Chef InSpec vs KICS
Chef InSpec
docs.chef.io
KICS
kics.ioSide by side
| Figure | Chef InSpec | KICS |
|---|---|---|
| Price from | $4.92/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 8 | 1 |
| Spec score · Infrastructure Testing Tools | 9.4 (#1) | 7.9 (#12) |
| Installation | Chef documents native installers for Windows and Linux distributions and Habitat packages for macOS, Windows, and Linux distributions. | KICS can be run as a Docker image or built from source; its documentation also provides downloadable releases for Linux, Windows, and macOS. |
| Purpose | Chef InSpec tests and audits applications and infrastructure by comparing their actual state with a desired state expressed in InSpec code. | KICS is an open-source static code analysis solution that finds security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrastructure as Code. |
| Support | The licensing page lists community Slack support for Free and Trial tiers and contract support for Commercial licenses. | The KICS core team can be contacted at [email protected], and the site points users to GitHub Discussions. |
Plans
Chef InSpec
- FreeFree
- FreeFree
- TrialFree
- TrialFree
- Business$59 a year
- Enterprise$189 a year
- CommercialPriced on request
- Enterprise PlusPriced on request
In their own words
Chef InSpec
Chef InSpec tests and audits applications and infrastructure against a desired state described in InSpec code. Its runtime framework and rule language express compliance, security and policy requirements. Reusable profiles group controls and can include versioning, platform requirements and dependencies. Resources support testing AWS, Azure, AliCloud and GCP infrastructure, and users can create custom resources. Tests can run locally or against cloud services and infrastructure such as Linux in Docker containers. Results can be exported as JSON, HTML or plain text, or sent to Chef Automate. The kitchen-inspec verifier also runs profiles through Test Kitchen. Chef offers premium CIS- and STIG-based profiles for compliance scanning. The free tier is for non-production workloads and personal, non-commercial use; the 30-day trial is for product evaluation under non-production conditions. Commercial licensing covers production and non-production workloads, with entitlements based on purchase order. Chef InSpec 7 requires EULA acceptance, and license-key requirements depend on the distribution source. Telemetry is enabled for free and trial tiers, but not commercial users.
KICS
KICS is a free, open-source static analysis solution powered by Checkmarx. It scans Infrastructure as Code for security vulnerabilities, compliance issues, and configuration mistakes across Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework files. Its security queries can be edited, extended, or supplemented with new queries, using OPA Rego policy language. Documented CI and delivery integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and others. A Visual Studio Code extension can scan automatically. KICS runs as a Docker image, from source, or through downloadable Linux, Windows, and macOS releases. Reports can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.