# Find Cloud Security

> A finder for cloud security tools: answer six questions to see which category you need (CNAPP, CSPM, CWPP, CIEM, DSPM, vulnerability management) and which vendors' published facts match. No scores or rankings. Vendor pages read in September 2026 and updated on 2026-11-03.

## Start here
- [Find your tool](https://findcloudsecurity.com/find-your-tool): Six questions that point to a starting category and list the vendors whose published facts match.
- [How we match](https://findcloudsecurity.com/how-we-match): The finder rules, sources and limits.
- [Categories](https://findcloudsecurity.com/category): The six cloud security tool categories and which vendors describe each.

## Categories
- [CNAPP](https://findcloudsecurity.com/category/cnapp): What a CNAPP combines, when one platform beats several tools, when it does not, and which of nine vendors describe a CNAPP on their own pages.
- [CSPM](https://findcloudsecurity.com/category/cspm): What cloud security posture management checks, why it is usually the first tool a team adds, its limits, and which of nine vendors describe CSPM.
- [CWPP](https://findcloudsecurity.com/category/cwpp): What cloud workload protection covers inside VMs, containers and serverless functions, agent versus agentless approaches, and which vendors describe CWPP.
- [CIEM](https://findcloudsecurity.com/category/ciem): What CIEM does with cloud roles, machine identities and unused permissions, when you need it, and which of nine vendors describe CIEM on their own pages.
- [DSPM](https://findcloudsecurity.com/category/dspm): What data security posture management finds in cloud storage and databases, how it differs from DLP, and which of nine vendors describe DSPM.
- [Vulnerability management](https://findcloudsecurity.com/category/vulnerability-management): How vulnerability management works across images, hosts and serverless in the cloud, how findings get ranked, and which of nine vendors describe it.

## Vendors
- [Vendor profiles](https://findcloudsecurity.com/vendor-profile): Fact profiles of 9 vendors and 36 head-to-heads. No scores.
- [Aqua Security](https://findcloudsecurity.com/vendor-profile/aqua): A cloud native security platform built around kernel-layer runtime enforcement, with agentless posture visibility, for public, private and disconnected environments.
- [CrowdStrike Falcon Cloud Security](https://findcloudsecurity.com/vendor-profile/crowdstrike): CrowdStrike's cloud security module, which pairs agentless posture with the same Falcon sensor used on endpoints.
- [Microsoft Defender for Cloud](https://findcloudsecurity.com/vendor-profile/microsoft-defender): Microsoft's cloud security product: a free posture tier, paid posture and server plans billed per resource, across Azure, AWS and Google Cloud.
- [Orca Security](https://findcloudsecurity.com/vendor-profile/orca): A cloud security platform built on agentless SideScanning, with an optional runtime sensor, covering posture, workloads, identity, data, vulnerabilities, code and AI.
- [Palo Alto Networks Cortex Cloud](https://findcloudsecurity.com/vendor-profile/cortex-cloud): Palo Alto Networks' cloud security platform, formed by merging Prisma Cloud with Cortex CDR (announced 13 February 2025).
- [SentinelOne Singularity Cloud](https://findcloudsecurity.com/vendor-profile/sentinelone): SentinelOne's cloud security line: an agentless CNAPP (Cloud Native Security) plus Cloud Workload Security for runtime.
- [Sysdig Secure](https://findcloudsecurity.com/vendor-profile/sysdig): A cloud security platform with runtime detection built on Falco, the open-source project Sysdig created, plus agentless posture.
- [Upwind](https://findcloudsecurity.com/vendor-profile/upwind): A cloud security platform that combines agentless scanning with eBPF runtime sensors, from a company founded in October 2022.
- [Wiz](https://findcloudsecurity.com/vendor-profile/wiz): An agentless cloud security platform (Wiz Cloud, Wiz Code, Wiz Defend) built around the Security Graph, part of Google since 11 March 2026.
- [Facts side by side](https://findcloudsecurity.com/fact-compare): Pick two to five vendors and compare recorded facts in one table.

