KICS
KICS is an open-source static code analysis solution for finding security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrast…
What KICS is
KICS is an open-source static code analysis solution for finding security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrastructure as Code (IaC). It covers formats including Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, OpenAPI, Pulumi, and others. Its security queries can be edited, extended, or supplemented with custom queries. Documented CI integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, Terraform Cloud, and AWS CodeBuild, and a Visual Studio Code extension can scan automatically. KICS runs as a Docker image or can be built from source; downloadable releases are available for Linux, Windows, and macOS. Scan results can be exported in formats such as JSON, SARIF, JUnit, HTML, PDF, and CSV. The project is powered by Checkmarx and is free. For Terraform, documented limits include unsupported functions and environment variables, as well as no support for unofficial or custom modules.
Good
- Free, open-source project
- Customizable and extendable security queries
- Integrates with many documented CI tools
- Exports results in multiple formats
- Offers a Visual Studio Code extension
Watch out
- Terraform functions and environment variables are unsupported
- Unofficial and custom Terraform modules are unsupported
Who it suits
KICS suits teams that want to scan IaC for security, compliance, and configuration issues and adapt queries to their needs. It is relevant to developers using its supported IaC formats and CI integrations.
Verdict
KICS offers IaC scanning across a broad set of listed technologies, with configurable queries and several reporting formats. Check the Terraform limitations against your code before relying on it.
Plans and prices
From KICS's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| KICS | Free | Open-source project; the project site describes it as free |
The facts
Each one read from KICS's own pages, with the date it was checked.
What it does
- Certifications
- The documentation lists previous CIS certifications for AWS Foundations and Kubernetes benchmarks.checked 4 Oct 2026
- CI integrations
- Documented integrations include Azure Pipelines, Bamboo, Bitbucket Pipelines, CircleCI, Codefresh, GitHub Actions, GitLab CI, Jenkins, TeamCity, Travis, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and AWS CDK.checked 4 Oct 2026
- Editor integration
- KICS provides an auto-scanning extension for Visual Studio Code.checked 4 Oct 2026
- Installation
- KICS can be run as a Docker image or built from source; its documentation also provides downloadable releases for Linux, Windows, and macOS.checked 4 Oct 2026
- Purpose
- KICS is an open-source static code analysis solution that finds security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrastructure as Code.checked 4 Oct 2026
- Queries
- KICS provides customizable and adjustable security queries that users can edit, extend, and add.checked 4 Oct 2026
- Reports
- KICS can export scan results in multiple formats, including JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, and CSV.checked 4 Oct 2026
- Support
- The KICS core team can be contacted at [email protected], and the site points users to GitHub Discussions.checked 4 Oct 2026
- Supported technologies
- The site lists Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework.checked 4 Oct 2026
- Terraform limitation
- KICS documents that Terraform functions and environment variables are not supported.checked 4 Oct 2026
- Terraform modules limitation
- KICS supports some listed official AWS Terraform modules but does not support unofficial or custom modules.checked 4 Oct 2026
The company
- Founded
- 2006checked 28 Sep 2026
- Headquarters
- Ramat Gan, Israelchecked 28 Sep 2026
- Project owner
- The project is powered by Checkmarx.checked 4 Oct 2026
Alternatives to KICS
- 1
Chef InSpec
Free planOpen sourceAPILinuxmacOSSelf-hosted8.0From $59 a year - 2
AWS CloudFormation
Free planiOSWebAPILinux7.7Free plan - 3
CIS-CAT Pro Assessor
Free planAPILinuxmacOSSelf-hosted7.7From $2,400 a year - 4
Test Kitchen
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 5
kube-score
Free planWebLinuxmacOSSelf-hosted7.0Free plan - 6
Conftest
Free planLinuxmacOSWindows6.8Free plan