Cloud Security Compare

Buyer note

What changed for CNAPP buyers in 2026: nine months of vendor news

Cloud Security Compare editors · · Editorial assessment

The short version

Four changes between January and September 2026 matter most to a buyer comparing cloud security platforms: Google now owns Wiz, Palo Alto Networks keeps adding agentic tools around Cortex, Upwind raised a $250 million Series B, and nearly every vendor shipped AI features. None of them moves our scores on its own, but each one adds a question to ask in an evaluation.

Does Google owning Wiz change a Wiz evaluation?

Google completed its acquisition of Wiz on 11 March 2026, after announcing the $32 billion deal on 18 March 2025. Wiz states it remains a multi-cloud platform across AWS, Azure, Google Cloud and OCI. Since the close, Wiz has kept shipping under its own name: Penetration Test Findings reached general availability on 19 August 2026, and Wiz for Gov achieved GovRAMP High authorization on 10 September 2026.

For a buyer on AWS or Azure, the open question is commercial rather than technical: how the product will be sold, supported and priced to customers of other clouds. Ask for the answer in writing. More on the options: Wiz alternatives.

What is Palo Alto Networks adding around Cortex Cloud?

Palo Alto Networks formed Cortex Cloud in February 2025 by merging Prisma Cloud with Cortex CDR. On 1 September 2026 it acquired Console, an AI-native platform for resolving alerts, issues and requests, and said the deal will deepen agentic capabilities in Cortex. Terms were not disclosed. For a Prisma Cloud customer being moved to Cortex Cloud, the useful question is which new capabilities come with the Cortex Cloud licence and which are sold separately. More: Prisma Cloud alternatives.

What does Upwind's Series B mean for buyers?

Upwind announced a $250 million Series B on 26 January 2026, led by Bessemer Venture Partners and Picture Capital, and says its total funding is now over $430 million. Upwind was founded in October 2022, and its newsroom lists 150+ customers. Funding does not change what the product does today; our Upwind scores rest on its product pages, strong on runtime (4.7) and weaker on ecosystem (3.5). What funding changes is the supplier-risk conversation for a younger vendor, which belongs in procurement rather than in the technical score. More: Orca vs Upwind and Upwind vs Wiz.

Which AI features did vendors ship?

AI was the most common subject of 2026 announcements, in two different senses: securing AI workloads, and using AI agents to do security work.

  • Orca Security announced AI AppGen Security and AI Code Security Auditor on 29 July 2026, ahead of Black Hat USA. Orca expects general availability later in 2026.
  • Sysdig introduced Headless Cloud Security on 6 May 2026, which delivers CNAPP functions as agent skills inside AI coding agents, and Sysdig Secure AI on 4 August 2026.
  • Aqua Security announced Aqua Compass on 22 April 2026, an MCP server that lets AI agents investigate and contain runtime incidents with human oversight.
  • Microsoft added threat protection for AI agents (preview, 2 February 2026) and AI model security for Azure Machine Learning (preview, 30 March 2026) to Defender for Cloud.
  • CrowdStrike added a Cloud Risk Engine that maps cloud risks to adversary tradecraft, announced on 24 March 2026.

The buyer's question is the same for each: is it generally available, which plan includes it, and can you test it in your proof of concept? Several of these launched as previews or with availability later in the year.

What changed in pricing and packaging?

The one dated pricing change came from Microsoft. From 27 October 2026, Foundational CSPM, the free posture tier of Defender for Cloud, will no longer be turned on by default for new Azure subscriptions. It stays free, existing subscriptions are not affected, and AWS and GCP connectors are unchanged. Teams that rely on the free tier for new subscriptions will need to turn it on themselves. No other vendor in our matrix published a price list this year, so Defender for Cloud remains the only platform here with public per-resource pricing. More: Orca vs Microsoft Defender for Cloud.

What did the open-source projects ship?

Falco, the CNCF graduated runtime detection project that Sysdig created, released 0.43.0 in January, 0.44.0 in May and 0.45.0 on 21 September 2026. Version 0.45.0 adds raw byte matching in rule conditions and new rules that flag containers accessing GPU devices. Sysdig's runtime score rests partly on Falco, and teams that run Falco themselves should ask which version a vendor's managed rules follow.

Do these changes move our scores?

Not yet. Our September 2026 scores reflect the product pages as they stood when we reviewed them. Capabilities announced as previews, or with general availability later in the year, are not scored until the vendor documents them as available. We re-review every vendor at least once a quarter. The news page lists each announcement with a link to the original source.

Sources

Related pages