What it is

KICS is an open-source security scanner for infrastructure-as-code projects. The project name stands for Keeping Infrastructure as Code Secure, and the repository describes it as a tool for finding security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle. It is published by Checkmarx under the Apache-2.0 license and is associated with the cloud-native, DevSecOps, and application security ecosystems. The repository also lists topics such as infrastructure-as-code, security, and vulnerability-detection.

The concrete problem it addresses is the gap between code review and infrastructure deployment. Teams that define cloud resources through configuration files need a way to inspect those files before they are applied. KICS uses customizable heuristics rules, called queries, to identify possible issues in infrastructure-as-code content and to produce results that developers can review and fix.

Key capabilities

• KICS detects security vulnerabilities in infrastructure-as-code files.
• KICS identifies compliance issues in infrastructure-as-code files.
• KICS finds infrastructure misconfigurations before deployment.
• KICS uses heuristics rules, called queries, to define what it checks.
• KICS supports editing and extending queries for custom checks.
• KICS provides output results that teams can review to fix detected issues.
• KICS can be integrated into CI/CD pipelines.

Who uses it and how

• Application security teams use KICS to review infrastructure-as-code repositories for possible vulnerabilities and misconfigurations.
• Cloud-native teams use KICS to add early checks to development workflows for infrastructure-as-code projects.
• Developers use KICS to examine scan results and correct detected issues before deployment.
• DevSecOps teams use KICS to integrate infrastructure-as-code scanning into CI/CD pipelines.
• Query maintainers use KICS to customize or extend queries when existing queries do not match a project's needs.

Getting started

The README points to installation and running instructions in docs/getting-started.md, and it mentions exploring result formats in docs/results.md. The provided badges show a Docker image named checkmarx/kics, while no package manager or hosted option is listed.

When to use it — and when not to

Use KICS when a team wants an Apache-2.0 licensed, extensible scanner for infrastructure-as-code and can maintain its own query workflow. It is less suitable when the required platform support, hosted option, or compliance report format is not documented in the provided material. The repository lists 312 open issues, so teams should review current issue volume before depending on a specific check.