Cloud security questions: short answers on CNAPP coverage and buying

Every environment you run is connected, every workload type in it is seen, and each workload is read deeply enough to find what matters. See what full coverage means.

Agentless scanning reads workloads from outside, through cloud APIs and a view of their storage, without installing anything. A sensor runs on the workload and sees activity as it happens, which makes detection and blocking possible.

For inventory, posture and most vulnerability and secrets findings, often yes. For detecting and blocking attacks in running workloads, no: that needs a sensor or agent.

VMs, containers and their images, Kubernetes, serverless functions, managed platform services and AI services. Ask each vendor which of these it reads without an agent, cloud by cloud.

Cloud security posture management checks cloud configuration through provider APIs. It is one layer of coverage; it does not read the workloads themselves.

Some keep product pages short and put details in documentation. An unnamed cloud is a question to ask, not proof of missing support; see what a named cloud tells you.

Map your environments and workload types first, check which platforms name all of them, then trial two or three on the same accounts and measure the first inventory. Our rankings weight coverage first.

Microsoft Defender for Cloud publishes a full price list with a free tier and a 30-day trial. Wiz, Orca, Upwind, Sysdig and CrowdStrike list prices on AWS Marketplace, with different units and terms. SentinelOne, Cortex Cloud and Aqua publish no price we could state with its unit; Aqua publishes its pricing units.

Long enough to connect the same accounts to each platform, wait for the first full inventory and check it against your own map and a few planted findings. Measure the time to inventory rather than relying on vendor claims.

Often that keeps findings in one place. Compare runtime scores first: CrowdStrike and Sysdig score highest on runtime here, and Orca scores lowest.

Which clouds you support by name, which workload types you read without an agent in each, how new accounts are picked up, and which environments are excluded. Ask for the answers in writing.

Yes. The coverage calculator re-ranks the nine platforms with your weights and flags environments a vendor does not name.

Orca Security, at 9.09 on our default weights, with Wiz at 9.03. With equal weights the order of the top two reverses.

Orca scores higher on clouds named, agentless depth and path to first findings; Wiz scores higher on risk context, runtime, integrations and pricing. See Orca v Wiz.

Cost visibility. It is the only platform here with a free tier, published per-resource pricing and a public calculator, and it scores highest in set on pricing at 9.2.

CrowdStrike and Sysdig, both at 9.6, followed by Upwind at 9.4. Their depth comes from a sensor or agent, which is why they score lower on agentless coverage.

Palo Alto Networks merged Prisma Cloud with Cortex CDR to form Cortex Cloud, announced on 13 February 2025, and Prisma Cloud customers move onto Cortex Cloud. We score it as Cortex Cloud.

Wiz states it remains a multi-cloud platform covering AWS, Azure, Google Cloud and OCI. Google completed the acquisition on 11 March 2026.

On the pages we reviewed, only Aqua Security names disconnected environments, and it states FedRAMP High authorization. Wiz for Government is also FedRAMP High authorized, and Orca states FedRAMP authorization at the Moderate level.

Each platform is scored 0 to 10 on seven criteria with a written reason. The total is the weighted average using the published weights, computed in code. See method.

Because this site answers one question: how fast a platform can see every workload across many clouds without installing anything. Agentless depth carries 25% and clouds named 20%.

No. Scores are an editorial assessment of public vendor pages read in September 2026 and updated on 11 October 2026. Vendor figures are labelled as vendor claims.

Use the contact page with the topic Correction and a link to a public source. We check it against the vendor's page and update the data.