Skip to content
SPECIFICTION
Get listed

Chef InSpec

docs.chef.io

From $4.92/mo Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit docs.chef.io
Spec score 9.4 #1 of 29 in Security Configuration Management Software

What it is

Chef InSpec tests and audits applications and infrastructure against a desired state described in InSpec code. Its runtime framework and rule language express compliance, security and policy requirements. Reusable profiles group controls and can include versioning, platform requirements and dependencies. Resources support testing AWS, Azure, AliCloud and GCP infrastructure, and users can create custom resources. Tests can run locally or against cloud services and infrastructure such as Linux in Docker containers. Results can be exported as JSON, HTML or plain text, or sent to Chef Automate. The kitchen-inspec verifier also runs profiles through Test Kitchen. Chef offers premium CIS- and STIG-based profiles for compliance scanning. The free tier is for non-production workloads and personal, non-commercial use; the 30-day trial is for product evaluation under non-production conditions. Commercial licensing covers production and non-production workloads, with entitlements based on purchase order. Chef InSpec 7 requires EULA acceptance, and license-key requirements depend on the distribution source. Telemetry is enabled for free and trial tiers, but not commercial users.

Spec sheet

What it does
Chef InSpec is a framework and rule language that tests applications and infrastructure against desired security, compliance and policy states, reporting violations for users to remediate.Read 14 Oct 2026 · docs.chef.io
Purpose
Chef InSpec tests and audits applications and infrastructure by comparing their actual state with a desired state expressed in InSpec code.Read 29 Sep 2026 · docs.chef.io
Integrations
The kitchen-inspec verifier lets users run InSpec profiles through Test Kitchen.Read 29 Sep 2026 · docs.chef.io
Support
The licensing page lists community Slack support for Free and Trial tiers and contract support for Commercial licenses.Read 29 Sep 2026 · docs.chef.io
Acquisition
Progress announced completion of its Chef Software acquisition on October 6, 2020, paying $220 million in cash.Read 14 Oct 2026 · investors.progress.com
Automate API integration
The Automate reporter sends results to a data-collector URL using an Automate API token and node identity fields.Read 14 Oct 2026 · docs.chef.io
Cloud coverage
Official resources target AWS, Azure, Alibaba Cloud and Google Cloud Platform services.Read 14 Oct 2026 · docs.chef.io
Company profile
LinkedIn lists Progress Chef as a privately held Seattle company founded in 2008 with 201–500 employees.Read 14 Oct 2026 · linkedin.com
Compliance as code
InSpec is a runtime framework and rule language for specifying compliance, security, and policy requirements.Read 29 Sep 2026 · docs.chef.io
Controls
A control represents a regulatory recommendation or system-state requirement, and profiles can contain many controls.Read 14 Oct 2026 · docs.chef.io
Custom resources
Users can create custom resources when the built-in resource collection does not cover a required test.Read 14 Oct 2026 · docs.chef.io
Documentation depth
The documentation includes installation, supported platforms, profiles, resource packs, reporters, plugins, licensing and Test Kitchen integration guides.Read 14 Oct 2026 · docs.chef.io
Installation
Chef documents native installers for Windows and Linux distributions and Habitat packages for macOS, Windows, and Linux distributions.Read 29 Sep 2026 · docs.chef.io
Installation formats
Official installers include macOS ARM64 DMG, Windows MSI, Debian DEB and RPM packages, plus Habitat packages.Read 14 Oct 2026 · docs.chef.io
License requirements
Chef InSpec 7 requires EULA acceptance, and whether a license key is needed depends on the distribution source.Read 29 Sep 2026 · docs.chef.io
License-key requirement
InSpec 7 installations from the Progress portal, Habitat or Commercial Downloads API do not require a license key, while external sources may require one.Read 14 Oct 2026 · docs.chef.io
Licensing model
The source repository is Apache-2.0, while packaged Progress Chef distributions are governed by the Chef EULA.Read 14 Oct 2026 · github.com
Limit: complexity
G2 reviewers report difficult setup, a steep learning curve, confusing documentation and extra operational work for smaller environments.Read 14 Oct 2026 · g2.com
Limit: pricing
A G2 reviewer says hosted and premium editions cost more than they can afford and that management-console, analytics and high-availability features are excluded from the free edition.Read 14 Oct 2026 · g2.com
Limit: scanning behavior
A TrustRadius reviewer reports that scheduled scans covered only instances present when a job was created and did not continuously discover new account assets.Read 14 Oct 2026 · trustradius.com
Notable release
Chef InSpec 7.1.7 was released May 11, 2026 and moved the 7.1 line to Chef Habitat builds rather than traditional Omnibus builds.Read 14 Oct 2026 · docs.chef.io
Open-source activity
The InSpec GitHub organization shows public repositories for the core framework, documentation, Train transport layer and cloud/database resource packs, with recent updates in 2026.Read 14 Oct 2026 · github.com
Plugin extensibility
InSpec plugins can add reporters, input sources, CLI commands, DSL extensions and custom resources, while Train plugins add transports for new hosts or APIs.Read 14 Oct 2026 · docs.chef.io
Praise: automation
G2 reviewers repeatedly praise reusable cookbooks, infrastructure automation, configuration consistency and InSpec testing in deployment pipelines.Read 14 Oct 2026 · g2.com
Praise: enterprise integration
TrustRadius reviewers say InSpec auditing, Chef Automate visibility and Habitat integrate well for managing large datacenters.Read 14 Oct 2026 · trustradius.com
Premium compliance content
Chef offers curated profiles aligned with CIS and DISA STIG benchmarks plus remediation content for Chef Compliance and InSpec.Read 14 Oct 2026 · chef.io
Profiles
Profiles package reusable controls with metadata, versioning, platform declarations and dependencies.Read 14 Oct 2026 · docs.chef.io
Rating on G2
4.2 out of 5 from 105 reviewsRead 14 Oct 2026 · g2.com
Rating on TrustRadius
6.5 out of 10 from 49 reviews and ratingsRead 14 Oct 2026 · trustradius.com
Reporting
Reporters can emit CLI, HTML, JSON, YAML and progress-bar results or send results to Chef Automate.Read 14 Oct 2026 · docs.chef.io
Resource packs
Official resource packs cover AWS, Azure, Docker, Elasticsearch, GCP, Habitat, Kubernetes, MongoDB, Podman and RabbitMQ.Read 14 Oct 2026 · docs.chef.io
Security standards
Chef offers premium CIS- and STIG-based profiles for compliance scanning across enterprise assets.Read 29 Sep 2026 · docs.chef.io
Self-hosting
InSpec runs locally or against remote targets and can be installed as a native package, Habitat package or Ruby-based source distribution.Read 14 Oct 2026 · github.com
Supported systems
Commercial support lists Amazon Linux, Debian, macOS, Oracle Linux, Red Hat Enterprise Linux, SUSE Linux, Ubuntu and Windows, with x86-64 and selected ARM64 support.Read 14 Oct 2026 · docs.chef.io
Targets
Tests can run locally or against cloud services and infrastructure such as Linux in Docker containers.Read 29 Sep 2026 · docs.chef.io
Telemetry
The Chef Licensing Telemetry service gathers activation, usage, environment, and bug data for InSpec and is enabled for free and trial tiers, but not commercial users.Read 29 Sep 2026 · docs.chef.io
Test Kitchen integration
The kitchen-inspec plugin lets Test Kitchen use InSpec profiles as its verifier, including profiles from Compliance, Supermarket or local files.Read 14 Oct 2026 · docs.chef.io

