Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

KICS review

Free#1 of 22 in Infrastructure as Code Security SoftwareIaC Security Scanners

A broad, free IaC scanner for security, compliance, secrets, and misconfigurations.

9.4/10Editor score
Visit KICS
KICS9.4 Visit KICS

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

KICS is a free, open-source static analysis tool for infrastructure-as-code projects. It is designed for teams that need security, compliance, misconfiguration, and secrets checks across Terraform, Kubernetes, and CloudFormation. The product also supports Docker, Ansible, and Helm, and can run as a command-line tool or Docker image. Its platform support includes Windows, macOS, and Linux, making it suitable for development and delivery environments that use those operating systems.

The pricing model is straightforward: KICS is presented as free and open source. There are no paid plan distinctions to compare, so its value centers on the breadth of checks and integrations available without a subscription structure. Security teams can use customizable and extensible queries, while development teams can connect scanning to Azure Pipelines, Bamboo, Bitbucket Pipelines, CircleCI, Codefresh, GitLab CI, Jenkins, TeamCity, Travis CI, AWS CodeBuild, and other listed tools. GitHub Actions adds pull-request comments and annotations for review workflows.

KICS stands out for combining broad IaC coverage with secrets detection, custom policies, pre-commit hooks, Terraform Cloud connectivity, and a Visual Studio Code extension with auto-scanning. That breadth makes it a practical fit for organizations managing several infrastructure formats or standardizing checks across CI/CD systems. It is less suitable for teams looking for a general application-security product rather than infrastructure-focused analysis, or for teams that do not want to manage query customization and integration configuration. Choose KICS when broad, free IaC coverage matters; consider a narrower tool when your needs center on a single platform or a different code-security scope.

KICS pros and cons

  • Where it wins
    • Scans Terraform, Kubernetes, and CloudFormation
    • Detects security issues, compliance gaps, misconfigurations, and secrets
    • Connects with CI/CD tools, GitHub Actions, and Visual Studio Code
  • Where it doesn't
    • Primarily focuses on infrastructure-as-code configuration files
    • Custom queries may require security and policy knowledge
    • Workflow coverage depends on configuring its listed integrations

KICS fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update