Cloud Security
Cloud security platforms that see the account, not only the CVE (2026)
A 2026 shortlist of CNAPP / CSPM platforms for exposure, identity in the cloud, and toxic combinations. Public docs, not a bake-off.
Expertise: Cloud Security · Level: Intermediate · 18 min read
A CVE without the identity and the exposure is homework.
The finding that still gets you is a public bucket that an admin identity can write, or a VM that is internet-reachable, over-privileged, and sitting next to the data. That is a toxic combination. Wiz’s own blog names the shape: a resource with a high chance of compromise and a real business impact if it falls. This page is the shortlist of platforms and open tools that still try to name the path.
Six entries. Two agentless CNAPPs (Wiz, Orca), one hyperscaler console (Defender for Cloud), and three tools you can run without a sales cycle: Prowler for posture checks, Falco for runtime, Steampipe for the SQL join. Vega is not a CNAPP and is not on this list. The Docker security note and the authentication guide cover the adjacent jobs.
Technical check: we cross-check first-party CNAPP and CSPM pages, project READMEs, public licenses and pricing, and live community threads. Rank is a technical recommendation, not a recap of other lists. We assigned no score and did not run a lab comparison.
| Platform | Best for | License |
|---|---|---|
| Wiz | Toxic combinations on a multicloud graph | Commercial (sales-quoted) |
| Prowler | Open-source CSPM you can run tonight | Apache-2.0; Cloud from $79/account/mo annual |
| Falco | Runtime threats on hosts and Kubernetes | Apache-2.0 |
| Steampipe | SQL over live cloud APIs | AGPL-3.0; Turbot Pipes hosted |
| Orca Security | Agentless SideScanning without a host agent | Commercial (sales-quoted) |
| Defender for Cloud | Azure-home CNAPP that also covers AWS and GCP | Foundational CSPM free; paid plans |
Wiz
Best for toxic combinations on a multicloud graph
Wiz’s first-party pages call the product a CNAPP and a CSPM in one graph. The Security Graph is the claim: correlate network exposure, identity, vulnerabilities, secrets, and data, then raise a toxic combination instead of a thousand isolated alerts. Agentless scanning is the deployment story. An eBPF runtime sensor is now on the same site for detect-and-block.
Key features
- Agentless scan across AWS, Azure, GCP, and Kubernetes, modeled on the Security Graph
- Toxic combinations raised as Wiz Issues when likelihood and business impact both go critical
- Code-to-cloud context, attack-path modeling, and ownership mapping for the fix
- Optional eBPF runtime sensor plus cloud and SaaS log analysis for detect and block
Why we like it
Use it when the job is “show me the path,” not “show me every CVE in the account.” The CSPM blog is explicit: a misconfigured machine is noise until it is also internet-exposed and running a known exploit. That is the CNAPP argument in one sentence. Forrester Wave CNAPP Q1 2026 and a Customers’ Choice CSPM badge sit on the same homepage. We did not sit in the console.
Limits
Pricing is sales-quoted. There is no public list on wiz.io. The graph is only as good as the cloud APIs and the snapshots it can read. Runtime block still wants the sensor. Public deal threads about Google and Wiz are why we treat multicloud independence as a fact you re-check.
License
Commercial. Demo and sales. No public per-workload card on the first-party site we read.
Prowler
Best for open-source CSPM you can run tonight
Prowler is the open cloud security platform most teams already reach for when they want CIS, NIST, and custom checks without a CNAPP contract. The README calls it a security and compliance scanner across AWS, Azure, GCP, Kubernetes, GitHub, M365, and more. The site’s own use-case list leads with Cloud Security Posture Management. We do not call it a CNAPP. They do not either.
Key features
- CLI, Local Server UI, and Prowler Cloud SaaS on the same check library
- Hundreds of built-in controls: CIS, NIST, PCI-DSS, GDPR, HIPAA, SOC2, ISO 27001, AWS FTR
- AWS Security Hub integration and a GitHub Action that can upload SARIF
- Attack Paths for AWS after a scan, using a graph sink (Neo4j or Neptune)
Why we like it
Use it when you need a posture report you can read, mute, and pipe. The Apache-2.0 CLI has no account cap. Prowler Cloud publishes a price, which is rarer than it should be in this category.
ramimac wrote it in December 2023, on an Ask HN about indie-grade cloud audits: “It’s much stronger at AWS than GCP or Azure. Steampipe can be a little harder to wrap your head around, but scales really well and has broader support.” That is still the honest split: Prowler for the check catalog, Steampipe when you want to write the join.
