CNAPP comparison matrix: nine cloud security platforms scored
Cloud Security Compare editors · Matchups reviewed September 2026 · Editorial assessment
The short version
Wiz tops the matrix at 4.4, followed by Orca Security at 4.2, then Cortex Cloud and Microsoft Defender for Cloud tied at 4.0. No vendor leads every criterion: Orca leads agentless coverage, CrowdStrike and Sysdig lead runtime, Wiz leads attack paths, code and ecosystem, and Defender for Cloud leads pricing transparency.
How does every platform score on every criterion?
What this score is not
Who beats whom, criterion by criterion?
Each cell counts how many of the seven criteria the row vendor scores higher on than the column vendor, then the reverse. Ties are left out, so the two numbers can add up to less than seven.
| Vendor | Wiz | Orca | Cortex Cloud | Defender | Upwind | CrowdStrike | SentinelOne | Sysdig | Aqua |
|---|---|---|---|---|---|---|---|---|---|
| Wiz | · | 4 · 1 | 5 · 1 | 6 · 1 | 5 · 1 | 5 · 1 | 5 · 1 | 5 · 2 | 5 · 1 |
| Orca | 1 · 4 | · | 3 · 3 | 4 · 3 | 5 · 1 | 4 · 2 | 4 · 2 | 5 · 2 | 5 · 1 |
| Cortex Cloud | 1 · 5 | 3 · 3 | · | 6 · 1 | 2 · 4 | 4 · 2 | 5 · 1 | 5 · 2 | 6 · 0 |
| Defender | 1 · 6 | 3 · 4 | 1 · 6 | · | 2 · 4 | 4 · 3 | 4 · 3 | 5 · 2 | 4 · 2 |
| Upwind | 1 · 5 | 1 · 5 | 4 · 2 | 4 · 2 | · | 4 · 2 | 5 · 1 | 4 · 3 | 4 · 2 |
| CrowdStrike | 1 · 5 | 2 · 4 | 2 · 4 | 3 · 4 | 2 · 4 | · | 2 · 3 | 5 · 1 | 5 · 1 |
| SentinelOne | 1 · 5 | 2 · 4 | 1 · 5 | 3 · 4 | 1 · 5 | 3 · 2 | · | 5 · 2 | 4 · 1 |
| Sysdig | 2 · 5 | 2 · 5 | 2 · 5 | 2 · 5 | 3 · 4 | 1 · 5 | 2 · 5 | · | 5 · 2 |
| Aqua | 1 · 5 | 1 · 5 | 0 · 6 | 2 · 4 | 2 · 4 | 1 · 5 | 1 · 4 | 2 · 5 | · |
Wiz wins the majority of criteria against every other platform. The only even pairing in the grid is Orca against Cortex Cloud, three criteria each.
How are the nine platforms deployed and priced?
| Vendor | Deployment | Runtime sensor | Clouds named | Open-source project | Public pricing |
|---|---|---|---|---|---|
| Wiz | Agentless, connects by cloud API; optional Wiz Sensor for runtime | Wiz Sensor, eBPF-based, blocks threats in real time on VMs, containers and serverless containers (Wiz Defend) | AWS, Azure, Google Cloud, OCI | None named | Not published. Contact sales. Source: Wiz platform · Reviewed Sep 2026 |
| Orca Security | Agentless SideScanning of workload block storage; optional Orca Sensor for runtime | Orca Sensor, eBPF-based, Linux, Kubernetes and Windows; can be configured to terminate processes | AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, Tencent Cloud | None named | Not published. Contact sales. Source: Orca platform · Reviewed Sep 2026 |
| Palo Alto Networks Cortex Cloud (formerly Prisma Cloud) | Cloud API posture modules plus a performance-optimized runtime agent | Cortex Cloud Runtime Security agent; CDR from the Cortex CDR merger | Multi-cloud (the pages we reviewed do not list clouds by name) | None named | Not published. CNAPP included at no additional cost for Cortex Cloud Runtime Security customers. Source: Cortex Cloud launch press release · Reviewed Sep 2026 |
| Microsoft Defender for Cloud | Free Foundational CSPM; agentless scanning in paid Defender CSPM and Defender for Servers Plan 2; agent-based EDR through Defender for Endpoint | Microsoft Defender for Endpoint (Defender for Servers Plan 1 and Plan 2) | Azure, AWS, Google Cloud, on-premises via Azure Arc | None named | Published per resource on the Azure pricing page and cost calculator; Foundational CSPM free; 30-day free trial Source: Defender CSPM plans · Reviewed Sep 2026 |
| Upwind | Agentless scanning combined with eBPF runtime sensors | eBPF sensor; CDR with cloud activity baselines and forensic timelines | AWS, Google Cloud, Azure, OCI (named as partners) | None named | Not published. Contact sales. Source: Upwind home · Reviewed Sep 2026 |
| CrowdStrike Falcon Cloud Security | Agentless CSPM; workload protection through agentless scanning and the Falcon sensor | CrowdStrike Falcon sensor (the same agent used for endpoints) | Multi-cloud (the pages we reviewed do not list clouds by name) | None named | Not published for cloud security; the pricing page lists endpoint bundles only Source: Falcon Cloud Security · Reviewed Sep 2026 |
| SentinelOne Singularity Cloud | Agentless CNAPP (Cloud Native Security) plus Cloud Workload Security for runtime | Cloud Workload Security for containers, VMs and AI workloads | Multi-cloud (the pages we reviewed do not list clouds by name) | None named | Not published. Contact sales. Source: Singularity Cloud · Reviewed Sep 2026 |
