CIS-CAT Pro Assessor vs Conftest
CIS-CAT Pro Assessor
cisecurity.orgConftest
conftest.devSide by side
| Figure | CIS-CAT Pro Assessor | Conftest |
|---|---|---|
| Price from | $200/mo | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 12 | 1 |
| Spec score · Infrastructure Testing Tools | 9.3 (#2) | 8.4 (#4) |
| Purpose | CIS-CAT Pro Assessor scans systems and reports their compliance with CIS Benchmarks. | Conftest is a utility for writing tests against structured configuration data. |
| Support | CIS SecureSuite membership includes technical product support, and the product page says dedicated Member Success Managers and enhanced technical support are available. | Questions and discussions are directed to the Open Policy Agent Slack channel `#opa-conftest`. |
Plans
CIS-CAT Pro Assessor
- CIS-CAT LiteFree
- CIS SecureSuite End User Membership (up to 99 employees)$2,400 a year
- CIS SecureSuite End User (up to 99 employees)$2,400 a year
- CIS SecureSuite Controls Membership$3,600 a year
- CIS SecureSuite End User (100–499 employees)$5,500 a year
- CIS SecureSuite End User Membership (100–499 employees)$5,500 a year
- CIS SecureSuite End User (500–999 employees)$7,900 a year
- CIS SecureSuite End User Membership (500–999 employees)$7,900 a year
- CIS SecureSuite End User Membership (1,000–4,999 employees)$10,900 a year
- CIS SecureSuite End User Membership (5,000–24,999 employees)$12,800 a year
In their own words
CIS-CAT Pro Assessor
CIS-CAT Pro Assessor has no write-up on Specifiction yet; its figures are above.
Conftest
Conftest is a free utility for testing structured configuration data, designed for use in CI environments. It uses the Open Policy Agent Rego language to express policies, then evaluates deny, violation, and warning rules within namespaces. Configuration can be read from individual files, directories, multiple files, or standard input. Supported inputs include Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, and XML. Results can be output as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF; the GitHub outputter can annotate test results in workflows. The `conftest verify` command runs policy unit tests. Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, or pushed to compatible OCI registries. Plugins extend the CLI, with downloads available from sources including OCI, Git, HTTP/HTTPS, Mercurial, and cloud storage. Pre-commit hooks support policy workflows, and integrations are documented for CircleCI, GitHub Actions, and Tekton. Conftest is available for Linux, macOS, and Windows.