Cloud security for a team of one or two: what to buy first
What changes when the team is small?
Time, not budget, is usually the binding constraint. Every console, agent and integration is upkeep. A tool that finds more but needs weekly care can leave a two-person team worse off than a simpler one they keep up with.
What should come first?
- Posture across every account, because it needs no deployment.
- Agentless workload scanning, for the same reason.
- Routing: findings must reach the people who own the resources, or the small team becomes the fixer of everything.
- Sensors only on workloads where stopping an attack in progress is worth the upkeep.
Why one console?
Two people cannot watch three tools. The finder adds CNAPP points for small teams for this reason. Check that the categories you need are described on the vendor's own pages, not only implied by the platform label.
What about price?
On the pages we read, Microsoft Defender for Cloud is the only vendor here with list prices on its own site, plus a free posture tier and a 30-day trial. CrowdStrike, Orca, Sysdig, Upwind and Wiz have public prices on AWS Marketplace listings, and Aqua and Sysdig publish the unit they price by. Cortex Cloud and SentinelOne quote through sales. Marketplace figures are a starting point, not a quote: check the contract term and what one unit covers. When the team is small, ask for the price basis (per resource, per workload, per host) early.
A realistic first quarter
Connect every account. Fix the repeated misconfigurations at their source templates. Turn on routing to owners. Then decide where a sensor is worth it. That sequence is achievable for two people; buying everything at once usually is not.