How we score cloud security platforms for multi-cloud coverage

What question do the scores answer?

Which cloud security platform gets a multi-cloud estate to full workload visibility fastest, without rolling out agents first, and what does it trade for that speed?

A coverage score is not a quality score. It measures how much of a multi-cloud estate a platform can see without an agent, how quickly, and how useful that first view is, then credits what you can add later. A platform built around a runtime agent can be the right purchase and still score lower here.

Which criteria and weights do we use?

Each platform gets a score from 0 to 10, to one decimal, on each criterion, with a one-line reason and a source on its profile. The total is the sum of score times weight divided by 100, shown to two decimals. Ranks use the exact total; equal totals share a rank.

Why these weights?

Agentless workload depth carries the most weight (25%) because it decides how much of each workload you see before anything is installed. Clouds and environments named (20%) follows because a multi-cloud team cannot use coverage of a cloud the vendor does not support. Path to first findings and risk context (15% each) decide whether the first week produces a fix list or just an inventory. Runtime (10%) matters, but it is the layer you add after coverage, so it carries less weight here than on a runtime-first ranking. Pricing visibility (8%) and integrations (7%) affect cost and follow-through more than speed of coverage. No criterion carries more than 30%.

How sensitive is the order to the weights?

With equal weights Wiz moves to first and Orca to second. The calculator lets you set your own weights and shows the formula.

What does each score band mean?

What counts as evidence?

• Only vendor pages we read: product and platform pages, documentation, pricing pages and press releases, all read in September 2026 and updated on 11 October 2026.
• Every vendor figure is quoted with the vendor's name and a link, and never presented as our finding.
• A cloud counts as named only if the vendor's own page names it. A press release counts when it names the cloud for the product we score.
• Prices from AWS Marketplace listings are labelled as marketplace prices with their contract term, and where we did not capture the term or unit we say so.
• Where a fact is not on the pages reviewed we write Not published or not named on the pages reviewed, and we do not guess.

What does the coverage strip show?

The strip has eight cells, always in the same order: AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, Tencent Cloud, on-premises or private cloud, and disconnected (air-gapped) environments. A filled cell means the vendor's own pages name that environment. It does not mean we tested coverage there, and an empty cell does not mean the environment is unsupported.

• Named on the vendor's pages we reviewed
• Not named on the pages we reviewed (this does not mean unsupported)

What are the limitations?

Public sources only. No hands-on testing, no demos, no vendor interviews and no access to private benchmarks. Marketing pages describe capabilities, not how well they work in your estate, so use this ranking to decide what to test in a trial. All vendor facts were read in September 2026 and updated on 11 October 2026 and can change after that date.

How do we handle corrections?

Send a correction through the contact page with the topic Correction and a link to the public source. We check it against the vendor's page, update the data and note the change; totals recompute automatically.