Agent tolerance: deciding how far to go with agents on cloud workloads
What does each approach see?
- Agentless: reads cloud APIs and copies of workload disks. It finds vulnerable packages, secrets, malware and misconfigurations on every workload it can reach, quickly, without touching the workload. It sees a recent moment, not live activity.
- Sensor or agent: runs on the workload or node. It sees processes, network connections and file changes as they happen, can tell which vulnerable packages are actually loaded, and can block or stop activity.
Where do the nine vendors start?
On the pages we read, three describe an agentless core with an optional sensor: Orca (SideScanning plus the optional Orca Sensor), SentinelOne (an agentless CNAPP plus Cloud Workload Security) and Wiz (API-connected scanning plus the Wiz Sensor). Other vendors offer agentless parts with depth from an agent: Aqua, Cortex Cloud, CrowdStrike, Defender for Cloud, Sysdig and Upwind. Cortex Cloud documents agentless VM image scanning; runtime protection uses its agent.
What does an agent cost you?
Not only licence fees. Someone must deploy it to every new node, keep it updated, check its resource use on busy machines, and handle the change requests that come with installing software on production. On Kubernetes this is usually one deployment per cluster; on large fleets of virtual machines it is more work.
How do you decide?
- List workloads where an agent is impossible: serverless functions and managed services. These need agentless coverage whatever you choose.
- List workloads where blocking matters: internet-facing services, systems holding sensitive data. These justify a sensor.
- Everything else is a judgement on effort versus depth.
Answer the finder's agent question with the strictest rule you will actually enforce. A no-agent answer gives agentless-core vendors a full match and agent-led ones a mismatch; a some-agents answer treats vendors with an agentless core or agentless parts as a match.
A practical pattern
Start agentless across everything, then add a sensor where blocking matters. Several vendors are built for exactly that path. If you already run an EDR agent on servers, check whether its vendor extends it to cloud workloads before adding a second agent.