Cloud security coverage news from September 2026

How we chose these

This briefing covers vendor announcements dated 1 to 24 September 2026 that we read on 27 September 2026, for the platforms and projects on this site. We include an item when it affects where or how a platform covers cloud workloads, or who can buy it. Each item links to its source below.

SentinelOne: managed hunting across three clouds (24 September)

SentinelOne extended its Wayfinder Threat Hunting service to AWS, Azure and Google Cloud. The managed hunting now covers cloud control-plane activity such as IAM privilege escalation, suspicious IAM policy changes and S3 bucket reconnaissance, for existing Wayfinder Threat Hunting customers through Singularity Marketplace plugins.

What it means for coverage: the press release names three clouds for a managed service, not for Singularity Cloud's CNAPP itself. We do not count it toward SentinelOne's named environments, which come from its Cloud Native Security page instead: AWS, Azure and Google Cloud.

Falco 0.45.0 (21 September)

The CNCF runtime detection project added raw byte matching in rule conditions, reload status endpoints, driver 11.0.0 and new rules that flag containers accessing GPU devices. Sysdig Secure builds its runtime detection on Falco, which Sysdig created.

What it means: GPU-access rules are relevant to teams running AI workloads in containers. Runtime depth on this site is already led by Sysdig and CrowdStrike at 9.6.

Orca Security: a partner program (16 September)

Orca announced the Partner POD Program, which rewards partners across the customer lifecycle including net retention, and an AI-based Partner Success Platform available in six languages at launch.

What it means: integrations and reach is the criterion where Orca scores 8.2 against Wiz's 9.8. A partner program is a step toward a wider footprint; it does not change the score until it shows up in reach buyers can see.

Wiz for Gov: GovRAMP High (10 September)

Wiz says Wiz for Gov is now GovRAMP High authorized, validated against NIST SP 800-53r5 controls for state and public sector data.

What it means: public sector teams in the US get another authorized option. Wiz's government page also states that Wiz for Government is FedRAMP High authorized. Aqua states FedRAMP High authorization, and Orca states FedRAMP authorization at the Moderate level.

Orca Security: Japanese localization (2 September)

Orca released full Japanese localization of its platform, covering menus, alerts, dashboards and profile management. Orca's newsroom index lists 1 September; the release page is dated 2 September, which we use.

What it means: a practical point for teams with Japanese-speaking operators. It does not change cloud coverage.

Palo Alto Networks acquires Console (1 September)

Palo Alto Networks acquired Console, an AI-native platform for resolving alerts, issues and requests, and says it will deepen agentic capabilities in Cortex. Terms were not disclosed.

What it means: Cortex Cloud sits in the Cortex portfolio. The deal points to more automated handling of findings, which matters after coverage is in place.

Does any of this change the ranking?

No. None of these September items changed a score. Scores changed on 11 October 2026 for other reasons: new pages naming clouds and AWS Marketplace prices. See the rankings. The ranking stands at Orca Security 9.09, Wiz 9.03.