How we match cloud security tools to your answers
What do we record for each vendor?
For each of the six categories we record one of two statuses with a note and a source: Described (the vendor's pages we read describe it; the note says when it sits in a paid tier or add-on) and Not in our sources (we did not find it). We also record the clouds the vendor names, its agent approach, runtime sensor, code and AI security, on-premises and disconnected support, compliance authorizations it states, its existing-product ecosystem and whether it publishes a price.
- Described on the vendor's pages we read
- Not in our sources (it may exist; we did not find it on the pages we read)
How does the finder pick a category?
| Category | Points from your answers |
|---|---|
| CNAPP | +2 if you protect source code and build pipelines +1 if you protect AI services, models or agents +2 if your team is one or two people +1 if your team is three to ten people Bundling bonus: count how many of CSPM, CWPP, CIEM, DSPM and vulnerability management have 3 or more points. If 3 or more do, +4; if exactly 2 do, +2. |
| CSPM | +2 if you pick at least one public cloud +2 if you pick two or more public clouds +3 if you need continuous compliance reporting +1 if you need US public-sector authorization +1 if you protect serverless functions +1 if you protect AI services, models or agents |
| CWPP | +3 if you protect virtual machines +2 if you protect containers and Kubernetes +1 if you protect serverless functions +1 if you run private cloud or on-premises servers +1 if you run disconnected (air-gapped) environments |
| CIEM | +2 if you pick two or more public clouds +1 if your team is more than ten people with a security operations team +1 if you protect serverless functions |
| DSPM | +4 if you protect sensitive data in cloud storage and databases +1 if you protect AI services, models or agents |
| Vulnerability management | +2 if you protect virtual machines +2 if you protect containers and Kubernetes +1 if you protect source code and build pipelines |
- Categories are ordered by points, highest first. Ties keep the fixed order: CNAPP, CSPM, CWPP, CIEM, DSPM, vulnerability management.
- The first category is Start here.
- Up to two more are Also relevant if their points are at least 3, or at least half the first category's points, whichever is higher.
- Categories with 0 points are Not suggested by your answers.
How does the finder check vendors?
For each picked category, a vendor gets +2 if it is Described and 0 if it is Not in our sources. Then the checks below apply when your answers trigger them.
| Check | When it applies | Matches (+2) | Partly (+1) | Not in our sources (0) | Against your answer (-2) |
|---|---|---|---|---|---|
| Clouds you named | You pick at least one public cloud | The vendor names every public cloud you picked | It names some of them | Its pages do not list clouds by name | It names none of them |
| Private cloud or on-premises | You pick private cloud or on-premises servers | The vendor states support | Not used | Not stated on the pages we read | Not used |
| Disconnected environments | You pick disconnected (air-gapped) environments | The vendor states support | Not used | Not stated on the pages we read | Not used |
| Agent tolerance | Always | No agents: agentless core. On some workloads: agentless core or agentless parts. Wherever needed: any approach | No agents: agentless parts with an agent for depth. On some workloads: leads with an agent | Not used | No agents: leads with an agent |
| Continuous compliance | You need continuous compliance reporting | The vendor describes it | Not used | Not described on the pages we read | Not used |
| Public-sector authorization | You need US public-sector authorization | The vendor states a FedRAMP or GovRAMP authorization | Authorization pursued, not stated as achieved | Not stated on the pages we read | Not used |
| Builds on what you run | You already run a product and the vendor builds on it | +3, shown as Extends a product you already run | Not used | Not used | Not used |
| Price you can check without a sales call | Your team is one or two people | List prices on the vendor's own site | A public marketplace price or a published pricing unit | Neither | Not used |
| AI workloads | You protect AI services, models or agents | AI security is described | Only in a paid plan or in part | Not described on the pages we read | Not used |
| Code scanning | You protect source code and build pipelines | Code scanning is described | Only in a paid plan or in part | Not used | Not used |
| Kubernetes runtime | You protect containers and Kubernetes | Kubernetes runtime protection is described | Only in a paid plan or in part | Not used | Not used |
Vendors with the same total are shown as equals and listed alphabetically. We never show the total as a score.
What does Not in our sources mean, and is it fair?
It means we did not find the item on the pages we read. It counts zero, not against the vendor. It does affect order: a vendor whose pages name its clouds can match a cloud check, and one whose pages do not cannot. Where this cuts against a vendor we know offers more than its pages say, the fix is a source, not a guess: send it through the contact page and we will add it.
Which vendors are covered, and why these nine?
Nine vendors that sell cloud security platforms covering several of the six categories: Aqua Security, CrowdStrike Falcon Cloud Security, Microsoft Defender for Cloud, Orca Security, Palo Alto Networks Cortex Cloud (formerly Prisma Cloud), SentinelOne Singularity Cloud, Sysdig Secure, Upwind and Wiz. Single-category specialists are not covered yet.
Where do the facts come from?
- Vendor product pages, documentation, pricing pages and press releases, all read in September 2026 and updated on 2026-11-03. Each fact on the site carries its source link and read date.
- Vendor figures such as detection times or customer counts are quoted as the vendor's statement and are never our finding.
- Where a vendor does not publish a price, we write Not published.
- Glossary and lesson links to public standards (CVE, EPSS, SBOM, NIST SP 800-53, Kubernetes, Model Context Protocol) are references for definitions, not vendor facts.
What are the limitations?
Public sources only. No hands-on testing, no demos, no vendor interviews. A vendor's pages describe what it sells, not how well it works in your environment. Our notes on nine vendors are thinner in places than the vendors' full documentation, which is why the Not in our sources status exists. Use the finder to decide what to ask and what to test, not as a test result.
How do we handle corrections?
Send a correction through the contact page with the topic Correction and a public source. We check it against the vendor's page and update the data; finder results recompute automatically.