What is KICS used for?

KICS scans Infrastructure as Code for security vulnerabilities, compliance issues, and misconfigurations. It is a good fit for find security vulnerabilities in IaC before deployment, check infrastructure compliance with policies, and identify misconfigurations in cloud and container setups.

Yes. KICS is open source under the Apache-2.0 licence. Its source code is on GitHub at Checkmarx/kics and is written mainly in Open Policy Agent.

Yes. KICS is open source, so the software itself is free to use.

Can I self-host KICS?

Yes. KICS can be self-hosted on your own server or infrastructure.

What is KICS an alternative to?

KICS is an open-source alternative to GitGuardian and Prisma Cloud. Other open-source alternatives to GitGuardian include Trivy, Checkov and Semgrep.

Is KICS actively maintained?

Yes. The most recent commit to KICS was on 8 October 2026, and the latest release is v2.2.0, published on 17 September 2026. The project has 2.7k stars on GitHub.

KICS: open-source alternative to GitGuardian, Prisma Cloud

About KICS

KICS is an open source static code analysis tool for Infrastructure as Code. It scans IaC files to find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle.

The tool supports multiple IaC platforms including Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, and others. It includes over 2400 customizable queries and is designed to be easy to install, run, and integrate into CI pipelines.

Key features

Scans Infrastructure as Code for security vulnerabilities, compliance issues, and misconfigurations
Supports Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure
Includes over 2400 customizable queries
Open source scanning engine and queries
Extensible architecture for adding new IaC support and custom queries
Easy to integrate into CI pipelines

Good fit for

Find security vulnerabilities in IaC before deployment
Check infrastructure compliance with policies
Identify misconfigurations in cloud and container setups

Built with: Open Policy Agent tools; Go tools
Tags: iac; static-analysis; security; compliance; infrastructure-as-code; devsecops

KICS: questions and answers

What is KICS used for?: KICS scans Infrastructure as Code for security vulnerabilities, compliance issues, and misconfigurations. It is a good fit for find security vulnerabilities in IaC before deployment, check infrastructure compliance with policies, and identify misconfigurations in cloud and container setups.
Is KICS open source?: Yes. KICS is open source under the Apache-2.0 licence. Its source code is on GitHub at Checkmarx/kics and is written mainly in Open Policy Agent.
Is KICS free?: Yes. KICS is open source, so the software itself is free to use.
Can I self-host KICS?: Yes. KICS can be self-hosted on your own server or infrastructure.
What is KICS an alternative to?: KICS is an open-source alternative to GitGuardian and Prisma Cloud. Other open-source alternatives to GitGuardian include Trivy, Checkov and Semgrep.
Is KICS actively maintained?: Yes. The most recent commit to KICS was on 8 October 2026, and the latest release is v2.2.0, published on 17 September 2026. The project has 2.7k stars on GitHub.