install

Additional install commands

macOS

Homebrewverified · 100%

brew install kics

provider-native install command

overview

Package summary

Detect vulnerabilities, compliance issues, and misconfigurations

Project links

Commands and aliases

kics

history

Project history and usage

KICS, short for Keeping Infrastructure as Code Secure, is Checkmarx's open-source scanner for infrastructure-as-code vulnerabilities, compliance problems, and misconfigurations.

Project history

Checkmarx created the public KICS repository in 2020 and published v1.0.0 on 2020-11-30. The project arrived during the wider shift from manually provisioned infrastructure toward Terraform, Kubernetes, Helm, CloudFormation, Docker Compose, and other declarative infrastructure formats, where configuration mistakes can become security defects.

Adoption history

KICS adoption is tied to CI and DevSecOps workflows. Official materials document a GitHub Action, a Docker image, a standalone CLI, and broad platform coverage across Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm, OpenAPI, gRPC, Azure Resource Manager, Pulumi, Serverless Framework, OpenTofu, Bicep, and more.

How it is used

Users run `kics scan` or CI integrations against infrastructure repositories to catch risky cloud and orchestration settings before deployment. Query packs and documentation make it useful both for one-off audits and for policy-style checks in build pipelines.

Why package nerds care

KICS is significant because it packages a large IaC security rule corpus as a Go CLI that can be installed by package managers, run in containers, or embedded in GitHub workflows. It sits in the same package-nerd mental shelf as Terraform linters, policy engines, and static analyzers, but focuses on concrete misconfiguration checks across many IaC syntaxes.

Timeline

2020: Checkmarx/kics repository created on GitHub.
2020: v1.0.0 release published on 2020-11-30.
2021: The 1.1 and 1.2 release series expanded after the initial 1.0 release.
2025: The 2.1 release series was active through repeated published releases.
2026: v2.1.20 release published on 2026-03-03.

Related projects

Official KICS materials include a companion Checkmarx/kics-github-action repository for GitHub Actions integration and documentation for scanning common IaC ecosystems such as Terraform, Kubernetes, Helm, CloudFormation, and Docker Compose.

Sources

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

narrow executable package without higher-risk signals

Signals

metadata:no-higher-risk-signals

Install behavior

No Homebrew bottle metadata was recorded.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: kics.config

executables

Installed executables

Command	Kind	Exposure	Note
`kics`	executable	indexed executable	Discovered from the local executable index.

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03

manager version2.1.21

manager updated2026-07-30

local dataunknown

upstreamnot available

latest detectednot detected

okNo freshness warnings were generated.

install metadata

Package metadata

Package key	brew:kics
Version	2.1.21
Package manager	Homebrew
Homepage	https://kics.io/
Repository	https://github.com/Checkmarx/kics
Last updated	2026-07-30T10:16:03Z
Pulse	updated
Bottle	not recorded
Service	none declared

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/kics.yml

Used sources

Geiger risk classifier
Nucleus package database
curated configuration and credential file locations
curated package history
pkgdb category and tag curation

Install kics with Homebrew