Skip to content
Find Cloud Security

Which kind of cloud security tool do you actually need?

By The Cloud Map Desk. Published , updated .

Desk research from public vendor pages. Vendor facts read September 2026, updated 2026-11-03. Profiles follow our published method; we did not run the products.

Where do your workloads run?

Pick every environment you need covered.

Question 1 of 6. Or see a worked example.

Nine vendors. One label each.

The same rows for every vendor, filled in from its own pages and marketplace listings. Alphabetical. Nothing here is a score.

Aqua Security

aquasec.com

Categories described4 of 6
CNAPPYes
CSPMYes
CWPPYes
CIEMNot found*
DSPMNot found*
Vulnerability managementYes
AgentsAgentless + agent
Clouds namedAWS, Azure, GCP, OCI, Alibaba
Code scanningYes
AI securityYes
FedRAMPHigh
Air-gappedYes
On-premisesYes
Open sourceTrivy
Public priceBy quote

* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.

CrowdStrike Falcon Cloud Security

crowdstrike.com

Categories described6 of 6
CNAPPYes
CSPMYes
CWPPYes
CIEMYes
DSPMYes
Vulnerability managementYes
AgentsAgentless + agent
Clouds namedAWS, Azure, GCP, OCI
Code scanningPartly
AI securityYes
FedRAMPHigh
Air-gappedNot stated
On-premisesNot stated
Open sourceNone named
Public priceMarketplace listing

* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.

Microsoft Defender for Cloud

azure.microsoft.com

Categories described6 of 6
CNAPPYes
CSPMYes
CWPPYes
CIEMYes
DSPMYes
Vulnerability managementYes
AgentsAgentless + agent
Clouds namedAzure, AWS, GCP
Code scanningPartly
AI securityPartly
FedRAMPHigh
Air-gappedNot stated
On-premisesYes
Open sourceNone named
Public pricePublished

* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.

Orca Security

orca.security

Categories described6 of 6
CNAPPYes
CSPMYes
CWPPYes
CIEMYes
DSPMYes
Vulnerability managementYes
AgentsAgentless core
Clouds namedAWS, Azure, GCP, OCI, Alibaba, Tencent
Code scanningYes
AI securityYes
FedRAMPModerate
Air-gappedNot stated
On-premisesYes
Open sourceNone named
Public priceMarketplace listing

* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.

Palo Alto Networks Cortex Cloud

paloaltonetworks.com

Categories described6 of 6
CNAPPYes
CSPMYes
CWPPYes
CIEMYes
DSPMYes
Vulnerability managementYes
AgentsAgentless + agent
Clouds namedAWS, Azure, GCP, OCI, Alibaba
Code scanningYes
AI securityYes
FedRAMPNot stated
Air-gappedNot stated
On-premisesNot stated
Open sourceNone named
Public priceNot published

* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.

SentinelOne Singularity Cloud

sentinelone.com

Categories described6 of 6
CNAPPYes
CSPMYes
CWPPYes
CIEMYes
DSPMYes
Vulnerability managementYes
AgentsAgentless core
Clouds namedAWS, Azure, GCP
Code scanningYes
AI securityYes
FedRAMPHigh
Air-gappedNot stated
On-premisesNot stated
Open sourceNone named
Public priceNot published

* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.

Sysdig Secure

sysdig.com

Categories described6 of 6
CNAPPYes
CSPMYes
CWPPYes
CIEMYes
DSPMYes
Vulnerability managementYes
AgentsAgentless + agent
Clouds namedAWS, Azure, GCP, OCI
Code scanningPartly
AI securityYes
FedRAMPNot stated
Air-gappedNot stated
On-premisesNot stated
Open sourceFalco
Public priceMarketplace listing

* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.

Upwind

upwind.io

Categories described6 of 6
CNAPPYes
CSPMYes
CWPPYes
CIEMYes
DSPMYes
Vulnerability managementYes
AgentsAgentless + agent
Clouds namedAWS, Azure, GCP, OCI
Code scanningYes
AI securityYes
FedRAMPIn progress
Air-gappedNot stated
On-premisesNot stated
Open sourceNone named
Public priceMarketplace listing

* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.

Wiz

wiz.io

Categories described6 of 6
CNAPPYes
CSPMYes
CWPPYes
CIEMYes
DSPMYes
Vulnerability managementYes
AgentsAgentless core
Clouds namedAWS, Azure, GCP, OCI, Alibaba
Code scanningYes
AI securityYes
FedRAMPHigh
Air-gappedNot stated
On-premisesNot stated
Open sourceNone named
Public priceMarketplace listing

* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.

Six kinds of tool. One of them holds the other five.

Start with the one your answers point to. Each name opens its guide.

CNAPP

Cloud-native application protection platform

One product that combines posture, workload, identity, data and code checks, so findings from each can be read together. Described by 9 of 9 vendors here.

CSPM

Cloud security posture management

Reads your cloud accounts through the provider's APIs and flags misconfigurations and compliance gaps.

Described by 9 of 9 vendors here

CWPP

Cloud workload protection platform

Looks inside virtual machines, containers and serverless functions for vulnerabilities, malware and attacks in progress.

Described by 9 of 9 vendors here

CIEM

Cloud infrastructure entitlement management

Maps which human and machine identities can do what, and flags permissions that are larger than the job needs.

Described by 8 of 9 vendors here

DSPM

Data security posture management

Finds where sensitive data sits across cloud storage and databases, and who or what can reach it.

Described by 8 of 9 vendors here

VM

Vulnerability management

Finds known vulnerable software across hosts, images and functions and helps decide which to fix first.

Described by 9 of 9 vendors here

No scores. The whole method is public.

We do not score or rank vendors. The finder applies published rules to your answers: first to pick a category, then to check each vendor's published facts against your constraints. Two teams with different answers will see different orders, and vendors with the same fit are shown as equals.

Read how we match

Frequently asked questions

What is the difference between CNAPP and CSPM?

CSPM checks how your cloud accounts are configured. A CNAPP combines CSPM with workload, identity, data and code checks in one product, so a misconfiguration, a vulnerable package and an over-permissioned role on the same asset show up together. If posture is your only need today, a CSPM is enough; if you need three or more categories, a CNAPP usually saves consoles.

Do I need an agent to secure cloud workloads?

Not for everything. Several vendors here scan workloads without agents by reading snapshots or cloud APIs. Detecting and stopping an attack while it runs inside a workload generally needs a sensor or agent on that workload. The finder asks how far you can go with agents and checks each vendor's stated approach.

Does this site rank cloud security vendors?

No. There are no scores, totals or winners. Vendors are listed alphabetically, or in order of fit to your quiz answers, and equal fits are shown as equals.