Skip to content
Find Cloud Security

Cloud security tool finder: which category fits your estate?

01Where do your workloads run?Pick every environment you need covered.
02What do you need to protect?Pick everything that applies.
03How many people work on cloud security?Count people, not tools.
04Which compliance need is firm?Pick the strictest one that applies.
05Can you install agents on workloads?An agent is software that runs inside each machine or cluster.
06Which security product do you already run?Pick the one you would most like to build on.

Your answers point to Cloud-native application protection platform

Start here

CNAPP

One product that combines posture, workload, identity, data and code checks, so findings from each can be read together.

Also relevant

  • CWPP
  • CSPM

Not suggested by your answers

  • DSPM
Points per category from your answers, in the fixed category order.
CategoryPointsFrom your answers
CNAPP5 pts
+1 a team of three to ten
+4 bundling bonus: 3 other categories at 3 points or more
CSPM4 pts
+2 at least one public cloud
+2 two or more public clouds
CWPP5 pts
+3 virtual machines
+2 containers and Kubernetes
CIEM2 pts
+2 two or more public clouds
DSPM0 ptsNo rule applied
Vulnerability management4 pts
+2 virtual machines
+2 containers and Kubernetes

Vendors whose published facts match

Ordered by how many of your checks each vendor's own pages satisfy. Equal fits are listed alphabetically. This is a fit to your answers, not a quality ranking.

  1. Equal fit 7 vendors

    Aqua SecurityShow checksMatches 3 checks fully, 0 partly, 0 not in our sourcesDescribes 3 of 3 picked categories
    Read the Aqua profile
    • CNAPPDescribed

      Positions one platform across posture, pipeline scanning and runtime enforcement.

      Source: Aqua cloud native security platform, read .

    • CWPPDescribed

      Monitor, detect, enforce and contain inside running workloads, with kernel-layer enforcement.

      Source: Aqua cloud native security platform, read .

    • CSPMDescribed

      CSPM is listed among the capabilities on its pricing page, alongside CWPP, agentless and agent-based scanning and eBPF runtime detection.

      Source: Aqua pricing, read .

    • Clouds you namedMatches

      Aqua names AWS, Azure, GCP, Oracle and Alibaba Cloud environments, plus Kubernetes; its platform page also describes private cloud and disconnected environments.

      Source: Aqua pricing, read .

    • Agent toleranceMatches

      Offers agentless posture visibility; the platform's depth comes from kernel-layer enforcement on the workload.

      Source: Aqua cloud native security platform, read .

    • Kubernetes runtimeMatches

      Runtime enforcement for containers that blocks attacks without killing the container.

      Source: Aqua cloud native security platform, read .

    CrowdStrike Falcon Cloud SecurityShow checksMatches 3 checks fully, 0 partly, 0 not in our sourcesDescribes 3 of 3 picked categories
    Read the CrowdStrike profile
    Orca SecurityShow checksMatches 3 checks fully, 0 partly, 0 not in our sourcesDescribes 3 of 3 picked categories
    Read the Orca profile
    • CNAPPDescribed

      CNAPP is listed as a module on the platform page, built on one Unified Data Model.

      Source: Orca Security platform overview, read .

    • CWPPDescribed

      Workloads are covered by SideScanning (VMs, containers, serverless) and, for runtime, the optional Orca Sensor.

      Source: Orca agentless SideScanning, read .

    • CSPMDescribed

      CSPM and multi-cloud compliance are listed as modules.

      Source: Orca Security platform overview, read .

    • Clouds you namedMatches

      AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud and Tencent Cloud.

      Source: Orca Security platform overview, read .

    • Agent toleranceMatches

      SideScanning reads workloads' runtime block storage and reconstructs the file system in a read-only view, covering Linux and Windows VMs, containers and images, and serverless, without agents.

      Source: Orca agentless SideScanning, read .

    • Kubernetes runtimeMatches

      Container and Kubernetes security is listed as a module; the Orca Sensor runs on Kubernetes.

      Source: Orca runtime sensor, read .

    SentinelOne Singularity CloudShow checksMatches 3 checks fully, 0 partly, 0 not in our sourcesDescribes 3 of 3 picked categories
    Read the SentinelOne profile
    Sysdig SecureShow checksMatches 3 checks fully, 0 partly, 0 not in our sourcesDescribes 3 of 3 picked categories
    Read the Sysdig profile
    • CNAPPDescribed

      Sysdig describes Sysdig Secure as a CNAPP.

      Source: Sysdig press release: Sysdig Secure AI, read .

