KICS
Open source IaC scanner covering more than twenty platforms with thousands of Rego queries.
Technical Architecture & Overview
KICS, Keeping Infrastructure as Code Secure, is a Checkmarx open source scanner for Terraform, Kubernetes, Ansible, CloudFormation, Dockerfiles, and more, shipping thousands of Rego-based queries. It runs as a CLI with SARIF and JSON output, and a GitHub Action integrates it into pipelines. In 2026 attackers replaced the KICS GitHub Action release tags (March) and several checkmarx/kics Docker Hub image tags (April) with credential-stealing versions, so pin actions to commit SHAs and verify image digests.
Targeted Technical Use Cases
Broad IaC scanning across mixed template stacks in CI pipelines.
Evaluation & Trade-offs
Core Strengths
- +Coverage of IaC platforms including Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm, Pulumi, and Crossplane.
- +Custom Rego queries for organization-specific policy.
- +Plugins or integration guides for CI/CD tools such as GitHub Actions, GitLab CI, and Jenkins.
Trade-Offs & Limitations
- -Query quality varies by platform.
- -GitHub Action and Docker Hub distribution were tampered with in 2026; pin and verify versions.
Defensive Security Application
Catching insecure infrastructure configurations before they deploy.
Frequently Asked Questions
What is KICS?→
KICS, Keeping Infrastructure as Code Secure, is a Checkmarx open source scanner for Terraform, Kubernetes, Ansible, CloudFormation, Dockerfiles, and more, shipping thousands of Rego-based queries. It runs as a CLI with SARIF and JSON output, and a GitHub Action integrates it into pipelines. In 2026 attackers replaced the KICS GitHub Action release tags (March) and several checkmarx/kics Docker Hub image tags (April) with credential-stealing versions, so pin actions to commit SHAs and verify image digests.
What is KICS used for?→
Broad IaC scanning across mixed template stacks in CI pipelines.
What are the strengths of KICS?→
- +Coverage of IaC platforms including Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm, Pulumi, and Crossplane.
- +Custom Rego queries for organization-specific policy.
- +Plugins or integration guides for CI/CD tools such as GitHub Actions, GitLab CI, and Jenkins.
What are the limitations of KICS?→
- +Query quality varies by platform.
- +GitHub Action and Docker Hub distribution were tampered with in 2026; pin and verify versions.
How is KICS used defensively?→
Catching insecure infrastructure configurations before they deploy.