Cloud security tool FAQ: categories, choosing, vendors and this site
What do the categories mean?
What is the difference between CSPM and CWPP?
CSPM reads cloud account settings through APIs; CWPP looks inside the workloads themselves. One tells you a machine is exposed, the other what is running on it.
More: CWPP guide
What does a CNAPP add over separate tools?
One inventory and one place where findings from posture, workloads, identities and data are joined, so a team can see which combinations create real risk.
More: CNAPP guide
Is CIEM the same as identity governance?
No. CIEM audits cloud infrastructure permissions, including machine identities. Workforce identity governance manages people's accounts and access reviews.
More: CIEM guide
Do I need DSPM if I already have CSPM?
If sensitive data is spread across many stores, yes. CSPM tells you a bucket is public; DSPM tells you whether it holds customer records.
More: DSPM guide
Where does vulnerability management happen in the cloud?
In three places: build pipelines (image and code scanning), the account (agentless disk scanning) and running workloads (agents that see which packages are loaded).
What is runtime protection?
Detecting and stopping attacks while a workload runs. It needs a sensor or agent on the workload.
More: Runtime protection
What is AI-SPM and which category does it belong to?
AI security posture management inventories AI services, models and agents and checks their configuration. Vendors sell it inside their CNAPP rather than as one of the five narrower categories.
More: AI-SPM
What is the shared responsibility model?
The cloud provider secures the infrastructure; you secure your configuration, identities, data and workloads. Every category on this site works on your side of that line.
More: Shared Responsibility in Practice: What Your Cloud Provider Leaves to You
How should I choose?
Which category should I start with?
Most teams start with CSPM because it needs no agents and covers every connected account. The finder adjusts that for your workloads, team and constraints.
More: Find your tool
Should a small team buy a CNAPP?
Often, because one console is easier to run than several. Check that the categories you need most are described by the vendor, not only implied by the platform label.
More: Cloud Security for a Team of One or Two: What to Buy First
Can I avoid agents entirely?
For inventory, posture and vulnerability scanning, yes, with an agentless-first vendor. Blocking attacks inside running workloads still needs a sensor.
More: Agent Tolerance: Deciding How Far to Go with Agents on Cloud Workloads
We run on Oracle Cloud or Alibaba Cloud. Which vendors name them?
On the pages we read, Orca names Oracle, Alibaba and Tencent Cloud; Aqua, Cortex Cloud and Wiz name Oracle and Alibaba Cloud; CrowdStrike, Sysdig and Upwind name OCI, Sysdig for posture only.
We already have an EDR agent. Does that cover cloud workloads?
Partly. CrowdStrike and Microsoft extend their endpoint agents to cloud servers. Posture, identity and data checks still come from the cloud side.
Which vendors publish prices?
Microsoft Defender for Cloud publishes list prices on its own site. CrowdStrike, Orca, Sysdig, Upwind and Wiz have public AWS Marketplace prices, and Aqua and Sysdig publish their pricing unit. Cortex Cloud and SentinelOne quote through sales.
What should we test in a trial?
The constraint that matters most to you: agentless coverage on your real accounts, a sensor on a busy node, or how a finding reaches its owner. The finder's check list is a good test plan.
How do compliance requirements change the choice?
Continuous compliance reporting raises posture to the top. US public-sector work narrows the list to vendors that state an authorization: in our sources Aqua, CrowdStrike, Microsoft Defender for Cloud, SentinelOne and Wiz for Government state FedRAMP High coverage, Orca states FedRAMP Moderate, and Wiz for Gov states GovRAMP High.
More: Mapping Compliance Needs to Cloud Security Tool Categories
What does each vendor say it covers?
What is Aqua Security known for?
Kernel-layer runtime enforcement that blocks attacks without killing the container, support for disconnected environments, FedRAMP High Authorization, and maintaining the open-source scanner Trivy.
More: Aqua Security profile
What happened to Prisma Cloud?
Palo Alto Networks merged Prisma Cloud with Cortex CDR to form Cortex Cloud, announced on 13 February 2025, and Prisma Cloud customers move onto it.
What does CrowdStrike Falcon Cloud Security add for Falcon customers?
Cloud posture, workload protection, CIEM, ASPM and AI-SPM using the same Falcon sensor and console already used on endpoints.
Is Microsoft Defender for Cloud free?
Its Foundational CSPM tier is free; paid plans bill per resource, with a 30-day free trial. From 27 October 2026 the free tier is opt-in for new Azure subscriptions.
Does Orca Security use agents?
Its core is agentless SideScanning. An optional eBPF-based Orca Sensor adds runtime detection and can be configured to terminate processes. Orca's own site publishes no price; an AWS Marketplace listing starts at $7,000.
More: Orca Security profile
What is SentinelOne's Offensive Security Engine?
A part of SentinelOne's agentless CNAPP that checks which exposures are exploitable and shows Verified Exploit Paths.
How does Sysdig relate to Falco?
Sysdig created Falco, now a CNCF graduated project, and builds Sysdig Secure's runtime detection on it.
More: Sysdig Secure profile
How old is Upwind?
Upwind was founded in October 2022 in San Francisco and announced a $250 million Series B on 26 January 2026.
More: Upwind profile
Is Wiz still multi-cloud after the Google acquisition?
Wiz names AWS, Azure, Google Cloud, OCI and Alibaba Cloud among its supported environments; Tencent Cloud is not named. Google completed the acquisition on 11 March 2026.
More: Wiz profile
How does this site work?
Does this site rank vendors?
No. There are no scores or winners. Vendors appear alphabetically, or in order of fit to your finder answers, with equal fits shown as equals.
More: How we match
How does the finder pick a category?
Each answer adds points to the categories it makes more relevant; the highest becomes Start here. The rule table is published.
More: How we match
What does Not in our sources mean?
We did not find the item on the vendor pages we read. It may exist. It counts zero in the finder, not against the vendor.
More: How we match
How is the order of vendors decided?
Alphabetically, or by fit when you answer the finder. Fit comes only from the published rules applied to your answers.
More: How we match
How do I correct a fact?
Use the contact page with the topic Correction and include a public source. We update the data and finder results recompute.
More: Contact