Limits
Coverage is uneven across clouds. Attack Paths are AWS-first in the README we read. The SaaS is a different product from the CLI. A check catalog is not a runtime detector and it is not a full CNAPP graph.
License
Apache-2.0 for the open project. Prowler Cloud is $99 per cloud-provider account per month, or $79 on annual billing, with a 50,000-resource envelope. Private Cloud is custom. Price lives here and in the table. Unlink any later repeat.
Falco
Best for runtime threats on hosts and Kubernetes
Falco is cloud-native runtime security. The project page is blunt: detect abnormal behavior from Linux kernel events, enrich with container and Kubernetes metadata, and fire a rule. eBPF is the modern probe. Plugins extend it to CloudTrail, Okta, and GitHub. It is a detector. It does not inventory your IAM graph.
Key features
- Streaming detection on syscalls, with default rules you can tighten
- eBPF and kernel-module drivers; official Helm chart for Kubernetes
- Plugins for cloud audit sources; JSON alerts to 50-plus SIEMs and lakes
- CNCF graduated. Originally created by Sysdig. Runs on x64 and ARM
Why we like it
A posture scan tells you the bucket was public yesterday. Falco tells you a shell just spawned in a container that should not have one. That is the other half of exposure. Pair it with a CSPM. Do not ask it to be one.
Limits
The driver is the tax. Stack Overflow is full of kernel-header misses, missing BPF probes, and managed-node friction. Rules without exceptions will fire on your 3 a.m. Ansible run. Falco does not score toxic combinations across accounts.
License
Apache-2.0. Project home is falco.org. Zero cost to start. Commercial adjacent tools (Sysdig, sidekicks) are separate products.
Steampipe
Best for SQL over live cloud APIs
Steampipe’s line is select * from cloud; Zero-ETL: plugins map AWS, Azure, GCP, Kubernetes, GitHub, and 150-plus other APIs into Postgres tables you query live. Security mods on the Hub give you CIS-style benchmarks. You write the join between a public security group and the instance profile yourself.
Key features
- Single binary CLI with a bundled Postgres, plus native Postgres FDW and SQLite extensions
- Plugin library for clouds, SaaS, and files, with documented tables and example queries
- Security, compliance, cost, and operations mods you can run as SQL
- Turbot Pipes for a hosted workspace; Powerpipe for dashboards
Why we like it
When the CNAPP UI will not answer “which buckets are public and writable by this role, right now,” Steampipe is the tool that will. The homepage use case is literally “What security groups are open to the world?” You keep the query. You do not wait on a vendor’s issue type.
Limits
It is a query engine. It does not page you when a toxic combination appears at 2 a.m. unless you wrap it. AGPL-3.0 is the repo license; Turbot’s commercial terms cover the product they ship. The README is explicit that others may distribute the software and may not use Turbot trademarks. Expect a learning curve. ramimac said as much.
License
AGPL-3.0 for the core repository. CLI download is free. Turbot Pipes is the hosted commercial option. Contributors sign a CLA.
Orca Security
Best for agentless SideScanning without a host agent
Orca’s homepage and schema call it a CNAPP. SideScanning is the patented move: read runtime block storage out of band, reconstruct the filesystem in a virtual view, and score risk without a packet on the workload network. The pitch is full inventory in hours. An optional Sensor exists when you want runtime too.
Key features
- Agentless SideScanning of VMs, containers, images, and serverless
- Unified data model that correlates misconfig, identity, data, and malware
- Attack-path analysis to crown-jewel resources
- Code scanning scored against live cloud context; optional runtime Sensor
Why we like it
Reach for Orca when you want agentless depth and you do not already own Wiz. The SideScanning page is unusually specific: no agent, no network scan, no code running in the guest. That is a real deployment difference from Falco and from any host-agent CNAPP. Pricing is sales-quoted. We did not run a scan.