| Sysdig Secure | Agentless posture plus an agent for runtime and in-use analysis | Sysdig agent with Falco-based detection | Multi-cloud (the pages we reviewed do not list clouds by name) | Falco (created by Sysdig, CNCF graduated project) | Not published. Licensed by number of hosts; request a quote. Source: Sysdig Secure · Reviewed Sep 2026 |
| Aqua Security | Agentless posture plus kernel-layer runtime enforcement; public cloud, private cloud and disconnected environments | Kernel-layer enforcement that blocks attacks without killing the container | Public cloud, private cloud and disconnected (air-gapped) environments | Trivy (maintained by Aqua Security, Apache-2.0) | Not published. Contact sales. Source: Aqua platform · Reviewed Sep 2026 |
Microsoft states that from 27 October 2026 Foundational CSPM becomes opt-in for new Azure subscriptions.
Which criteria carry the most weight?
| Criterion | Weight | What we look for |
|---|---|---|
| Agentless coverage and time to value | 18% | How much of the estate (VMs, containers, serverless, PaaS, AI services) is visible without installing anything, across how many clouds, and how fast. |
| Runtime protection depth | 16% | Detection and prevention inside running workloads: sensor technology, blocking, investigation, response. |
| Risk prioritization and attack paths | 18% | How findings are correlated into exploitable paths and ranked, so teams fix the few things that matter. |
| Code-to-cloud and AppSec | 14% | SCA, SAST, IaC, secrets and image scanning, and tracing a cloud risk back to the code and owner that caused it. |
| AI workload security | 12% | Inventory and posture for models, AI services, pipelines, agents and MCP servers, plus runtime detection for AI-specific threats. |
| Ecosystem and integrations | 12% | Integrations, partner and marketplace reach, platform breadth around the CNAPP, and market footprint. |
| Pricing transparency | 10% | Whether a buyer can model cost from public material before talking to sales. |
Weights sum to 100. Totals are the weighted average, computed from the scores above.
Where does each vendor lead or trail?
- Wiz: leads Risk prioritization and attack paths, Code-to-cloud and AppSec, Ecosystem and integrations, co-leads AI workload security; lowest score on Pricing transparency (1.5).
- Orca Security: leads Agentless coverage and time to value, co-leads AI workload security; lowest score on Pricing transparency (1.5).
- Palo Alto Networks Cortex Cloud (formerly Prisma Cloud): leads no criterion; lowest score on Pricing transparency (1.5).
- Microsoft Defender for Cloud: leads Pricing transparency; lowest score on Agentless coverage and time to value (3.7).
- Upwind: leads no criterion; lowest score on Pricing transparency (1.5).
- CrowdStrike Falcon Cloud Security: co-leads Runtime protection depth; lowest score on Pricing transparency (1.5).
- SentinelOne Singularity Cloud: leads no criterion; lowest score on Pricing transparency (1.5).
- Sysdig Secure: co-leads Runtime protection depth; lowest score on Pricing transparency (2.0).
- Aqua Security: leads no criterion; lowest score on Pricing transparency (1.5).
Editorial assessment, 0 to 5. Weighted across seven criteria. How to read these scores: /reading-these-comparisons
Frequently asked questions
How are the matrix totals calculated?
Each criterion is scored 0 to 5 with a written reason. The total is the weighted average using the published weights: agentless coverage 18%, runtime 16%, risk prioritization 18%, code-to-cloud 14%, AI workload security 12%, ecosystem 12%, pricing transparency 10%.
Why do Cortex Cloud and Defender for Cloud share third place?
Their exact totals are 4.036 and 3.996. Both round to 4.0, and we show equal displayed scores as ties rather than implying a precision the method does not have.
Why does every vendor score low on pricing transparency?
Seven of the nine publish no prices at all. A score of 1.5 means "quote only". Sysdig scores 2.0 because it publishes its licensing unit, and Defender for Cloud scores 4.6 because its per-resource pricing and calculator are public.
Can I re-weight the matrix?
Yes, on the score calculator. Set a weight from 0 to 10 for each criterion and the nine platforms re-rank from the same criterion scores shown on this page.