Checkmarx IaC Security

Checkmarx IaC Security is the Infrastructure-as-Code scanner inside the Checkmarx One Cloud pillar. It is built on **KICS** (Keeping Infrastructure as Code Secure), the open-source engine Checkmarx maintains. KICS scans Terraform (HCL), CloudFormation (YAML and JSON), Kubernetes manifests, Helm charts, Dockerfiles, Ansible playbooks, Azure Resource Manager templates, OpenAPI specs, and CDK output. The open-source roots matter because customers can audit the rule set, contribute custom rules upstream, and verify that the engine is doing what it claims.

PR-time policy gates are the load-bearing capability for shifting left. IaC misconfigurations (public S3 buckets, overly-permissive IAM roles, unencrypted database snapshots, Kubernetes pods running as root) are easy to introduce and hard to catch after deployment. Checkmarx IaC Security scans the Terraform or CloudFormation diff at PR time, posts findings as PR comments on the changed resources, and gates the merge based on severity and policy. Programs that catch IaC misconfigurations at PR time spend a fraction of the operational effort that programs catching them post-deploy do.

Compare honestly to Checkov and Bridgecrew (now Prisma Cloud). Checkov is open-source, Python-based, and the established alternative. Bridgecrew (now part of Prisma Cloud) commercializes Checkov. KICS is open-source, Go-based, and the engine behind Checkmarx IaC Security. The technical differences are modest; the integration story differs. Programs picking Checkmarx IaC Security usually want consolidation with SAST, SCA, DAST, and Container Security inside Checkmarx One. Programs picking Checkov stay open-source. Both are valid.

What derails IaC Security adoption is rule-set drift and rule-set noise. Default rules generate findings on every minor convention deviation regardless of whether the deviation matters in this environment. Merito's engagement starts with rule-set tuning to the customer's actual cloud provider mix (AWS-heavy programs do not need Azure-specific rules tripping on every scan), application of compensating-control logic (a finding flagged on an internal-only resource may not need PR-time blocking), and policy-as-code authoring so internal cloud standards become enforceable scanner rules.

Merito has audited cloud programs that ran IaC scanning post-deploy, accumulated thousands of findings on existing infrastructure, and never moved the needle because remediating already-deployed cloud is expensive. The fix is shifting left: scan the IaC diff at PR time, post findings as PR comments, and gate the merge before the misconfiguration ships. Checkmarx IaC Security does this; programs that scan only post-deploy are running detection rather than prevention.

Merito recommends Checkmarx IaC Security specifically when the program is consolidating onto Checkmarx One, when cross-product correlation with Container Security and SAST matters, and when the open-source KICS heritage gives the team confidence to audit and contribute to the engine. For programs already running mature Checkov pipelines and not consolidating, the migration delta is often small. For programs picking Prisma Cloud or Wiz as the cloud-side anchor, IaC Security from Checkmarx still works as the AppSec-side companion.

The custom policy-as-code authoring is the load-bearing move on internal cloud standards. Programs that document tagging, region, and encryption rules in a wiki and never enforce them spend the next year arguing about them. Programs that encode them as custom KICS rules turn standards into enforceable PR-time gates.