KICS
Ramat Gan, Israel
What it is
KICS is a free, open-source static code analysis solution for finding security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrastructure as Code. It supports Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, OpenAPI, Pulumi, Crossplane, Knative, Serverless Framework, and other listed technologies. Security queries use OPA Rego and can be edited, extended, or supplemented with new queries. KICS connects with CI systems including GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, Terraform Cloud, and AWS CodeBuild, and offers automatic scanning through a Visual Studio Code extension. It runs as a Docker image or from source, with releases for Linux, Windows, and macOS. Scan results can be exported as JSON, SARIF, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. The project is powered by Checkmarx. Documentation notes that Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.
For and against
For
- Free open-source project
- Supports many Infrastructure as Code technologies
- Customizable OPA Rego security queries
- CI/CD and Visual Studio Code integrations
- Exports numerous report formats
Against
- Terraform functions and environment variables are unsupported
- Unofficial or custom Terraform modules are unsupported
- No free trial is offered because the project is free
The verdict
KICS provides broad IaC scanning, editable policies, automation integrations, and flexible reporting at no cost. Terraform users should review its documented function, environment-variable, and module limitations.
Who it suits
KICS suits developers and security teams working with Infrastructure as Code across supported formats. It is useful for teams wanting customizable policies, CI/CD integration, and multiple report formats without a paid plan.
Plans and prices
KICS
Open-source project; the project site describes it as free
Read 4 Oct 2026 · docs.kics.io
On the record
- Certifications
- The documentation lists previous CIS certifications for AWS Foundations and Kubernetes benchmarks.docs.kics.io · read 4 Oct 2026
- CI integrations
- Documented integrations include Azure Pipelines, Bamboo, Bitbucket Pipelines, CircleCI, Codefresh, GitHub Actions, GitLab CI, Jenkins, TeamCity, Travis, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and AWS CDK.docs.kics.io · read 4 Oct 2026
- Editor integration
- KICS provides an auto-scanning extension for Visual Studio Code.docs.kics.io · read 4 Oct 2026
- Installation
- KICS can be run as a Docker image or built from source; its documentation also provides downloadable releases for Linux, Windows, and macOS.docs.kics.io · read 4 Oct 2026
- Project owner
- The project is powered by Checkmarx.docs.kics.io · read 4 Oct 2026
- Purpose
- KICS is an open-source static code analysis solution that finds security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrastructure as Code.kics.io · read 4 Oct 2026
- Queries
- KICS provides customizable and adjustable security queries that users can edit, extend, and add.kics.io · read 4 Oct 2026
- Reports
- KICS can export scan results in multiple formats, including JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, and CSV.docs.kics.io · read 4 Oct 2026
- Support
- The KICS core team can be contacted at [email protected], and the site points users to GitHub Discussions.docs.kics.io · read 4 Oct 2026
- Supported technologies
- The site lists Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework.kics.io · read 4 Oct 2026
- Terraform limitation
- KICS documents that Terraform functions and environment variables are not supported.docs.kics.io · read 4 Oct 2026
- Terraform modules limitation
- KICS supports some listed official AWS Terraform modules but does not support unofficial or custom modules.docs.kics.io · read 4 Oct 2026
