Our take
Activeregular commits and releases- Activity
- 62
- Community
- 94
- Issues
- 46
- Pull requests
- 54
- More contributors than 78% of the projects we track
KICS is an actively maintained, broadly compatible IaC scanner with an extensible Open Policy Agent query model, though teams should account for its Go and container requirements and evaluate how its findings fit their existing workflow.
Good fit if
- You need to scan several IaC formats, not just Terraform.
- Your team wants to customize or add security and compliance queries.
- You can run Go-based tooling or use Docker in development and CI.
Look elsewhere if
- Your required IaC format is not among the project's supported platforms.
- You need an alternative that does not use Open Policy Agent queries.
- You cannot accommodate the Go runtime or Docker-based setup.
All health signals
| Last commit | 2026-11-09 (today) |
|---|---|
| Commits, last 90 days | 50 |
| Releases, last 12 months | 8 (latest v2.2.1, 2026-11-09) |
| Contributors | 100+ (top contributor: 10% of commits) |
| Issues closed, last 90 days | 4 (typically closed in 13 days) |
| Pull requests merged, last 90 days | 50 (typically merged in 1 day) |
| Project age | 6 years |
Checked on 2026-11-10 with the GitHub API.
Overview
KICS (Keeping Infrastructure as Code Secure) is Checkmarx's open-source scanner for finding security vulnerabilities, compliance issues, and misconfigurations in infrastructure as code. It uses Open Policy Agent queries as its rule foundation, which teams can customize or extend to suit their checks.
It is aimed at cloud-native and DevSecOps teams that want to find configuration problems during development or in CI/CD, rather than after deployment. Supported formats include Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm, OpenAPI, and others listed in the project documentation.
Key Features
- Scans infrastructure definitions for security vulnerabilities, compliance issues, and misconfigurations.
- Provides customizable queries that teams can edit, extend, or add.
- Supports a broad set of infrastructure formats, including Terraform, OpenTofu, Kubernetes, Docker, CloudFormation, and Pulumi.
- Produces results intended to help developers identify and fix detected issues.
- Offers integrations for CI/CD workflows.
- Provides Docker and Docker Compose support.
Use Cases
- A platform team can scan Terraform or OpenTofu changes before cloud resources are provisioned.
- A DevSecOps team can add IaC checks to CI/CD and surface findings during code review.
- A Kubernetes team can check manifests and Helm-related infrastructure for risky configurations.
- A security team can adapt queries to enforce internal compliance expectations across supported formats.
What you need
Detected in the repository
- Go 1.26.8 or newer (from go.mod)
- A Dockerfile, so it can run in a container; a Compose file sets up the related services
- A test suite and automated checks on GitHub Actions
License in plain words
Apache-2.0permissive
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license, the NOTICE file and a note of your changes
- Share your changes: no
- Includes an explicit patent grant from the contributors:
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
See the getting-started guide for installation and the first scan. The KICS documentation covers configuration, results, queries, and integrations.
Alternatives
- Checkov: Checkov also scans IaC for security and compliance issues, using Python and graph-based analysis, and additionally covers container images and open-source package vulnerabilities.
| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| kics | Open Policy Agent | Apache-2.0 | 2.7k | Active |
| Checkov | Python | Apache-2.0 | 9.1k | Active |
Considerations
The project is active, with regular commits and releases, and contributions are not concentrated in one person. Recent issue closure activity is relatively light compared with its ongoing pull request and release activity, so teams should check the issue tracker for the status of concerns relevant to their use. KICS requires Go, and Docker and Docker Compose are supported options; confirm that your build or CI environment can accommodate the runtime and execution method. The repository uses the Apache-2.0 license, so review its terms as part of adoption.
Found this useful?
Share it with someone who would like kics.