Skip to content
SPECIFICTION
Get listed

KICS

kics.io

Free plan WindowsmacOSLinuxSelf-hosted
Visit kics.io
Spec score 7.9 #12 of 28 in Infrastructure Testing Tools

What it is

KICS is a free, open-source static analysis solution powered by Checkmarx. It scans Infrastructure as Code for security vulnerabilities, compliance issues, and configuration mistakes across Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework files. Its security queries can be edited, extended, or supplemented with new queries, using OPA Rego policy language. Documented CI and delivery integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and others. A Visual Studio Code extension can scan automatically. KICS runs as a Docker image, from source, or through downloadable Linux, Windows, and macOS releases. Reports can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.

Spec sheet

Purpose
KICS is an open-source static code analysis solution that finds security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrastructure as Code.Read 4 Oct 2026 · kics.io
Support
The KICS core team can be contacted at [email protected], and the site points users to GitHub Discussions.Read 4 Oct 2026 · docs.kics.io
Headquarters
Ramat Gan, IsraelRead 28 Sep 2026 · kics.io
Founded
2006Read 28 Sep 2026 · kics.io
Certifications
The documentation lists previous CIS certifications for AWS Foundations and Kubernetes benchmarks.Read 4 Oct 2026 · docs.kics.io
CI integrations
Documented integrations include Azure Pipelines, Bamboo, Bitbucket Pipelines, CircleCI, Codefresh, GitHub Actions, GitLab CI, Jenkins, TeamCity, Travis, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and AWS CDK.Read 4 Oct 2026 · docs.kics.io
Editor integration
KICS provides an auto-scanning extension for Visual Studio Code.Read 4 Oct 2026 · docs.kics.io
Installation
KICS can be run as a Docker image or built from source; its documentation also provides downloadable releases for Linux, Windows, and macOS.Read 4 Oct 2026 · docs.kics.io
Project owner
The project is powered by Checkmarx.Read 4 Oct 2026 · docs.kics.io
Queries
KICS provides customizable and adjustable security queries that users can edit, extend, and add.Read 4 Oct 2026 · kics.io
Reports
KICS can export scan results in multiple formats, including JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, and CSV.Read 4 Oct 2026 · docs.kics.io
Supported technologies
The site lists Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework.Read 4 Oct 2026 · kics.io
Terraform limitation
KICS documents that Terraform functions and environment variables are not supported.Read 4 Oct 2026 · docs.kics.io
Terraform modules limitation
KICS supports some listed official AWS Terraform modules but does not support unofficial or custom modules.Read 4 Oct 2026 · docs.kics.io

Plans and prices

KICS Free Open-source project; the project site describes it as free Read 4 Oct 2026 · docs.kics.io

Every KICS plan and price →

Strong points and limits

Strong points

  • Free open-source project
  • Supports many IaC technologies
  • Customizable OPA Rego queries
  • Broad CI/CD integration list
  • Exports numerous report formats

Limits

  • Terraform functions and variables are unsupported
  • Unofficial and custom Terraform modules unsupported
  • No free trial is listed

Who it suits

KICS suits teams checking Infrastructure as Code in local environments and CI/CD pipelines. It is relevant to users working with the listed IaC formats and policy queries.

Verdict

KICS combines broad IaC coverage with customizable policies, editor scanning, CI integrations, and varied report outputs. Terraform users should account for its documented function, variable, and module limitations.

Where Specifiction places it

Alternatives to KICSAll alternatives →