Infrastructure as code (IaC) can be a boon to developers that want to create applications fast without manually configuring resources for these apps. It uses code to automatically manage and provision things like servers, storage, databases, networks, and logs, and this saves time and money by removing the manual component.

But it’s not without security risk.

“With every Yin, there is a Yang, and while IaC increases agility, any misconfiguration can cause a security risk and this will be blind to traditional security tools,” said Zeus Kerravala, principal analyst at ZK Research.

Misconfigurations can expose internal networks or cause compliance issues as configurations drift, he explained.

“Unless you’re an IaC expert, it can be difficult to catch errors,” added Melinda Marks, senior analyst at Enterprise Security Group. “Misconfigurations that are easy to miss by the untrained eye — such as missing encryption at rest, or leaving an S3 bucket open — could expose company or client data if pushed into production.”

While open source IaC testing tools exist, “most developers don’t want to stay on top of identifying and learning how to use the best tools, and they don’t want to have to become experts on IaC or security,” Marks added.

But as the speed at which developers push apps into production continues to increase, thanks in large part to IaC, security needs to keep up, and this means “shifting left” in the development process. This is where IaC security tools come into play.

“If you’re responsible for security at an organization using IaC, you would want an IaC security solution to help you work with developers to consistently apply secure practices across the software development lifecycle to reduce your risk of security misconfigurations deployed to production, where problems could impact company or customer data,” Marks said.

To help enterprises prevent misconfigurations and fix IaC flaws, several security companies have been adding IaC security tools to their portfolio. While some cloud security vendors such as Fugue and Qualys developed this technology internally, others have been scooping up IaC companies at breakneck speed.

“It is interesting to see the acquisition activity in this space as organizations typically don’t want another solution or dashboard, or more alerts on issues,” Marks said. “So we’re seeing application security, cloud security posture management, and vulnerability management vendors rolling it into their offerings, either by acquiring solutions, or by building their own.”

A couple weeks ago cloud-security unicorn Lacework acquired Soluble to help its customers integrate security earlier in the software delivery process by remediating IaC flaws. Soluble’s technology conducts static analysis of code, and it also inspects risk, impact, cost, and potential policy violations in IaC via popular development tools including Terraform, CloudFormation, and Kubernetes.

“The good thing about product integration is there’s not a lot of heavy lifting for us on this because build time is so different from our runtime platform,” Lacework VP of Product Adam Leftik said. “Soluble really brings that build time capability into the platform, and doesn't require a lot of traditional heavyweight, back-end operation.”

Some other security platform vendors acquiring IaC startups to build security into the development process include Sysdig, which inked a deal to buy Apolicy over the summer, and Tenable, which announced an agreement to acquire Accurics in September.

Earlier this year Palo Alto Networks acquired BridgeCrew to add IaC security to Prisma Cloud, and it rolled out those new capabilities during last week’s Ignite event.

“This is a great move for Palo Alto Networks,” Kerravala said. “They’ve already established themselves as a foundational security vendor — something the industry has never had — now BridgeCrew enables them to offer products much earlier in the stack than it had been able to historically.”

While developer-focused security company Snyk already had an IaC product on the market, earlier this month it bought CloudSkiff, a Paris-based company that created an open source tool for drift detection.

In an earlier interview with SDxCentral, Snyk co-founder and President Guy Podjarny said CloudSkiff would boost Snyk’s IaC product capabilities. Driftctl catches drift outside of a developer’s infrastructure code, and this provides an important tool to identify discrepancies post deployment, he explained.

“It might have changed because of a security flaw, but most of the time it changes because there was some ad-hoc problem in the infrastructure, or somebody wants to access some system and therefore just opened a port, or wanted to gather some data and therefore changed some permissions,” he said. “Development today is very fast moving, and that type of occurrence happens a lot.”

Of course, these are only a handful of examples of vendors buying or building IaC security into their portfolios, and analysts say this trend will continue. “I would expect Fortinet to do the same as would VMware,” Kerravala said. “Given Cisco owns AppD, this would be make a nice compliment to it as well.”

Looking ahead, Marks said she expects more activity in the space “both from startups challenging traditional vendors with developer-centric tools, and the established vendors making a play to become the one-stop cloud security shop.”

Security needs to keep pace with the speed of modern software development, she added. And with developers far outnumbering cybersecurity professionals, security teams can’t afford to be a bottleneck to business, nor do they want to waste precious human resources wading through alerts or vulnerability lists.

“IaC security is a new item on the checklist for ways to reduce cloud security risk, but the solutions vary from basic static testing to ways to manage policy, and faster ways to remediate issues that are tied to other data and context from other security products,” Marks said. “The key will be seeing how these bigger vendors integrate solutions in their offerings over time in ways that help security work more efficiently to meet the demands of modern software development.”