Which clouds each cloud security platform names, and what the gaps mean

What did we count?

Eight environments a multi-cloud team might run: AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, Tencent Cloud, on-premises or private cloud, and disconnected (air-gapped) environments. For each platform we marked an environment as named only if the vendor's own page, or a vendor press release about the product we score, names it. This briefing covers pages read in September 2026 and on 11 October 2026.

What did we find?

• Orca Security names 7: all six public clouds on its platform page, plus public cloud, private cloud and on-premises for the Orca Sensor.
• Wiz names 4: AWS, Azure, Google Cloud and OCI. After Google completed its acquisition on 11 March 2026, Wiz stated that it remains a multi-cloud platform.
• Upwind names 4: AWS, Google Cloud, Azure and OCI, presented as partnerships on its homepage.
• Microsoft Defender for Cloud names 4: Azure, AWS and Google Cloud, and on-premises servers through Azure Arc.
• Aqua Security names 7: AWS, Azure, Google Cloud, Oracle and Alibaba on its pricing page, plus private and disconnected environments.
• Palo Alto Networks Cortex Cloud names 5: AWS, Azure, Google Cloud, OCI and Alibaba Cloud on its posture page.
• CrowdStrike Falcon Cloud Security names 4: AWS, Azure, Google Cloud and OCI, linked from its cloud security page.
• Sysdig Secure names 4: AWS, Google Cloud and Azure for all agentless features, Oracle Cloud for CSPM only.
• SentinelOne Singularity Cloud names 3: AWS, Azure and Google Cloud, plus "many other" environments it does not list.

Why did the counts change?

In September three large vendors named no cloud on the pages we read. On 11 October we read their product, pricing, posture and documentation pages, which do name clouds. The lesson for buyers: the product overview is rarely where a vendor commits to a cloud list, so look at docs and pricing pages too.

Which gaps matter most?

For most estates, AWS, Azure and Google Cloud decide the question. All nine platforms now name all three. The long tail matters to fewer teams, but decisively to them:

• Oracle Cloud: named by Orca, Aqua, Cortex Cloud, Wiz, Upwind, CrowdStrike and Sysdig (CSPM only).
• Alibaba Cloud: named by Orca, Aqua and Cortex Cloud.
• Tencent Cloud: named by Orca only.
• On-premises or private cloud: named by Orca (for its sensor), Defender for Cloud (servers through Azure Arc) and Aqua.
• Disconnected environments: named by Aqua only.

What does a named cloud not tell you?

Which services and workload types are covered there, whether that coverage is agentless, and whether any region or sovereign variant is excluded. A vendor that names six clouds may read VMs in all six and serverless in two. Ask for a per-cloud breakdown in writing; lesson 5 lists the questions.

How does this feed the ranking?

The count is not the score. Our clouds criterion, weighted 20%, also credits how clearly coverage is stated. Orca and Aqua score 10.0, Cortex Cloud 9.2, Wiz 9.0, CrowdStrike 8.5, Sysdig 8.0, Defender for Cloud 7.5, and Upwind and SentinelOne 7.0. A partnership mention, a CSPM-only cloud or an unlisted "many others" counts for less than a coverage statement. The rankings show every strip.

What should a buyer do with this?

Tick the environments you run in the coverage calculator. It flags every platform that does not name one of them. Those platforms are not out; they owe you a written answer before they go on the shortlist.