Skip to content


KICS - Keeping Infrastructure as Code Secure KICS - Keeping Infrastructure as Code Secure

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

KICS stands for Keeping Infrastructure as Code Secure, it is open source and is a must-have for any cloud native project.

Version 2.1.0



Version 2.0.0 Added Features, Breaking Changes and Deprecated Queries

Breaking changes

Added features

  • Critical severity
  • Parallel Scan (by default)

Deprecated Queries

Click here to check the deprecated queries list.

Supported Platforms

KICS scans and detects issues in following Infrastructure as Code solutions:

Beta Features


By default, Databricks, NIFCloud, and TencentCloud queries run when you scan Terraform files using KICS.

The Severity and Description of these queries are still under review.

Getting Started

Setting up and using KICS is super-easy.

Interested in more advanced stuff?

  • Deep dive into KICS queries.
  • Understand how you to integrate KICS in your favorite CI/CD pipelines.

How it Works

What makes KICS really powerful and popular is its built-in extensibility. This extensibility is achieved by:

  • Fully customizable and adjustable heuristics rules, called queries. These can be easily edited, extended and added.
  • Robust but yet simple architecture, which allows quick addition of support for new Infrastructure as Code solutions.


KICS is a true community project. It's built as an open source project from day one and anyone can find his own way to contribute to the project. Check out how, within just minutes, you can start making a difference, by sharing your expertise with a community of thousands of security experts and software developers.

About the Project

The KICS project is powered by Checkmarx, global leader of Application Security Testing. Read more about Infrastructure as Code, Infrastructure as Code Testing and Checkmarx.

KICS will always stay an open source and free project for the benefit of global software industry community. We believe that when Software is Everywhere, Security is Everything.

Now, Software = Security.

Looking for more info? Explore KICS project in details:

Join the GitHub discussions. Or contact KICS core team at