Infrastructure-as-code scanner with Rego queries
Checkmarx's open-source scanner for security issues and misconfigurations in IaC, with queries written in Rego across many platforms.
KICS (Keeping Infrastructure as Code Secure) finds misconfigurations in Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm, OpenAPI and other formats. Each check is a query written in Rego, the Open Policy Agent language, so teams can read and extend the rules.
It is maintained by Checkmarx and runs as a CLI, a Docker image or a CI integration.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
No published advisory found for KICS in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
Cloud security posture and compliance checks
Open-source cloud security platform that runs hundreds of checks against AWS, Azure, Google Cloud, Kubernetes and Microsoft 365, mapped to compliance frameworks.
Static analysis for infrastructure as code
Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.
Multi-cloud security auditing tool
NCC Group's multi-cloud auditing tool that collects configuration data through cloud APIs and highlights risk areas in an offline HTML report.
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
Kubernetes security posture and compliance scanner
CNCF project that scans clusters, manifests and Helm charts against frameworks such as the NSA-CISA guidance and CIS Benchmarks, and scans images.
Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
