How agentless scanning works, and what it cannot see

Two levels of agentless

The lightest level reads configuration. The platform gets read access to a cloud account and asks the provider's APIs what exists and how it is set up: which storage buckets are public, which identities have broad permissions, which security groups are open. This is cloud security posture management (CSPM), and every platform on this site offers it.

The deeper level reads the workload's own disk. The platform takes a view of the workload's storage, outside the running workload, and inspects the file system: installed packages, their versions, secrets left in files, malware, configuration files. This finds vulnerabilities and exposed secrets on the workload itself, still without an agent.

How vendors describe the deeper level

Orca Security calls its approach SideScanning. Orca says it reads workloads' runtime block storage and reconstructs the file system in a read-only view, covering Linux and Windows VMs, containers and images, and serverless. Orca states that it "deploys in minutes" and describes the technology as patented.

Wiz describes an agentless connection through cloud APIs and states that it reaches VMs, containers, serverless, PaaS and AI resources without agents.

Microsoft Defender for Cloud offers agentless VM, secrets and Kubernetes scanning in its paid Defender CSPM and Defender for Servers Plan 2 tiers; its free Foundational CSPM tier covers configuration only.

SentinelOne describes its Cloud Native Security as "an agentless CNAPP".

These are each vendor's own descriptions. The useful buyer question is the same for all of them: which workload types does the deeper level reach, in which clouds?

Why agentless is the fast route

An agent has to be installed on every workload, kept updated and approved by every team that owns a workload. An agentless connection is set up once per account, subscription or project, often through an organization-level role that covers many accounts. For a team that needs an inventory across hundreds of accounts quickly, that difference decides the timeline.

What agentless cannot see

Reading a copy of storage shows what is installed, not what is running. It does not see a process starting, a network connection opening or a file changing between scans. It cannot block anything. Detection and prevention inside a running workload need a sensor or agent, which lesson 3 covers.

Agentless scanning also runs on a schedule. A workload that lives for a few minutes may be created and gone between two scans.

How to check depth in a trial

1. Pick one workload of each type you run: a Linux VM, a Windows VM, a container image, a serverless function.
2. Plant a known test finding on each, such as an old package version.
3. Connect the platform without agents and record which findings appear, and how long after connection.

On this site, agentless workload depth carries 25% of the total. Orca leads it at 9.8, with Wiz at 9.6.