Three example teams run through the cloud security finder

Why walk through examples?

Rules on a method page are easier to trust when you can see them work. Here are three teams with different estates. Each result card below is computed by the same code the finder uses.

Team one: two people on Azure

They run virtual machines and serverless functions on Azure, have no formal compliance requirement, can install agents anywhere, and already use Microsoft security.

What drove it: virtual machines add points to workload protection; a small team adds points to CNAPP; one cloud gives posture a base. On the vendor side, Defender for Cloud gets three points for extending a product they already run and a match on price visibility, the check that applies only to small teams. Vendors whose pages name Azure also match the cloud check.

Team two: containers and code, on open-source tooling

A mid-sized team on AWS runs containers and Kubernetes, scans code in pipelines, can install agents, and already uses Falco or Trivy.

What drove it: containers and code make vulnerability management and CNAPP the picks. Aqua maintains Trivy and Sysdig created Falco, so both get the existing-product points; Aqua also matches the code scanning check fully, where Sysdig's pages describe image and workload scanning but not source code. Vendors that name AWS match the cloud check, which is why several others sit close behind.

Team three: four clouds, no agents, continuous compliance

A large team runs AWS, Azure, Google Cloud and OCI, protects virtual machines, containers, sensitive data and AI services, needs continuous compliance reporting, and will not install agents.

What drove it: continuous compliance and four clouds push posture to the top, with CNAPP and workload protection close behind. The no-agent answer gives agentless-core vendors a full match and vendors with agentless parts a partial match. Orca and Wiz both name all four clouds, scan without agents and list compliance reporting, so they share the first group. Aqua and Upwind also name all four clouds and list compliance reporting, but their depth needs an agent, so the agent check is only a partial match.

What the examples show

• Different answers produce different leaders. None of the three is fixed by the site.
• Sources matter. When we re-read vendor pages on 11 October 2026, compliance reporting for Wiz moved from Not in our sources to a match, and Wiz joined Orca in team three's first group.
• Ties are real. In the site's default example (AWS and Azure, VMs and containers, some agents), seven vendors share the first group and are listed alphabetically.