Reading CNAPP vendor claims: capabilities, percentages and customer counts

What is a capability statement?

A description of something the product does, which you can test. Orca Security says its sensor can be configured to terminate processes. Wiz says its sensor blocks threats. Write each one down as a test in your proof of concept.

How should you treat performance claims?

Upwind says it detects threats in 15 seconds and claims 93% noise reduction. Figures like these come from the vendor, measured in conditions the vendor chose. We attribute them ("Upwind says") and do not score them. To use one, ask how it was measured and on what estate, and try to reproduce it in your own test.

What do customer counts tell you?

Wiz states it is used by more than 65% of the Fortune 100. Aqua Security says more than 500 of the world's largest enterprises use it. Upwind's newsroom lists 150+ customers. These are signals of maturity and supplier risk, but they say nothing about fit for your estate. We count market footprint only inside the ecosystem criterion.

When does an announcement count?

A press release announces; documentation confirms. Several 2026 launches were previews or had general availability set for later in the year. Before counting a capability, ask for the documentation page and the plan that includes it. Our news page links every announcement to its source.

How should you read a vendor's comparison page?

Several vendors publish pages that compare themselves with named rivals. Orca Security, for example, publishes comparison pages against Wiz and Prisma Cloud. Read them as positioning: they are chosen and worded by one side. They are useful as a list of what that vendor thinks matters, and each claim on them can be turned into a test. They are not evidence of which product is stronger in your environment, and neither are our pages. Our scores are an editorial assessment of public material, and the limitations say so.

Related pages