LESSON 4 · CHOOSING A PLATFORM · 2 MIN READ
Map your cloud estate before you trial a cloud security platform
Short answer
Write down what you run before any vendor connects to it: each environment, the workload types in each, rough counts and who owns them. The map turns a vendor's coverage claim into a yes or no per row, and it gives you a baseline to check the first inventory against.
Why map first?
A platform's first inventory will be the most complete picture of your estate many teams have ever seen. That is useful, but it also makes the platform the judge of its own coverage. If you have your own list first, you can see what the platform missed, not only what it found.
What goes on the map
One row per environment. Columns:
- Environment: cloud and account, subscription or project grouping. For example "AWS, production organization", "Azure, two subscriptions", "Oracle Cloud, one tenancy", "on-premises VMware cluster".
- Workload types present: VMs (Linux, Windows), containers and Kubernetes, serverless functions, managed databases and other PaaS, AI services.
- Rough counts: an order of magnitude is enough (tens, hundreds, thousands).
- Owner: the team that would approve a read-only role or a sensor install.
- Constraints: regulated data, air-gapped segments, workloads where no agent may run.
Where to get the numbers
Your cloud providers' own consoles and billing exports list accounts and services. Your configuration management or infrastructure-as-code repositories list what was meant to exist. The gap between those two lists is itself worth knowing.
How to use the map with vendors
Send each vendor the environment and workload-type columns (not the counts if you prefer) and ask them to mark each cell: supported without an agent, supported with an agent, or not supported. Ask for the answer in writing. Compare those answers with what their public pages name; this site's coverage strip shows the public side for nine platforms.
Use the map to set weights
If your map has three clouds and a long tail of accounts, agentless breadth matters most, which is the question our default weights answer. If it has one cloud and a mature agent rollout, runtime and integrations matter more. If it has an air-gapped segment, very few platforms here name that environment at all; Aqua Security is the one that does. Put your own weights into the coverage calculator and tick the environments on your map.
Keep the map
The map is also the checklist for the trial in lesson 6 and the baseline for keeping coverage complete after purchase.
Next lesson: What a vendor's list of named clouds tells you, and what it does not