What full cloud coverage means, and why vendors mean different things by it

Part one: every environment

A multi-cloud estate is a list of places: accounts in AWS, subscriptions in Azure, projects in Google Cloud, and for some teams tenancies in Oracle Cloud, Alibaba Cloud or Tencent Cloud, plus servers in a private data center. Coverage starts with whether a platform can connect to each of those places at all.

Vendors publish this unevenly. Orca Security's platform page names six public clouds. Wiz names four. Microsoft Defender for Cloud documents Azure, AWS and Google Cloud, and reaches on-premises servers through Azure Arc. The others name between three and five public clouds, and Aqua Security also names private and disconnected environments. This site's coverage strip shows which environments each vendor names.

Part two: every workload type

Inside each environment sit different kinds of workload: virtual machines, containers and the images they come from, Kubernetes clusters, serverless functions, managed platform services (PaaS) and, increasingly, AI services. A platform that sees every VM but no serverless function has a coverage gap that does not show up in an account count.

Part three: enough depth

Seeing that a VM exists is inventory. Seeing which packages are installed on it, which secrets sit on its disk and which of its vulnerabilities are reachable from the internet is depth. Posture tools read the cloud provider's configuration APIs and see the first. Workload scanning reads the workload itself and sees the second.

Where agents come in

There are two ways to read a workload deeply: from outside, without installing anything, or from inside, with an agent or sensor running on the workload. The outside route is usually faster to switch on across a large estate, because nothing has to be deployed. The inside route sees what is happening while the workload runs, which the outside route cannot. Lesson 2 and lesson 3 cover each in turn.

How to use the three parts

When a vendor says "full coverage", ask three questions:

1. Which of my environments do you connect to, by name?
2. Which workload types do you read in each, and which need an agent?
3. For each workload type, what do you read: configuration only, or the workload's own file system?

Write the answers in a table with your environments as rows. Gaps show up quickly, and they are easier to discuss than a general claim.

How this site scores it

Our ranking splits coverage into two criteria: clouds and environments named (20%) and agentless workload depth (25%). A third, path to first findings (15%), covers how quickly the first two arrive. On those three, Orca scores 10.0, 9.8 and 9.0, and Wiz scores 9.0, 9.6 and 8.5. The other four criteria cover what you get after that first view.