CNAPP FAQ: questions about cloud security platforms and our scores

A cloud-native application protection platform: one product that combines posture (CSPM), workload protection (CWPP), identity (CIEM), data (DSPM), code and, increasingly, AI security for cloud estates. All nine platforms on this site are sold as CNAPPs, but each started from a different module, which is why their scores differ by criterion. More: Glossary: CNAPP

Agentless scanning reads cloud APIs and workload storage from outside, so it covers the whole estate quickly with nothing installed. Agents, now usually eBPF sensors, run inside workloads and can detect and block attacks as they happen. Every platform we compare offers both; they differ in which one they started from. More: Agentless vs agent-based

For many teams it is the first step, not the whole job. CSPM checks cloud account settings against good practice and compliance frameworks, but it does not look inside workloads, trace problems back to code or detect attacks at runtime. CNAPPs add those modules. More: Which CNAPP modules to compare first

A chain of weaknesses, such as an exposed workload, a vulnerable package and an over-permitted identity, that together let an attacker reach something valuable. Showing the path lets a team fix the one link that breaks it. More: How CNAPPs rank risk

AI security posture management: an inventory of the models, AI services, agents and MCP servers an organization runs, with checks on how they are configured and what they can reach. It is most of what our AI workload security criterion measures. More: AI workload security in CNAPPs

Linking a problem found in a running cloud resource back to the repository, file and owner that produced it, so the fix is made in code and stays fixed. More: Code security in a CNAPP

Of the nine we compare, only Microsoft Defender for Cloud publishes per-resource pricing, with a public cost calculator, a free Foundational CSPM tier and a 30-day free trial. Sysdig publishes its licensing unit (hosts) but not prices. The other seven quote through sales. More: Score calculator

Because the vendors do not publish them. We write "Not published" rather than estimate, and we do not reproduce Microsoft's per-resource rates, which are on its own pricing page and calculator. More: How to read these comparisons

Put both on the same billable unit (hosts, workloads, resources or accounts), the same term and the same estate size, and ask each vendor in writing what happens to the price as the estate grows. More: Questions to put to CNAPP vendors

Filter by the clouds you run, then by the security stack you already own, then take the two leaders on the one criterion you will not compromise on. More: Building a CNAPP shortlist

Fix the scope, criteria and weights before either vendor connects, run both on the same accounts at the same time, and score what you saw on your own estate rather than what the demo showed. More: How to run a CNAPP proof of concept

Yes. The score calculator re-ranks all nine platforms from our criterion scores using weights you set from 0 to 10, and the address of the page stores your weights so you can share them. More: Score calculator

Wiz, at 4.4 out of 5 in our editorial assessment, followed by Orca Security at 4.2. Cortex Cloud and Microsoft Defender for Cloud tie for third at 4.0. More: Comparison matrix

Wiz scores higher overall (4.4 against 4.2) and wins four criteria: runtime, risk prioritization, code-to-cloud and ecosystem. Orca wins agentless coverage and time to value, and the two tie on AI workload security and pricing transparency. More: Wiz vs Orca

On pricing transparency (1.5), like six of the other vendors, and on runtime protection depth (3.8), where all eight other platforms score higher. Five vendors also score higher than Orca on ecosystem. More: Orca Security alternatives

Yes. Google announced a definitive agreement to acquire Wiz for $32 billion on 18 March 2025, and the acquisition completed on 11 March 2026. Wiz states it remains a multicloud platform covering AWS, Azure, Google Cloud and OCI. More: Wiz alternatives

Palo Alto Networks merged Prisma Cloud with Cortex CDR to form Cortex Cloud, announced on 13 February 2025, and moved Prisma Cloud customers onto Cortex Cloud. We score it as Cortex Cloud and keep "Prisma Cloud" in page names because buyers still search for it. More: Prisma Cloud alternatives

CrowdStrike Falcon Cloud Security and Sysdig Secure tie at 4.8, with Upwind at 4.7. More: CrowdStrike vs Sysdig

Orca Security scores highest (4.9), just ahead of Wiz (4.8). Aqua Security scores lowest (3.4). More: Agentless vs agent-based

Its Foundational CSPM tier is free. Defender CSPM and the workload plans are paid and billed per resource, with a 30-day free trial. Microsoft states that from 27 October 2026 Foundational CSPM becomes opt-in for new Azure subscriptions. More: Microsoft Defender for Cloud alternatives

Both show 3.7. Sysdig leads on runtime detection built on Falco; Aqua leads on code security and AI workload security, with pipeline gating and the Trivy scanner it maintains. More: Sysdig vs Aqua

Each vendor gets a 0 to 5 score on seven criteria, each with a one-line reason. The total is the weighted average using published weights: agentless coverage 18%, runtime 16%, risk prioritization 18%, code-to-cloud 14%, AI workload security 12%, ecosystem 12% and pricing transparency 10%. More: How to read these comparisons

No. They are an editorial assessment of public vendor material: product pages, documentation, pricing pages and press releases, reviewed in September 2026. We did not run the products, attend demos or interview vendors. More: Limitations

When two totals round to the same one-decimal value we show a tie, for example 3= for both, rather than implying a precision the method does not have. More: Comparison matrix

At least once a quarter. Every page is dated, and the current scores were last reviewed in September 2026. More: How to read these comparisons

Email editors@cloudsecuritycompare.com with the page, the claim and a public source. We check corrections within five business days. More: Contact