Limits
Snapshot timing is a known agentless constraint. SideScanning is not a streaming detector. The Sensor is a second deploy. There is no public price card on orca.security. A 2020 CNCF-adjacent fight with Palo Alto over review videos is history; it does not change the current product page.
License
Commercial. Demo and sales. Founded December 2019 per first-party schema.
Microsoft Defender for Cloud
Best for an Azure-home CNAPP that also covers AWS and GCP
Microsoft’s product page and pricing page both call Defender for Cloud a CNAPP: CSPM, DevOps security, and workload protection across hybrid and multicloud. Foundational CSPM is free. Defender CSPM is the paid plan that adds agentless scanning, attack paths, and the cloud security graph. A 30-day trial sits in front of pay-as-you-go.
Key features
- Foundational CSPM: continuous assessment, Secure Score, Microsoft cloud security benchmark on Azure, AWS, and GCP
- Defender CSPM: agentless vulnerability scanning, attack-path analysis, data-aware posture, code-to-cloud context
- Workload plans for servers, containers, databases, storage, APIs, and AI services
- DevOps security across pipelines; findings land in the Defender portal
Why we like it
If the bill already lives in Azure, start here before you buy a second graph. The FAQ on the product page is the clean definition: CNAPP equals CSPM plus workload protection plus DevOps security. Azure Security Center was the old name, renamed in 2021. We did not enable a plan.
Limits
The interesting graph is on the paid plan. Workload protection is a menu of extra meters; we will not dump the tier list. Findings can lag after you fix a policy. Home-cloud gravity is real: the console is Azure even when the resource is in AWS. Foundational CSPM for new Azure subscriptions moves to opt-in on 27 October 2026 per Microsoft Learn.
License
Foundational CSPM is free. Defender CSPM and workload plans are billed per resource after a 30-day trial. Commit Units can discount pay-as-you-go. Exact unit prices belong on the Azure pricing page, not in a third paragraph here.
What the internet thinks about cloud security platforms
Live threads. We quoted the argument, not the score.
Hacker News
“What they particularly liked was the alert fidelity – most other cloud security vendors back when Wiz started required a host agent to provide a similar level of assurance a given alert was real, whereas Wiz would do offline volume scanning.”
marcus0x62, 18 Mar 2025, on the Google-Wiz thread. A former competitor. The agentless fidelity argument is the one Wiz still sells.
Stack Overflow
“I have a Falco stack which keeps an eye on what is going on the production servers and raises alerts when an event that I describe as suspicious is found. So the problem I’m running through is, my playbook triggers some alerts.”
Arch on a nightly compliance playbook that opened /etc/shadow and woke Falco. Runtime detectors need exceptions. Posture scanners do not see that hour.
Information Security
“The way to secure an S3 bucket is to make it private, and grant access to the specific IAM roles that need access. Do not rely on long complicated names to protect it alone.”
keithRozario on public-bucket folklore. The combo is still ACL plus identity. A long name is not a CSPM finding you can close.
FAQs
Is a CNAPP the same as a CSPM?
No. Wiz’s own academy page is the first-party split we used. CSPM watches configuration and compliance. A CNAPP keeps that and adds workload, identity, data, and (often) runtime so it can prioritize toxic combinations. Prowler is a CSPM-class scanner. Wiz, Orca, and Defender for Cloud call themselves CNAPPs on their product pages. Falco and Steampipe are neither.
Why are Prowler, Falco, and Steampipe on a CNAPP list?
Because most teams do not buy a graph on day one. Prowler is the open posture catalog. Falco is the runtime half a CNAPP will later claim. Steampipe is how you write the toxic-combination join yourself. They sit next to Wiz, Orca, and Defender so the shortlist is not six sales decks.
Why isn’t Vega on this list?
Vega is not a CNAPP. It does not scan cloud accounts for toxic combinations or ship a CSPM graph. Putting it here would be a category error. If you want the federated / agentic post-SIEM option, that is a different shortlist.
Is this a scored bake-off?
No. Order is editorial. We did not install these in a lab or assign points. A platform is here if first-party docs still describe a CNAPP, a CSPM, or a live query/runtime job that maps to exposure and identity in the cloud.
