026/05/29
TI  - Multicloud Security Assessment: A Benchmark Study of Infrastructure as Code Scanners
JO  - ICCK Transactions on Information Security and Cryptography
T2  - ICCK Transactions on Information Security and Cryptography
JF  - ICCK Transactions on Information Security and Cryptography
VL  - 2
IS  - 2
SP  - 109
EP  - 118
DO  - 10.62762/TISC.2026.777114
UR  - https://www.icck.org/article/abs/TISC.2026.777114
KW  - multicloud
KW  - infrastructure
KW  - code scanners
AB  - Multicloud environments are becoming more common, often businesses will have workloads across one or more of AWS, Azure and GCP, with each provider slightly differing in security features and capabilities. Furthermore, Infrastructure as Code is increasing in popularity meaning cloud resources are being provisioned as code through automation pipelines as opposed to GUI/Portal deployments. This shift means that security scanning of the resource code is a crucial first step in securing a cloud environment, and the tool(s) being used for this need to be able to perform at a consistent level across all the different cloud providers. Failure to do this could mean the introduction of security vulnerabilities to the environment, possibly vulnerabilities that have been caught for one cloud provider but not another. This study analyses three well-used Infrastructure as Code scanners when used in resource deployments to the three major cloud providers: AWS, Azure and GCP. The experiment was performed in an isolated CI pipeline to mirror a production workload and used intentionally vulnerable code to give the tools a benchmark number of findings. The findings show a difference in performance for the three tools based on the cloud provider, proving emphatically the importance of understanding all default security controls in a cloud environment and how they can differ based on the provider, as well as the rule coverage for the tools being considered. The findings of this project can be used to give professionals a more informed opinion when choosing one or more of these security scanners.
SN  - 3070-2429
PB  - Institute of Central Computation and Knowledge
LA  - English
ER  - 

@article{Roe2026Multicloud,
  author = {Harry Roe and Mandar Gogate and Kia Dashtipour},
  title = {Multicloud Security Assessment: A Benchmark Study of Infrastructure as Code Scanners},
  journal = {ICCK Transactions on Information Security and Cryptography},
  year = {2026},
  volume = {2},
  number = {2},
  pages = {109-118},
  doi = {10.62762/TISC.2026.777114},
  url = {https://www.icck.org/article/abs/TISC.2026.777114},
  abstract = {Multicloud environments are becoming more common, often businesses will have workloads across one or more of AWS, Azure and GCP, with each provider slightly differing in security features and capabilities. Furthermore, Infrastructure as Code is increasing in popularity meaning cloud resources are being provisioned as code through automation pipelines as opposed to GUI/Portal deployments. This shift means that security scanning of the resource code is a crucial first step in securing a cloud environment, and the tool(s) being used for this need to be able to perform at a consistent level across all the different cloud providers. Failure to do this could mean the introduction of security vulnerabilities to the environment, possibly vulnerabilities that have been caught for one cloud provider but not another. This study analyses three well-used Infrastructure as Code scanners when used in resource deployments to the three major cloud providers: AWS, Azure and GCP. The experiment was performed in an isolated CI pipeline to mirror a production workload and used intentionally vulnerable code to give the tools a benchmark number of findings. The findings show a difference in performance for the three tools based on the cloud provider, proving emphatically the importance of understanding all default security controls in a cloud environment and how they can differ based on the provider, as well as the rule coverage for the tools being considered. The findings of this project can be used to give professionals a more informed opinion when choosing one or more of these security scanners.},
  keywords = {multicloud, infrastructure, code scanners},
  issn = {3070-2429},
  publisher = {Institute of Central Computation and Knowledge}
}