Use when infrastructure code (Terraform, CloudFormation, Kubernetes, Helm, ARM, Serverless, CDK) needs security scanning with the broadest built-in rule set: Checkov with custom Python checks, SARIF and JUnit output, and a baseline so CI fails only on new findings. Single-tool option: trivy-config.