Lesson 7 · Buying · 2 min read
Questions to put to CNAPP vendors in writing
Cloud Security Compare editors · Matchups reviewed September 2026 · Editorial assessment
The short version
Send both shortlisted vendors the same written questions, grouped by your criteria, and compare the answers side by side. Written answers are easier to compare than demos and can be checked in a proof of concept. The questions below follow our seven criteria and the gaps that public vendor pages most often leave open.
Why ask in writing?
A demo shows what the presenter chooses to show. A written answer to a written question can be compared with the other vendor's answer, checked against documentation and tested on your accounts. It also becomes part of the record if a capability does not match what was described. Send identical questions to both vendors on the same day, with the same deadline.
What should you ask about coverage and runtime?
- Which of our clouds, accounts and resource types are covered without installing anything, and which need an agent or sensor?
- Which capabilities in your proposal are generally available today, and which are previews or roadmap items?
- What does the runtime sensor run on (Linux, Windows, Kubernetes, serverless), what does it use in CPU and memory, and can it block as well as alert?
- How are sensor updates delivered, and how is one rolled back?
What should you ask about prioritization, code and AI?
- Show how one finding from our proof of concept was ranked, and which inputs moved it up or down.
- Which source control and CI systems do you support, and can a cloud finding be traced to a repository, a file and an owner?
- Which AI services, model providers, agents and MCP servers does your inventory cover today?
- Where do findings go: which ticketing, chat and SIEM tools do you integrate with, and are those integrations included in the price?
What should you ask about ownership, data and authorizations?
- Where is our data processed and stored, and can we choose the region?
- Has ownership or product naming changed in the last two years, and what does that mean for our contract?
- Which authorizations does the product hold, such as FedRAMP or GovRAMP, and for which offering?
The ownership question matters in 2026. Google completed its acquisition of Wiz on 11 March 2026, and Palo Alto Networks moved Prisma Cloud customers onto Cortex Cloud after announcing the merger with Cortex CDR in February 2025. Authorizations are usually specific to an offering: Wiz says Wiz for Gov holds GovRAMP High authorization, and Aqua Security lists FedRAMP High authorization.
What should you ask about pricing?
Among the nine platforms we compare, only Microsoft Defender for Cloud publishes per-resource pricing, so for the others the questions carry the weight. Ask what the billable unit is (hosts, workloads, resources or accounts), how it is counted in your estate today, what happens to the price as the estate grows, which modules in the proposal are priced separately, and what the term and renewal conditions are. Put both answers on the same unit before comparing them.
Related pages
- How to run a CNAPP proof of conceptTest the answers
- Writing a CNAPP scoring sheetDecide how answers are scored
- Reading vendor claimsCapabilities, percentages and customer counts
Next lesson: Rolling out a runtime sensor: from one cluster to the estate