## Head-to-heads
- [Aqua vs CrowdStrike](https://findcloudsecurity.com/aqua-vs-crowdstrike): Aqua Security and CrowdStrike Falcon Cloud Security compared on facts only.
- [Aqua vs Defender for Cloud](https://findcloudsecurity.com/aqua-vs-microsoft-defender): Aqua Security and Microsoft Defender for Cloud compared on facts only.
- [Aqua vs Orca](https://findcloudsecurity.com/aqua-vs-orca): Aqua Security and Orca Security compared on facts only.
- [Aqua vs Cortex Cloud](https://findcloudsecurity.com/aqua-vs-cortex-cloud): Aqua Security and Palo Alto Networks Cortex Cloud compared on facts only.
- [Aqua vs SentinelOne](https://findcloudsecurity.com/aqua-vs-sentinelone): Aqua Security and SentinelOne Singularity Cloud compared on facts only.
- [Aqua vs Sysdig](https://findcloudsecurity.com/aqua-vs-sysdig): Aqua Security and Sysdig Secure compared on facts only.
- [Aqua vs Upwind](https://findcloudsecurity.com/aqua-vs-upwind): Aqua Security and Upwind compared on facts only.
- [Aqua vs Wiz](https://findcloudsecurity.com/aqua-vs-wiz): Aqua Security and Wiz compared on facts only.
- [CrowdStrike vs Defender for Cloud](https://findcloudsecurity.com/crowdstrike-vs-microsoft-defender): CrowdStrike Falcon Cloud Security and Microsoft Defender for Cloud compared on facts only.
- [CrowdStrike vs Orca](https://findcloudsecurity.com/crowdstrike-vs-orca): CrowdStrike Falcon Cloud Security and Orca Security compared on facts only.
- [CrowdStrike vs SentinelOne](https://findcloudsecurity.com/crowdstrike-vs-sentinelone): CrowdStrike Falcon Cloud Security and SentinelOne Singularity Cloud compared on facts only.
- [CrowdStrike vs Sysdig](https://findcloudsecurity.com/crowdstrike-vs-sysdig): CrowdStrike Falcon Cloud Security and Sysdig Secure compared on facts only.
- [CrowdStrike vs Upwind](https://findcloudsecurity.com/crowdstrike-vs-upwind): CrowdStrike Falcon Cloud Security and Upwind compared on facts only.
- [CrowdStrike vs Wiz](https://findcloudsecurity.com/crowdstrike-vs-wiz): CrowdStrike Falcon Cloud Security and Wiz compared on facts only.
- [Defender for Cloud vs Orca](https://findcloudsecurity.com/microsoft-defender-vs-orca): Microsoft Defender for Cloud and Orca Security compared on facts only.
- [Defender for Cloud vs SentinelOne](https://findcloudsecurity.com/microsoft-defender-vs-sentinelone): Microsoft Defender for Cloud and SentinelOne Singularity Cloud compared on facts only.
- [Defender for Cloud vs Sysdig](https://findcloudsecurity.com/microsoft-defender-vs-sysdig): Microsoft Defender for Cloud and Sysdig Secure compared on facts only.
- [Defender for Cloud vs Upwind](https://findcloudsecurity.com/microsoft-defender-vs-upwind): Microsoft Defender for Cloud and Upwind compared on facts only.
- [Defender for Cloud vs Wiz](https://findcloudsecurity.com/microsoft-defender-vs-wiz): Microsoft Defender for Cloud and Wiz compared on facts only.
- [Orca vs SentinelOne](https://findcloudsecurity.com/orca-vs-sentinelone): Orca Security and SentinelOne Singularity Cloud compared on facts only.
- [Orca vs Sysdig](https://findcloudsecurity.com/orca-vs-sysdig): Orca Security and Sysdig Secure compared on facts only.
- [Orca vs Upwind](https://findcloudsecurity.com/orca-vs-upwind): Orca Security and Upwind compared on facts only.
- [Orca vs Wiz](https://findcloudsecurity.com/orca-vs-wiz): Orca Security and Wiz compared on facts only.
- [Cortex Cloud vs CrowdStrike](https://findcloudsecurity.com/cortex-cloud-vs-crowdstrike): Palo Alto Networks Cortex Cloud and CrowdStrike Falcon Cloud Security compared on facts only.
- [Cortex Cloud vs Defender for Cloud](https://findcloudsecurity.com/cortex-cloud-vs-microsoft-defender): Palo Alto Networks Cortex Cloud and Microsoft Defender for Cloud compared on facts only.
- [Cortex Cloud vs Orca](https://findcloudsecurity.com/cortex-cloud-vs-orca): Palo Alto Networks Cortex Cloud and Orca Security compared on facts only.
- [Cortex Cloud vs SentinelOne](https://findcloudsecurity.com/cortex-cloud-vs-sentinelone): Palo Alto Networks Cortex Cloud and SentinelOne Singularity Cloud compared on facts only.
- [Cortex Cloud vs Sysdig](https://findcloudsecurity.com/cortex-cloud-vs-sysdig): Palo Alto Networks Cortex Cloud and Sysdig Secure compared on facts only.
- [Cortex Cloud vs Upwind](https://findcloudsecurity.com/cortex-cloud-vs-upwind): Palo Alto Networks Cortex Cloud and Upwind compared on facts only.
- [Cortex Cloud vs Wiz](https://findcloudsecurity.com/cortex-cloud-vs-wiz): Palo Alto Networks Cortex Cloud and Wiz compared on facts only.
- [SentinelOne vs Sysdig](https://findcloudsecurity.com/sentinelone-vs-sysdig): SentinelOne Singularity Cloud and Sysdig Secure compared on facts only.
- [SentinelOne vs Upwind](https://findcloudsecurity.com/sentinelone-vs-upwind): SentinelOne Singularity Cloud and Upwind compared on facts only.
- [SentinelOne vs Wiz](https://findcloudsecurity.com/sentinelone-vs-wiz): SentinelOne Singularity Cloud and Wiz compared on facts only.
- [Sysdig vs Upwind](https://findcloudsecurity.com/sysdig-vs-upwind): Sysdig Secure and Upwind compared on facts only.
- [Sysdig vs Wiz](https://findcloudsecurity.com/sysdig-vs-wiz): Sysdig Secure and Wiz compared on facts only.
- [Upwind vs Wiz](https://findcloudsecurity.com/upwind-vs-wiz): Upwind and Wiz compared on facts only.

