# KICS

KICS is a Security Scanning product. It runs on-premises. Pricing is free.

KICS is an open-source Infrastructure as Code security scanner that detects vulnerabilities and misconfigurations through customizable queries and integrates with CI/CD pipelines.

Checked October 2026.

## What is KICS?

KICS (Keeping Infrastructure as Code Secure) is an open-source security scanning tool designed to analyze Infrastructure as Code (IaC) configurations for security vulnerabilities and misconfigurations.

The tool operates through customizable heuristic rules called queries that can be edited, extended, and added to meet specific security requirements. KICS features a modular architecture that enables support for multiple Infrastructure as Code solutions.

Key capabilities include:
- Static analysis of IaC templates and configurations
- Detection of security issues and compliance violations
- Integration with CI/CD pipelines for automated security scanning
- Extensible query system for custom security rules
- Support for various cloud-native and infrastructure technologies

The tool provides structured output results that help identify and remediate detected security issues. KICS is designed for cloud-native projects and can be integrated into development workflows to ensure infrastructure security from the early stages of deployment.

Tags: Cloud Native, Security Scanning, DevSecOps, Open Source, Infrastructure as Code, CI/CD

## Where it fits in your security program (NIST CSF 2.0)

- [Identify](https://cybersectools.com/guides/building-identify-program-small-team): helps you know your assets and your risks.
- [Protect](https://cybersectools.com/guides/building-protect-program-small-team): helps you prevent attacks and keep data safe.

## Quick facts

- Category: [Exposure & Vulnerability Management](https://cybersectools.com/categories/exposure-vulnerability-management) · [Security Scanning](https://cybersectools.com/categories/security-scanning)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 2,588
- Website: github.com

## KICS FAQ

### What is KICS?

KICS is a product in the Security Scanning category. It covers Cloud Native, Security Scanning and DevSecOps.

### What is the pricing for KICS?

KICS is free. Download and setup instructions are at https://github.com/Checkmarx/kics/.

### What are alternatives to KICS?

Alternatives to KICS listed on CybersecTools:

1. [Guardian360 Quickscan WP Plugin](https://cybersectools.com/tools/guardian360-quickscan-wp-plugin) - WordPress plugin for website security scanning via the Guardian360 API. (Free)
2. [CyberChecker](https://cybersectools.com/tools/cyberchecker) - Automated web vulnerability scanner with 60+ security checks (Commercial)
3. [Perisai Web Scanner](https://cybersectools.com/tools/bima-scanner) - Automated web scanner detecting vulnerabilities and HTTP security headers (Free)
4. [Domain Verity](https://cybersectools.com/tools/domain-verity) - Monitors domains for TLS, email auth, DNS, and cert misconfigurations. (Commercial)
5. [DNSAudit.io](https://cybersectools.com/tools/dnsauditio) - Free DNS security scanner that checks domains for misconfigs and exposure. (Free)

Compare all KICS alternatives at [https://cybersectools.com/alternatives/kics](https://cybersectools.com/alternatives/kics)

### What deployment and organization size does KICS fit?

KICS is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare KICS with similar solutions

- [KICS vs Guardian360 Quickscan WP Plugin](https://cybersectools.com/compare/guardian360-quickscan-wp-plugin-vs-kics)
- [KICS vs CyberChecker](https://cybersectools.com/compare/cyberchecker-vs-kics)
- [KICS vs Perisai Web Scanner](https://cybersectools.com/compare/bima-scanner-vs-kics)

All alternatives to KICS: [/alternatives/kics](https://cybersectools.com/alternatives/kics)

---

Source: https://cybersectools.com/tools/kics

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on KICS: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md