IaC Security platforms scan infrastructure-as-code templates — Terraform, CloudFormation, Kubernetes manifests, Helm charts, ARM/Bicep, Pulumi — for misconfigurations, policy violations, and exposures before the infrastructure is provisioned. Core capabilities include policy-as-code engines (Rego, Sentinel, custom DSLs), out-of-the-box rule packs for CIS, NIST, SOC 2, and PCI benchmarks, drift detection between declared and deployed state, PR-time shift-left scanning with fix suggestions, and integration with runtime cloud-security tools for closed-loop policy enforcement. IaC Security is the pre-deployment pair to CNAPP's runtime posture management. Leading tools include Checkov (Prisma Cloud), Snyk IaC, Tfsec/Trivy (Aqua), Terrascan (Tenable), HashiCorp Sentinel, and OPA Gatekeeper.