Platform profile · Rank 9 of 9
Aqua Security review: the platform that names air-gapped estates
Short answer
Aqua Security is the only platform here that names disconnected (air-gapped) environments, and it states FedRAMP High authorization. Its depth comes from kernel-layer enforcement rather than agentless scanning, and alongside AWS, Azure, Google Cloud, Oracle and Alibaba it names private and disconnected environments, yet its agentless depth is the shallowest here, so it ranks 9 of 9 at 7.45 on a question about fast agentless coverage.
Desk research from public vendor pages read in September 2026, updated 2026-10-11. Editorial assessment; we did not run the products.
Coverage score
Rank 9 of 9 on default weights. Change the weights in the coverage calculator
Which environments does Aqua name?
Aqua's pricing page lists "Support of AWS, Azure, GCP, Oracle and Alibaba Cloud environments"; its platform page names public, private and disconnected environments and states FedRAMP High authorization.
Source: Aqua pricing · Read 11 Oct 2026
- Named on the vendor's pages we reviewed
- Not named on the pages we reviewed (this does not mean unsupported)
Learn more: what a vendor's list of named clouds tells you
How does Aqua see workloads?
- Coverage model
- Agentless posture visibility; the platform's depth comes from kernel-layer runtime enforcement.
Source: Aqua cloud native security platform · Read 27 Sep 2026
- Runtime layer
- Kernel-layer enforcement that blocks attacks without killing the container and preserves memory evidence.
Source: Aqua cloud native security platform · Read 27 Sep 2026
- Path to first findings
- Agentless posture first; workload depth needs the enforcement layer.
Source: Aqua cloud native security platform · Read 27 Sep 2026
What does Aqua claim?
What does Aqua cost?
Not published No list prices. Aqua says Dev Security pricing "is based on the number of code repositories" and Cloud Security is priced by workloads (EC2 instances, Fargate containers, Lambda functions); trial and demo on request.
Source: Aqua pricing · Read 11 Oct 2026
How does Aqua score on each criterion?
| Criterion | Weight | Score | Why |
|---|---|---|---|
| Clouds and environments named | 20% | 10.0tied highest in set | Names AWS, Azure, Google Cloud, Oracle and Alibaba plus private and disconnected environments, seven of eight; only Tencent is missing. |
| Agentless workload depth | 25% | 6.8lowest in set | Agentless posture visibility exists, but the platform's depth comes from kernel-layer enforcement. |
| Path to first findings | 15% | 5.5lowest in set | Agentless posture first; workload depth needs the enforcement layer deployed. |
| Risk context from day one | 15% | 7.8tied lowest in set | Ranks vulnerabilities by reachability, EPSS scores and evidence of active exploitation. |
| Runtime layer when you need it | 10% | 9.0 | Kernel-layer enforcement blocks attacks without killing the container and keeps memory evidence. |
| Integrations and reach | 7% | 7.6 | Trivy's open-source reach, FedRAMP High authorization and support for disconnected environments. |
| Cost visibility before purchase | 8% | 4.0 | No list prices, but the pricing units are published: workloads for Cloud Security, code repositories for Dev Security. |
- Clouds:
Source: Aqua pricing · Read 11 Oct 2026
- Agentless:
Source: Aqua cloud native security platform · Read 27 Sep 2026
- Setup:
Source: Aqua cloud native security platform · Read 27 Sep 2026
- Context:
Source: Aqua cloud native security platform · Read 27 Sep 2026
- Runtime:
Source: Aqua cloud native security platform · Read 27 Sep 2026
- Integrations:
Source: Trivy · Read 27 Sep 2026
- Pricing:
Source: Aqua pricing · Read 11 Oct 2026
Briefings about Aqua
- Which Clouds Each CNAPP Names: Nine Platforms, Eight Environments
- Agentless Reach by Workload Type: VMs, Containers, Serverless, PaaS
- Cloud Security Coverage News, September 2026: What Changed and Why It Matters
- Why Pricing Visibility Counts in a Cloud Coverage Ranking, and Why Only 8%
- Air-Gapped and Private Cloud Coverage: Where Cloud-Hosted CNAPPs Stop
- Minutes, 30 Seconds, 15 Seconds: How to Read CNAPP Speed Claims
Where does it lead, and where does it fall short?
Leads
- Highest or tied highest in set on clouds and environments named.
- The only platform here that names disconnected (air-gapped) environments, plus FedRAMP High authorization.
- Kernel-layer enforcement and Trivy, its widely used open-source scanner.
Falls short
- Lowest or tied lowest in set on agentless workload depth, path to first findings and risk context from day one.
- Scores below 6 platforms on pricing.
- Agentless workload depth is the shallowest here; coverage leans on the enforcement layer.
- No list prices; pricing is by workloads or code repositories.
Key facts
| Ownership | Aqua Security |
|---|---|
| Open-source project | Trivy (maintained by Aqua Security, Apache-2.0) |
| Best fit | Teams with private or disconnected environments and container pipelines |
| FedRAMP | FedRAMP High authorization, per Aqua Source: Aqua cloud native security platform · Read 27 Sep 2026 |
| Compliance frameworks | Built-in compliance reporting; framework names not listed on the pages we read Source: Aqua pricing · Read 11 Oct 2026 |
| Website | www.aquasec.com |
How does Aqua compare head to head?
- Aqua 7.45 v Orca 9.09 · Orca scores higherHead to head
- Aqua 7.45 v Wiz 9.03 · Wiz scores higherHead to head
- Aqua 7.45 v CrowdStrike 7.94 · CrowdStrike scores higherHead to head
- Aqua 7.45 v Defender for Cloud 7.86 · Defender for Cloud scores higherHead to head
- Aqua 7.45 v Cortex Cloud 7.75 · Cortex Cloud scores higherHead to head
- Aqua 7.45 v Sysdig 7.67 · Sysdig scores higherHead to head
- Aqua 7.45 v Upwind 7.63 · Upwind scores higherHead to head
- Aqua 7.45 v SentinelOne 7.49 · SentinelOne scores higherHead to head
Frequently asked questions
How does Aqua Security score for multi-cloud coverage?
7.45 out of 10, rank 9 of 9 on our default weights. Its highest score is on Clouds and environments named (10.0) and its lowest on Cost visibility before purchase (4.0).
Which clouds does Aqua Security name?
On the pages we reviewed: AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, On-premises or private cloud and Disconnected (air-gapped). Aqua's pricing page lists "Support of AWS, Azure, GCP, Oracle and Alibaba Cloud environments"; its platform page names public, private and disconnected environments and states FedRAMP High authorization.
What does Aqua Security cost?
Not published. No list prices. Aqua says Dev Security pricing "is based on the number of code repositories" and Cloud Security is priced by workloads (EC2 instances, Fargate containers, Lambda functions); trial and demo on request.