Kiro (agent platform with security integrations)

What it does

Kiro is AWS's agentic development environment. In autonomous mode, its agent plans work, delegates to sub-agents and opens pull or merge requests. The Kiro Powers directory, on Kiro's own site, includes security powers for Snyk (Secure at Inception), Aikido Security code scanning, SonarQube Code Quality & Security, and Sonatype. Kiro's docs explain that powers load dynamically to give the agent those tools. Kiro is listed as an agent platform with security integrations, not as a dedicated security scanner. AWS documents that Kiro is FedRAMP High and DoD IL-4/5 authorized in AWS GovCloud (US); Kiro is marked in-scope for FedRAMP Class C (East/West) and Class D (GovCloud) on AWS's services-in-scope list (updated 15 Oct 2026). The Marketplace package for AWS GovCloud is F1603047866 (FedRAMP Authorized, High).

Frameworks (vendor-stated)

FedRAMP

Vendor-claimed FedRAMP

Government authorizations

Registry records checked 2026-10-18. Scope “listing” means the certified product is this listing or the government boundary it already documents; “platform-only” means another product line is certified and the vendor does not state this agent is inside that boundary.

Pricing (as published)

Published: Free $0 (50 credits); Pro $20/user/month (1,000 credits); Pro+ $40 (2,000 credits); Pro Max $100 (5,000 credits); Power $200; extra credits $0.04 each (kiro.dev/pricing at last check).

Tasks

agent platform with security integrationsappsecpr review

Sources

1. kiro.dev/powers/ (primary)
2. kiro.dev/docs/powers/
3. kiro.dev/docs/web/autonomous-mode/
4. kiro.dev/pricing/
5. aws.amazon.com/agreement/
6. fedramp.gov/marketplace/products/F1603047866/
7. aws.amazon.com/compliance/services-in-scope/FedRAMP/
8. aws.amazon.com/about-aws/whats-new/2026/06/kiro-fedramp-high-dod-il-4-5-govcloud-us/
9. kiro.dev/changelog/general/kiro-authorized-for-fedramp-high-and-dod-il-4-5-in-aws-govcloud-us/

Last verified 18 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email [email protected]. See our methodology.

Use-case comparisons

• US public-sector and FedRAMP AI agents — 25 verified listings (US government, FedRAMP and public-sector compliance or security operations)

Compare Kiro (agent platform with security integrations) with

• 
  Aikido AI AutoFix vs Kiro (agent platform with security integrations)
• 
  AISLE (autonomous vulnerability discovery, triage and verified-fix agents) vs Kiro (agent platform with security integrations)
• 
  Amazon Q Developer security scanning vs Kiro (agent platform with security integrations)
• 
  Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests) vs Kiro (agent platform with security integrations)
• 
  Black Duck Signal (agentic AI AppSec) vs Kiro (agent platform with security integrations)
• 
  Checkmarx One Assist vs Kiro (agent platform with security integrations)
• 
  Claude Code security review vs Kiro (agent platform with security integrations)
• 
  Codacy AI Reviewer vs Kiro (agent platform with security integrations)
• 
  Contrast AI SmartFix (agentic vulnerability remediation) vs Kiro (agent platform with security integrations)
• 
  Cursor Bugbot vs Kiro (agent platform with security integrations)

Alternatives

• 
  Aikido AI AutoFix — Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.
• 
  AISLE (autonomous vulnerability discovery, triage and verified-fix agents) — Prague-headquartered AI code-security platform in which thousands of agents analyse a codebase in parallel for exploitable vulnerabilities, fix agents write patches, and agentic verification builds the repo and runs tests before opening a pull request for human merge. October 2026 added agent-driven proof of exploitability against running web apps and APIs. Cohere signed a letter of intent to acquire AISLE on Oct 15, 2026.
• 
  Amazon Q Developer security scanning — Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.
• 
  Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests) — German AppSec product from Düsseldorf: a team of agents audits repositories (SAST, secrets, SCA, IaC, CI/CD) and cloud accounts, triages signals so only confirmed findings surface, pentests running apps inside a verified scope with a separate agent reproducing every finding, reviews pull requests with a merge-blocking status check, and opens fix pull requests that run your tests but never merge themselves.
• 
  Black Duck Signal (agentic AI AppSec) — Agentic AI application security tool (GA March 2026) with role- and task-based agents that analyse new code in any language, filter findings by exploitability and apply verified fixes, callable from Claude Code, Gemini and GitHub Copilot via MCP.
• 
  Checkmarx One Assist — Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel.

See all Kiro alternatives →

FAQ (from this dataset)

What does Kiro do?

Agent platform with security integrations: AWS's agentic IDE and autonomous agent, with Kiro Powers for Snyk, Aikido, SonarQube and Sonatype scanning.

How much does Kiro cost?

Published: Free $0 (50 credits); Pro $20/user/month (1,000 credits); Pro+ $40 (2,000 credits); Pro Max $100 (5,000 credits); Power $200; extra credits $0.04 each (kiro.dev/pricing at last check).

Where is Amazon Web Services headquartered?

United States

Which frameworks does Kiro support?

Frameworks (vendor-stated): FedRAMP. Framework tags indicate relevance, not certification.

What are alternatives to Kiro?

See the Kiro alternatives page for category-sharing listings in relevance order, not a ranking. Kiro alternatives.

Stay updated