Cloud vulnerability management: finding and ranking vulnerable software
What does a VM tool do?
Each finding refers to a published vulnerability, usually by its CVE identifier. The tool matches the packages it finds against vulnerability databases and reports where each vulnerable package is.
Cloud tools find packages in three ways: scanning container images and code before deployment, reading workload disks or snapshots without an agent, and observing running workloads with a sensor, which can also tell whether the vulnerable package is actually loaded.
Ranking uses severity plus context: is the workload internet-facing, does it hold sensitive data, is the vulnerability being exploited in the wild, is the package in use. Public signals such as EPSS estimate the chance a vulnerability will be exploited.
When do you need VM?
- You run more workloads than a team can patch by hand.
- Auditors or customers ask for evidence of patch coverage.
- Container images are built often and deployed from many pipelines.
- Your current scanner lists findings without telling you which matter.
When is VM not enough?
Finding vulnerable software is the start. Fixing it means rebuilding images, patching hosts and changing code, which happens in your pipelines and with your teams. A list without context or ownership is where most programs stall, so ask how a finding reaches the person who can fix it.
Which finder answers point to VM?
- +2 if you protect virtual machines
- +2 if you protect containers and Kubernetes
- +1 if you protect source code and build pipelines
Which vendors describe VM?
9 of 9 vendors describe VM on the pages we read, and 0 are not in our sources.
| Vendor | Status | What their pages say | Source |
|---|---|---|---|
| Aqua Security | Described | Ranks vulnerabilities by reachability, EPSS scores and evidence of active exploitation. | Source: Aqua cloud native security platform, read . |
| CrowdStrike Falcon Cloud Security | Described | AI-driven vulnerability management is named. | Source: CrowdStrike Falcon Cloud Security (re-read), read . |
| Microsoft Defender for Cloud | Described | Agentless VM vulnerability scanning is in the paid Defender CSPM plan and Defender for Servers Plan 2. | Source: Microsoft Learn: Defender for Cloud CSPM plans, read . |
| Orca Security | Described | Vulnerability management is listed as a module, with risk prioritization and attack path analysis. | Source: Orca Security platform overview, read . |
| Palo Alto Networks Cortex Cloud | Described | Vulnerability management is listed under cloud posture security, with SmartScore ranking. | Source: Cortex Cloud posture security, read . |
| SentinelOne Singularity Cloud | Described | The Offensive Security Engine checks which exposures are exploitable and shows Verified Exploit Paths; a vulnerability management module is not named on the pages we read. | Source: SentinelOne Cloud Native Security, read . |
| Sysdig Secure | Described | Agentless vulnerability host scanning and agent-based scanning, with in-use prioritization. | Source: Sysdig pricing (re-read), read . |
| Upwind | Described | Vulnerability management and attack path analysis are listed. | Source: Upwind homepage, read . |
| Wiz | Described | Named Unified Vulnerability Management solution, described as agentless cloud vulnerability management. | Source: Wiz Unified Vulnerability Management, read . |
Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.
What should you ask a VM vendor?
- Where does the tool find vulnerabilities: pipeline, account scan, running workload, or all three?
- How does it rank findings, and can it show which vulnerable packages actually run?
- Does it use exploitation signals such as EPSS or known-exploited lists?
- Can it route a finding to the code owner or open a pull request?
Frequently asked questions
What is a CVE?
A CVE identifier names a single publicly disclosed vulnerability, in the form CVE, year, number. Almost every vulnerability finding refers to one.
What is EPSS?
The Exploit Prediction Scoring System, run by FIRST, estimates the probability that a published vulnerability will be exploited in the next 30 days. Aqua says it uses EPSS scores in ranking.
Is agentless vulnerability scanning as good as an agent?
They answer different questions. Agentless scanning finds vulnerable packages on disk across the whole estate with nothing installed; an agent can also tell which of them are loaded and running.