Kics : Find Security Vulnerabilities & Compliance Issues

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

KICS stands for Keeping Infrastructure as Code Secure, it is open source and is a must-have for any cloud native project.

Supported Platforms

Support of other solutions and additional cloud providers are on the roadmap.

Getting Started

Setting up and using KICS is super-easy.

• First, see how to install and get KICS running.
• Then explore KICS output results format and quickly fix the issues detected.

Interested in more advanced stuff?

• Deep dive into KICS queries.
• Understand how to integrate KICS in your favourite CI/CD pipelines.

How it Works?

What makes KICS really powerful and popular is its built-in extensibility. This extensibility is achieved by:

• Fully customizable and adjustable heuristics rules, called queries. These can be easily edited, extended and added.
• Robust but yet simple architecture, which allows quick addition of support for new Infrastructure as Code solutions.

Release Process

KICS release process is quite simple. We have nightly builds that will pack and pre-release all changes merged into master. The nightly release will have a “nightly” prefix with the last commit hash code. We have binaries available for both Windows and Linux, as well a Docker image in DockerHub