    • CWPPDescribed

      Runtime threat detection for containers and Kubernetes through the agent.

      Source: Sysdig Secure, read .

    • CSPMDescribed

      CSPM is listed.

      Source: Sysdig Secure, read .

    • Clouds you namedMatches

      AWS, GCP and Azure support all of Sysdig's agentless cloud features; Oracle Cloud supports agentless CSPM only.

      Source: Sysdig docs: connect cloud accounts, read .

    • Agent toleranceMatches

      Agentless posture covers vulnerabilities, misconfigurations, permissions and threats; process-level analysis needs the agent.

      Source: Sysdig Secure, read .

    • Kubernetes runtimeMatches

      Runtime detection for containers and Kubernetes built on Falco.

      Source: Sysdig Secure, read .

    UpwindShow checksMatches 3 checks fully, 0 partly, 0 not in our sourcesDescribes 3 of 3 picked categories
    Read the Upwind profile
    • CNAPPDescribed

      Lists posture, identity, data, workload, code, API and detection modules on one platform.

      Source: Upwind homepage, read .

    • CWPPDescribed

      Container and Kubernetes, serverless, and CDR modules, with eBPF sensors.

      Source: Upwind homepage, read .

    • CSPMDescribed

      CSPM is listed.

      Source: Upwind homepage, read .

    • Clouds you namedMatches

      AWS, Google Cloud, Azure and OCI are named as partnerships.

      Source: Upwind homepage, read .

    • Agent toleranceMatches

      Agentless scanning plus eBPF runtime sensors; the design centers on the runtime sensor.

      Source: Upwind homepage, read .

    • Kubernetes runtimeMatches

      Container and Kubernetes security is listed, with eBPF sensors.

      Source: Upwind homepage, read .

    WizShow checksMatches 3 checks fully, 0 partly, 0 not in our sourcesDescribes 3 of 3 picked categories
    Read the Wiz profile
    • CNAPPDescribed

      Wiz Cloud, Wiz Code and Wiz Defend on one Security Graph.

      Source: Wiz platform overview, read .

    • CWPPDescribed

      Agentless workload scanning plus the Wiz Sensor for runtime blocking, Kubernetes file integrity monitoring and drift detection.

      Source: Wiz Defend and Wiz Sensor, read .

    • CSPMDescribed

      Agentless, API-connected scanning of cloud resources, including Alibaba Cloud, as the vendor states.

      Source: Wiz extends CNAPP leadership with protection for Alibaba Cloud, read .

    • Clouds you namedMatches

      Wiz names AWS, Azure, Google Cloud, OCI and Alibaba Cloud among its supported environments; Tencent Cloud is not named.

      Source: Wiz environments: Alibaba Cloud, read .

    • Agent toleranceMatches

      Connects by cloud API and, Wiz states, reaches VMs, containers, serverless, PaaS and AI resources without agents.

      Source: Wiz platform overview, read .

    • Kubernetes runtimeMatches

      Kubernetes file integrity monitoring and drift detection in Wiz Defend.

      Source: Wiz Defend and Wiz Sensor, read .

  2. Equal fit 2 vendors

    Microsoft Defender for CloudShow checksMatches 2 checks fully, 1 partly, 0 not in our sourcesDescribes 3 of 3 picked categories
    Read the Defender for Cloud profile
    Palo Alto Networks Cortex CloudShow checksMatches 2 checks fully, 1 partly, 0 not in our sourcesDescribes 3 of 3 picked categories
    Read the Cortex Cloud profile

How does the finder decide?

Two steps. First, each answer adds points to the categories it makes more relevant; the highest becomes your starting category. Second, each vendor gets points for describing your picked categories and for matching your constraints. The full rule table is on How we match. A vendor marked Not in our sources may still offer something; we did not find it on the pages we read, so ask the vendor.

Frequently asked questions

Why does the finder say CNAPP when I picked several workloads?

Because several categories scored three points or more, and the rules add a bundling bonus to CNAPP when that happens. Three separate tools for posture, workloads and vulnerabilities usually means three consoles; a CNAPP puts them in one.

Why are some vendors shown as an equal fit?

Their published facts satisfy your checks to the same degree. We list equal fits alphabetically rather than invent a tiebreak.

What does Not in our sources mean?

We did not find that capability or fact on the vendor pages we read in September 2026 and updated on 3 November 2026. It may exist; it scores zero in the finder, not a penalty, and the profile says so.

Does the finder store my answers?

No. Answers live in the page's address bar so you can share a result. Nothing is sent anywhere.