Lesson 4 · Buying · 2 min read

From nine vendors to two: building a CNAPP shortlist

Cloud Security Compare editors · Matchups reviewed September 2026 · Editorial assessment

The short version

Three filters get a long list down to two names: the clouds you run, the security stack you already own, and the one criterion you will not compromise on. Once you have two, a head-to-head comparison does the rest.

Which clouds do you run?

List every cloud you run, including the small ones. Coverage differs. Orca Security names six clouds, including Oracle Cloud, Alibaba Cloud and Tencent Cloud. Wiz names AWS, Azure, Google Cloud and OCI. Microsoft Defender for Cloud covers Azure, AWS and GCP. A vendor that does not cover a cloud you run comes off the list unless you accept a second tool.

What do you already own?

If you run CrowdStrike Falcon on endpoints, Falcon Cloud Security uses the same sensor and console. If you are a Palo Alto Networks customer, Cortex Cloud sits in the same portfolio. If you are Azure-first, Defender for Cloud is native and has a free posture tier. Each of these is a real advantage and a reason to put that vendor on the shortlist, but not by itself a reason to choose it.

Which criterion will you not compromise on?

Pick one criterion and take the two leaders. On our matrix, Orca leads agentless coverage (4.9); CrowdStrike and Sysdig tie on runtime protection (4.8); Wiz leads risk prioritization, code-to-cloud and ecosystem; Wiz and Orca tie on AI workload security; and Defender for Cloud leads pricing transparency.

How do you check the shortlist is fair?

Before you invite two vendors, read their head-to-head and check that each one wins at least one criterion you care about. If one vendor wins every criterion you weight highly, you have a preference and a benchmark rather than a shortlist. That can be the right call, but say so internally. If the two are close, as Wiz and Orca Security are (4.4 against 4.2) or Cortex Cloud and Microsoft Defender for Cloud are (both 4.0), the proof of concept is where the decision will be made. The score calculator shows how much your own weights move the order before you commit to two names.

Write down, in one sentence, why each vendor is on the list.
Record which vendors you removed and the filter that removed them.
Check that both vendors cover every cloud you run before either one connects.

What next?

With two names, read the head-to-head, for example Wiz vs Orca, Orca vs Microsoft Defender for Cloud or Wiz vs CrowdStrike. Every pairing of the nine platforms has its own page, listed on the home page, and the compare page puts up to five side by side.

Comparison matrixLeaders by criterion
How to run a CNAPP proof of conceptWhat to do once you have two names
Wiz alternativesIf Wiz is already on your list

Next lesson: Reading CNAPP vendor claims: capabilities, percentages and customer counts