Checkov vs KICS
Checkov
checkov.io
KICS
kics.ioSide by side
| Figure | Checkov | KICS |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Infrastructure Testing Tools | 8.0 (#10) | 7.9 (#12) |
| Spec score · Infrastructure Policy as Code Tools | 7.9 (#12) | 7.8 (#13) |
| CI integrations | The documentation describes integrations with Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. | Documented integrations include Azure Pipelines, Bamboo, Bitbucket Pipelines, CircleCI, Codefresh, GitHub Actions, GitLab CI, Jenkins, TeamCity, Travis, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and AWS CDK. |
| Installation | The project documents installation through pip and Homebrew; Homebrew is specified for macOS or Linux. | KICS can be run as a Docker image or built from source; its documentation also provides downloadable releases for Linux, Windows, and macOS. |
| Purpose | Checkov scans infrastructure-as-code files for misconfigurations that can cause security or compliance problems. | KICS is an open-source static code analysis solution that finds security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrastructure as Code. |
| Support | The project directs users to its documentation for tutorials and examples and identifies Prisma Cloud as the maintainer. | The KICS core team can be contacted at [email protected], and the site points users to GitHub Discussions. |
Plans
In their own words
Checkov
Checkov is a free tool for scanning infrastructure-as-code files for configuration problems that could affect security or compliance. Its documented targets include Terraform, CloudFormation, ARM, Serverless, Helm, Kubernetes, and Docker. The policy library contains more than 750 predefined checks, including checks for standards such as CIS and the AWS Foundations Benchmark. Checkov can also identify common credentials in IaC files, including AWS access keys, Azure service credentials, and private keys. Teams can create custom attribute policies in Python or YAML and composite policies in YAML. Documented continuous-integration integrations include Jenkins, Bitbucket Cloud Pipelines, GitHub Actions, and GitLab CI. Add-ons for Visual Studio Code and JetBrains provide real-time scanning and inline fixes. Installation is documented through pip and Homebrew, with Homebrew specified for macOS or Linux. The project supports Python 3.9 through 3.13 and is distributed under the Apache-2.0 license. Prisma Cloud extends Checkov with runtime scanning, visibility, native VCS integrations, drift detection, and pull request annotations. Alpine is not officially tested or supported; it requires Python 3.11 or later.
KICS
KICS is a free, open-source static analysis solution powered by Checkmarx. It scans Infrastructure as Code for security vulnerabilities, compliance issues, and configuration mistakes across Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework files. Its security queries can be edited, extended, or supplemented with new queries, using OPA Rego policy language. Documented CI and delivery integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and others. A Visual Studio Code extension can scan automatically. KICS runs as a Docker image, from source, or through downloadable Linux, Windows, and macOS releases. Reports can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.