TerraGoat is the canonical vulnerable Terraform repository maintained by Bridgecrew (now Prisma Cloud). It has over 5,000 GitHub stars and is used by security teams worldwide as the benchmark for validating IaC scanners. The premise is straightforward: run your tool against TerraGoat, check how many of the known vulnerabilities it catches.
The problem is that the "known vulnerabilities" reference list is incomplete by design — or by oversight. This research quantifies that gap for the first time.
Methodology
Three tools were run against TerraGoat in isolation, with no tuning or custom rules:
Checkov — the official Bridgecrew scanner, the tool TerraGoat was originally built to test
