CheckOps home

Tools directory

K

CheckOps

KICS

KICS (Keeping Infrastructure as Code Secure) is Checkmarx's Apache-2.0 open-source scanner for security vulnerabilities, compliance issues and misconfigurations in infrastructure-as-code.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

KICS finds security vulnerabilities, compliance issues and infrastructure misconfigurations early in the development cycle of infrastructure as code. It is an open-source project from Checkmarx. Queries are written in Rego, and the project covers formats such as Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm and more (see docs for the full list).

The source code is at Checkmarx/kics on GitHub under the Apache-2.0 licence, with about 2,700 stars; the most recent commit was on 10 November 2026.

Features

  1. Many IaC formats: Terraform, Kubernetes, Dockerfile, CloudFormation, Ansible, Helm and more.
  2. Rego queries: Large query library; write your own.
  3. CI integrations: GitHub Actions, GitLab and others.
  4. Reports: JSON, SARIF, HTML and more.
  5. Docker image: Run without installing.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 10 November 2026.

Cons

  1. Noise on legacy code: Baseline and exclusions needed.
  2. Rego learning curve: Custom queries need Rego skills.
docker run -t -v "$PWD":/path checkmarx/kics scan -p /path -o /path/results

Resources:

Pricing

KICS is free and open source under the Apache-2.0 licence.

  1. Platform teams scanning IaC in CI.
  2. Teams wanting a Checkov alternative with Rego queries.
  3. Not a fit for runtime cloud posture.

Conclusion

KICS is a broad, Rego-based IaC scanner backed by Checkmarx.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with KICS side by side.