kics

KICS finds security vulnerabilities and misconfigurations in infrastructure-as-code, in the same family as Checkov. The name stands for Keeping Infrastructure as Code Secure, and it covers Terraform, Kubernetes, Docker, CloudFormation, Ansible, and more against a large library of queries. Open source, maintained by Checkmarx, free.

You run it as a binary or container in CI, and it flags issues with a severity and a description of the fix. Queries are written in a rego-like format, so you can extend the ruleset for your own standards. It's stateless and fast, built to gate pull requests.

KICS is free and open source. Checkmarx sells a broader commercial application security platform, but KICS stands on its own. In practice the choice is usually Checkov versus KICS: both are strong, Checkov has the larger community and policy library, KICS covers a slightly different set of platforms. Try both against your repos and keep whichever flags more of what you care about.

The catch: same noise problem as any IaC scanner. The default ruleset is broad, and an existing codebase will surface plenty of findings you'll want to triage or suppress. The tool is easy; tuning it to your risk tolerance is the actual work.