Plans and prices

Free Free Unlimited duration · non-production workloads · personal and non-commercial use Read 29 Sep 2026 · docs.chef.io
Free Free Personal/non-commercial use · Scan up to 10 targets · Unlimited duration Read 14 Oct 2026 · docs.chef.io
Trial Free 30 days Trial users may scan unlimited targets for 30 days Read 14 Oct 2026 · docs.chef.io
Trial Free 30 days · non-production workloads · product evaluation Read 29 Sep 2026 · docs.chef.io
Business $59 a year per node, per year Node management · Job orchestration · Configuration management · Standard support · 10 pooled monthly jobs per node · 10 concurrent jobs · 30-day data/log retention Read 14 Oct 2026 · chef.io
Enterprise $189 a year per node, per year Business features · Desktop management · Compliance audit · Standard support · 10 pooled monthly jobs per node · 10 concurrent jobs · 30-day data/log retention Read 14 Oct 2026 · chef.io
Commercial Priced on request Renewable · production and non-production workloads · entitlements based on purchase order Read 29 Sep 2026 · docs.chef.io
Enterprise Plus Priced on request Contact us for a customized quote Continuous compliance · Cloud security posture management · Application delivery · Premium support · 50 concurrent jobs · Up to 60-day retention with dedicated instance Read 14 Oct 2026 · chef.io

Every Chef InSpec plan and price →

Strong points and limits

Strong points

  • Profiles group reusable controls with platform requirements.
  • Resources cover AWS, Azure, AliCloud and GCP.
  • Results can be sent to Chef Automate.
  • A 30-day evaluation trial is available.

Limits

  • Free use excludes production workloads.
  • Free use excludes commercial activity.
  • License-key requirements vary by distribution source.
  • Telemetry is enabled for free and trial tiers.

Who it suits

It suits teams that need to express compliance, security or policy requirements as code and audit infrastructure. The free tier is limited to personal, non-commercial use and non-production workloads.

Chef InSpec in depth

Read the full write-up

Chef InSpec is a compliance-as-code framework for testing applications and infrastructure against policy written in InSpec code. It suits engineering and security teams that want reusable checks across local, cloud, and container environments. Its code-driven approach is flexible, but licensing terms and the free tiers’ non-production limits matter when planning adoption.

