Cloud Security
CSPM tools that read the account, not the VM (2026)
A 2026 shortlist of posture checks on the cloud account. Public docs, not a lab bake-off.
Expertise: Cloud Security · Level: Intermediate · 12 min read
A hardened image does not close an open bucket.
The VM is patched. The bucket is public. CSPM reads the control plane. The cloud platforms list already compares CNAPP shelves. This page is posture-only. We repeat Prowler, Steampipe, and Wiz because that is the honest overlap, and we say so.
Six checks. Two open CLIs. One SQL layer. One first-party recorder. Two commercial CNAPP posture modules. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Prowler | CLI checks on an account you own | Apache-2.0 |
| ScoutSuite | Multi-cloud audit HTML you generate | GPL-2.0 |
| Steampipe | SQL against cloud APIs | AGPL-3.0 |
| AWS Config | First-party recorder on AWS | AWS consumption |
| Prisma Cloud | Commercial CNAPP posture | Commercial |
| Wiz | Graph CNAPP with a posture view | Commercial |
Prowler
Best for cLI checks on an account you own
Prowler is a CLI that calls cloud APIs and prints failing checks. The cloud platforms list already rows it. Here it is the posture gem.
Key features
- AWS Azure GCP checks
- CLI you can CI
- JSON output
- Apache-2.0
Why we like it
You can run it with a role you created. That is the prove-it. We do not pretend this is a new discovery.
Limits
A check is not remediation. You own the role. Cloud product is separate.
ScoutSuite
Best for multi-cloud audit HTML you generate
ScoutSuite walks the APIs and writes an HTML report. NCC Group maintains it.
Key features
- Multi-cloud collectors
- Offline HTML report
- You run it with your keys
- GPL-2.0
Why we like it
When the output must be a file you can attach to a ticket, ScoutSuite is the honest artifact.
Limits
Point-in-time. Not a continuous CNAPP. You protect the credentials you used.
Steampipe
Best for sQL against cloud APIs
Steampipe turns APIs into tables. Mods ship CIS-like queries. Also on the cloud platforms list.
Key features
- SQL on APIs
- Mods for AWS Azure GCP
- Dashboards
- You operate the engine
Why we like it
A query you can read is a check you can review. That is why it stays here as posture.
Limits
AGPL-3.0. You still schedule it. Not a runtime agent.
AWS Config
Best for first-party recorder on AWS
AWS Config records resource state and evaluates rules. It is not multi-cloud. It is the native posture API.
Key features
- Configuration history
- Managed rules
- Conformance packs
- Remediation hooks
Why we like it
If the estate is AWS-only, start with the recorder you already pay per item. Then add Prowler for the checks Config misses.
Limits
AWS only. Cost follows recorded items. Rules are not Azure Policy.
Prisma Cloud
Best for commercial CNAPP posture
Prisma Cloud includes CSPM in a CNAPP. The cloud platforms list is the shelf. This row is the posture module.
Key features
- Account onboarding
- Misconfig rules
- Code to cloud story
- Enterprise support
Why we like it
Known shelf. We list it so a CLI-only page is not a fantasy.
Limits
Commercial. We did not run a tenant. Do not treat this as a second CNAPP bake-off.
Wiz
Best for graph CNAPP with a posture view
Wiz is on the cloud platforms list as a CNAPP. The CSPM view is one pane. We will not reprint the six-row CNAPP page.
Key features
- Security graph
- Agentless snapshots
- Misconfig findings
- Sales-led
Why we like it
If the buyer already said Wiz, this is the posture they will see. Link the parent list for runtime and DSPM.
Limits
Commercial. Overlap is intentional and declared. We did not run Wiz.
What the internet thinks about CSPM tools
Indie-grade cloud audit threads still name Prowler first. Steampipe shows up in the same comment as the SQL option.
ramimac on Hacker News, Dec 2023: “Prowler is easy to get going with, and gives decent results. It’s much stronger at AWS than GCP or Azure.”
Prove Prowler still ships a license
Confirm the Prowler repo still publishes a LICENSE. Do not point it at an account you do not own.
curl -fsS https://raw.githubusercontent.com/prowler-cloud/prowler/master/LICENSE | head -n 3FAQs
Is this the same as the cloud platforms list?
No. That page is CNAPP shelves. This page is posture checks. Three names overlap on purpose.
Does CSPM replace the workload agent?
No. A public bucket is an account finding. A process on the node is CWPP. Different door.
Can I skip AWS Config if I have Wiz?
You can. You still need a recorder story for audit. Config is the first-party one on AWS.
Is this a scored bake-off?
No. Order is editorial.
