Air-gapped and private cloud coverage: where cloud-hosted security platforms stop

Why public clouds are easier

Agentless coverage depends on an API that describes the environment and a way to read workload storage. Public clouds provide both. A private data center or a disconnected network usually does not, and a cloud-hosted security platform may have no network path to it at all.

What the nine name

From pages read in September 2026 and on 11 October 2026:

• Aqua Security names AWS, Azure, Google Cloud, Oracle and Alibaba, plus private cloud and disconnected environments, and states FedRAMP High authorization. Its depth comes from kernel-layer enforcement that runs where the workload runs.
• Orca Security names public cloud, private cloud and on-premises for the Orca Sensor, its eBPF runtime sensor. SideScanning, its agentless method, is described for cloud workloads.
• Microsoft Defender for Cloud covers on-premises servers through Azure Arc, with Defender for Endpoint providing runtime protection.
• The other six do not name on-premises, private or disconnected environments on the pages reviewed.

What this means in practice

Outside public clouds, coverage arrives through something installed: a sensor, an enforcement agent or a management bridge. The speed advantage of agentless scanning mostly disappears there, and the questions become the ones from lesson 3: deployment paths, approvals and upgrades.

For a disconnected environment, add three more:

1. Can the platform's management components run inside the disconnected network, with no outbound connection?
2. How are detection rules and vulnerability data updated without internet access?
3. How do findings from the disconnected segment reach the same console as the rest of the estate, if at all?

How the scores treat it

Our clouds criterion counts on-premises and disconnected environments as two of eight cells. Aqua scores 10.0 there, tied with Orca at the top, because it names both public clouds and the hardest environments. If your estate is the other way round, the coverage calculator lets you tick only the environments you run and see who names them.

Open source as a fallback

Trivy, the open-source scanner Aqua maintains under the Apache-2.0 license, is a scanner rather than a CNAPP. Because it is open source, a team can run it on its own infrastructure; check the project's documentation for offline use before relying on it in a segment a cloud-hosted platform cannot reach.

The planning rule

Put disconnected and private segments on your estate map as separate rows with their own owner and constraints. Choose the main platform for the public-cloud majority, then check whether it, or a second tool, covers the rest. Do not let the hardest segment pick the platform for the easy majority, or the reverse.