Overview

InSpec compares a system’s actual state with a desired state expressed as code, making it useful for security, compliance, and policy checks as well as infrastructure testing. It can assess targets locally or reach cloud services and infrastructure, including Linux in Docker containers. This hybrid model suits teams working across environments, though teams should confirm the applicable license conditions before making it part of a production workflow.

Readers comparing Infrastructure Testing Tools or Security Configuration Management Software will find InSpec’s clearest distinction in its reusable, code-based controls.

Key features

Reusable profiles

Profiles gather controls into artifacts that can be versioned and can declare platform requirements and dependencies. That structure helps teams maintain a collection of checks over time instead of rebuilding individual audits for each use.

Cloud resources and extensibility

Resources cover infrastructure in AWS, Azure, AliCloud, and GCP, and users can create custom resources. This breadth is useful for multi-cloud assessments, while custom resources provide a route to cover needs beyond the supplied resource set.

Reporting and integration

Audit results can be exported as JSON, HTML, or plain text, or sent to Chef Automate. The kitchen-inspec verifier also lets teams run InSpec profiles through Test Kitchen, connecting checks to that testing workflow.

Compliance content

Chef offers premium CIS- and STIG-based profiles for scanning enterprise assets. They provide a route to standards-based checks, but they are premium content rather than part of the free plan.

Pricing

InSpec is freemium. The Free plan costs nothing and has unlimited duration, but is restricted to non-production workloads and personal, non-commercial use. It fits individual or non-commercial evaluation, not a production deployment.

The Trial plan costs nothing for 30 days and is limited to non-production workloads and product evaluation. It gives prospective users a defined evaluation period, but is not a continuing production option. The Commercial plan has custom pricing, is renewable, and covers production and non-production workloads; entitlements are based on the purchase order. Chef lists contract support for Commercial licenses, while Free and Trial tiers receive community Slack support.

Chef InSpec 7 requires EULA acceptance, and the need for a license key depends on the distribution source. The Chef Licensing Telemetry service gathers activation, usage, environment, and bug data for Free and Trial tiers; it is not enabled for commercial users. These distinctions make the distribution and tier choice material, especially for organizations evaluating non-commercial use before moving to a commercial license.

Platforms

InSpec supports API, Linux, macOS, self-hosted, and Windows environments. Chef documents native installers for Windows and Linux distributions, and Habitat packages for macOS, Windows, and Linux distributions.

Who it's for

InSpec is a strong fit for teams that want compliance and policy checks maintained as code, especially when they need versionable profiles and assessments across cloud environments. Its reporting formats and Test Kitchen verifier also suit teams that want checks to feed into an existing testing or reporting workflow. It is a weaker fit for buyers seeking a free production license, since the Free and Trial plans are both restricted to non-production workloads.

Pros and cons

Reusable controls: Versionable profiles with platform requirements and dependencies help teams maintain and apply checks consistently.

Broad assessment targets: Local, cloud, and container targets, plus resources for four cloud providers and custom resources, support varied infrastructure.

Flexible outputs: JSON, HTML, plain text, and Chef Automate reporting accommodate different review workflows.

Free use is constrained: Both no-cost tiers are non-production only, and the Trial ends after 30 days.

Licensing needs attention: InSpec 7 requires EULA acceptance, and license-key requirements vary by distribution source; Free and Trial tiers also have licensing telemetry enabled.

Standards profiles are premium: CIS- and STIG-based enterprise scanning profiles are offered as premium content.

Alternatives

Choose Qualys External Attack Surface Management if a 30-day no-cost CSAM with EASM offer is a better match for a time-limited evaluation; its listed platforms are API, Linux, and web.

Prowler Cloud is worth comparing if its 15-day trial with no cloud account limit and access to every check and compliance framework fits your evaluation; its Open Source plan is also free.

Mondoo CSPM may suit readers seeking free-forever open-source tools for cloud, Kubernetes, OS, SaaS, and API scanning, with a Kubernetes operator and extensible provider system.

Consider Puppet if a configuration management product with a free 10-node Enterprise allowance is more relevant; its Enterprise plans use custom pricing.

CrowdStrike Falcon Surface is another paid alternative.

Kubescape is a free, self-hosted open-source option under Apache 2.0, with a CLI and Kubernetes operator.

Rapid7 Surface Command is another paid alternative.

Lynis is a free, open-source option for Linux, macOS, and self-hosted environments; its SaaS premium plan is $36 a year.

Verdict

Choose Chef InSpec if your team wants policy and compliance checks expressed as reusable code across local and cloud infrastructure, and can use a commercial license for production. Its strongest reason to choose it is the combination of profiles, cloud resources, and multiple reporting paths; look elsewhere if you need production use without commercial licensing or prefer not to accept the InSpec 7 EULA and free-tier telemetry conditions.

Verdict

InSpec offers multiple ways to run checks and export results, with reusable profiles and cloud resources. Review the licensing conditions, including the free-tier limits and InSpec 7 EULA requirement.

Where Specifiction places it

Alternatives to Chef InSpecAll alternatives →