KICS is an open-source Infrastructure as Code security scanner that detects vulnerabilities and misconfigurations through customizable queries and integrates with CI/CD pipelines.
Checked October 2026.
KICS (Keeping Infrastructure as Code Secure) is an open-source security scanning tool designed to analyze Infrastructure as Code (IaC) configurations for security vulnerabilities and misconfigurations.
The tool operates through customizable heuristic rules called queries that can be edited, extended, and added to meet specific security requirements. KICS features a modular architecture that enables support for multiple Infrastructure as Code solutions.
Key capabilities include:
The tool provides structured output results that help identify and remediate detected security issues. KICS is designed for cloud-native projects and can be integrated into development workflows to ensure infrastructure security from the early stages of deployment.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about KICS: features, pricing and alternatives.
KICS is a product in the Security Scanning category. It covers Cloud Native, Security Scanning and DevSecOps.
KICS is free. Download and setup instructions are at https://github.com/Checkmarx/kics/.
Alternatives to KICS listed on CybersecTools:
Compare all KICS alternatives at https://cybersectools.com/alternatives/kics
KICS is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
JavaScript security scanner for detecting vulnerabilities in third-party scripts
A next-generation crawling and spidering framework for extracting data from websites
A security tool for discovering S3 bucket references in web content and testing buckets for misconfigurations.
A Python script that finds endpoints in JavaScript files to identify potential security vulnerabilities.
LinksDumper extracts links and endpoints from HTTP responses to support web application security testing and reconnaissance activities.
A tool that reveals invisible links within JavaScript files
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
