> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/infrastructure-as-code-scanning.md).
# Infrastructure as Code scanning
Infrastructure as Code (IaC) scanning is a security testing practice that analyzes IaC configurations to identify misconfigurations, security vulnerabilities, and compliance issues before deployment. By scanning IaC templates such as Terraform, CloudFormation, Kubernetes manifests, and other configuration files, teams can detect security risks early in the development process.
With Harness Security Testing Orchestration (STO), you can perform IaC scanning using [integrated scanners](#supported-scanners-for-iac). STO enhances the scanning process by normalizing results, deduplicating findings, and formatting them into actionable insights.
### Set up IaC Scanning with Harness STO
You can use any of the [integrated scanners](#supported-scanners-for-iac) that perform IaC scanning. Select any of the scanners below for detailed configuration steps.
#### Supported Scanners for IaC
Below is the list of scanners supported for IaC in Harness STO:
If the scanner you use for IaC is not listed, you can explore additional [scanners](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) that are compatible with the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md). If the Custom Scan step does not support the scanner you need, you can use the [Custom Ingestion](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-ingest-reference.md) step to ingest and process your scan results.
### Next steps