Kiro (agent platform with security integrations)

Vendor: Amazon Web Services · HQ: United States · Category: Code security

Last verified 18 Oct 2026 · Added 18 Oct 2026 · 9 sources · How we verify

Visit official site (opens in new tab) Claim this listing

Vendor? Get your “Listed on Agent Index” badge

This listing is an agent platform with security integrations, not a dedicated application-security product. It is in the Code security category because the vendor’s own docs show a concrete scanner or vulnerability-fix workflow (for example Snyk, Sentry or Dependabot). Compare dedicated AppSec listings on the AI code security agents table.

What it does

Kiro is AWS's agentic development environment. In autonomous mode, its agent plans work, delegates to sub-agents and opens pull or merge requests. The Kiro Powers directory, on Kiro's own site, includes security powers for Snyk (Secure at Inception), Aikido Security code scanning, SonarQube Code Quality & Security, and Sonatype. Kiro's docs explain that powers load dynamically to give the agent those tools. Kiro is listed as an agent platform with security integrations, not as a dedicated security scanner. AWS documents that Kiro is FedRAMP High and DoD IL-4/5 authorized in AWS GovCloud (US); Kiro is marked in-scope for FedRAMP Class C (East/West) and Class D (GovCloud) on AWS's services-in-scope list (updated 15 Oct 2026). The Marketplace package for AWS GovCloud is F1603047866 (FedRAMP Authorized, High).

Frameworks

FedRAMP

Vendor-claimed FedRAMP

Government authorizations

Registry records checked 2026-10-18. Scope “listing” means the certified product is this listing or the government boundary it already documents; “platform-only” means another product line is certified and the vendor does not state this agent is inside that boundary.

Pricing (as published)

Published: Free $0 (50 credits); Pro $20/user/month (1,000 credits); Pro+ $40 (2,000 credits); Pro Max $100 (5,000 credits); Power $200; extra credits $0.04 each (kiro.dev/pricing at last check).

Tasks

agent platform with security integrationsappsecpr-review

Sources

1. kiro.dev/powers/ (primary)
2. kiro.dev/docs/powers/
3. kiro.dev/docs/web/autonomous-mode/
4. kiro.dev/pricing/
5. aws.amazon.com/agreement/
6. fedramp.gov/marketplace/products/F1603047866/
7. aws.amazon.com/compliance/services-in-scope/FedRAMP/
8. aws.amazon.com/about-aws/whats-new/2026/06/kiro-fedramp-high-dod-il-4-5-govcloud-us/
9. kiro.dev/changelog/general/kiro-authorized-for-fedramp-high-and-dod-il-4-5-in-aws-govcloud-us/

Last verified 18 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email sales@heritageservices.online. See our methodology.

Use-case comparisons

• US public-sector and FedRAMP AI agents — 19 verified listings (US government, FedRAMP and public-sector compliance or security operations)

Compare Kiro (agent platform with security integrations) with

• Aikido AI AutoFix vs Kiro (agent platform with security integrations)
• Amazon Q Developer security scanning vs Kiro (agent platform with security integrations)
• Black Duck Signal (agentic AI AppSec) vs Kiro (agent platform with security integrations)
• Checkmarx One Assist vs Kiro (agent platform with security integrations)
• Claude Code security review vs Kiro (agent platform with security integrations)
• Codacy AI Reviewer vs Kiro (agent platform with security integrations)
• Cursor Bugbot vs Kiro (agent platform with security integrations)
• Cycode AI Teammates (Exploitability, Remediation and Change Impact agents) vs Kiro (agent platform with security integrations)
• Devin vs Kiro (agent platform with security integrations)
• Endor Labs security agents (agentic triage and remediation) vs Kiro (agent platform with security integrations)

Alternatives

• Aikido AI AutoFix — Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.
• Amazon Q Developer security scanning — Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.
• Black Duck Signal (agentic AI AppSec) — Agentic AI application security tool (GA March 2026) with role- and task-based agents that analyse new code in any language, filter findings by exploitability and apply verified fixes, callable from Claude Code, Gemini and GitHub Copilot via MCP.
• Checkmarx One Assist — Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel.
• Claude Code security review — Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments.
• Codacy AI Reviewer — Hybrid AI pull-request reviewer from Codacy (Lisbon). Combines static analysis with LLM context; vendor pages include security-vulnerability feedback and suggested fixes.

See all Kiro (agent platform with security integrations) alternatives →

Stay updated