diff --git a/tox.ini b/tox.ini
index 760029767b..e5d2b13ec6 100644
--- a/tox.ini
+++ b/tox.ini
@@ -51,13 +51,13 @@ commands =
   bash -c "find keystone -type f -regex '.*\.pot?' -print0| \
            xargs -0 -n 1 msgfmt --check-format -o /dev/null"
   # Run security linter
-  bandit -r keystone
+  bandit -r keystone -x tests
 
 [testenv:bandit]
 # NOTE(browne): This is required for the integration test job of the bandit
 # project. Please do not remove.
 deps = .[bandit]
-commands = bandit -r keystone
+commands = bandit -r keystone -x tests
 
 [testenv:cover]
 commands =