## Pricing
- [Pricing](https://findcloudsecurity.com/pricing): What vendors publish about pricing.
- [Aqua Security pricing](https://findcloudsecurity.com/pricing/aqua): No list prices. Cloud Security is priced by number of workloads (EC2 instances, Fargate containers, Lambda functions) and Dev Security by number of code repositories; request a trial or demo.
- [CrowdStrike Falcon Cloud Security pricing](https://findcloudsecurity.com/pricing/crowdstrike): AWS Marketplace pay-as-you-go listing that combines Falcon Cloud Security with Next-Gen SIEM: runtime host protection (EC2, WorkSpaces) $0.023 per hour per running host; container cluster and node protection $0.054 per hour per running worker node; Fargate container protection $0.01 per hour per Fargate instance; 30-day free trial with up to $500 in usage credits. CrowdStrike's own pricing page lists endpoint bundles only.
- [Microsoft Defender for Cloud pricing](https://findcloudsecurity.com/pricing/microsoft-defender): Foundational CSPM is free. Defender CSPM is $5.11 per billable resource per month (8 functions or web apps count as 1 resource). Defender for Servers is $4.906 per server per month for Plan 1 and $14.60 for Plan 2. Defender for Containers is $6.8693 per vCore per month. USD list prices, East and Central US; free for the first 30 days.
- [Orca Security pricing](https://findcloudsecurity.com/pricing/orca): Orca's own site publishes no price (orca.security/pricing returned a 404 on 27 September 2026). An AWS Marketplace contract listing (Unique Expansion) shows Small, up to 100 concurrent workloads (EC2) per month, $7,000.00; Small-medium (300) $12,000.00; Medium (500) $17,000.00; Large (1,000) $30,000.00. These are monthly prices under the listing's 1-month contract, checked on 4 November 2026. The listing also offers a 12-month contract.
- [Palo Alto Networks Cortex Cloud pricing](https://findcloudsecurity.com/pricing/cortex-cloud): Not published. The Cortex Cloud page offers only a demo request. CNAPP is included at no additional cost for Cortex Cloud Runtime Security customers.
- [SentinelOne Singularity Cloud pricing](https://findcloudsecurity.com/pricing/sentinelone): Not published. Contact sales.
- [Sysdig Secure pricing](https://findcloudsecurity.com/pricing/sysdig): No list prices on its own site; CNAPP licensing is based on the number of hosts. AWS Marketplace (Sysdig Cloud Security and Observability), 1-month contract: CNAPP Enterprise $72.00 per unit per month; the unit is not described in our notes. 12-month contracts are listed as saving up to 17%.
- [Upwind pricing](https://findcloudsecurity.com/pricing/upwind): No price on upwind.io. AWS Marketplace, 12-month contract: Upwind Cloud Security Platform $30,000.00 and Upwind Managed Detection and Response 24/7 Service $6,000.00; the unit basis is not described in our notes. 24-month and 36-month contracts are listed as saving up to 8% and 11%.
- [Wiz pricing](https://findcloudsecurity.com/pricing/wiz): Wiz's own pages we read publish no price. AWS Marketplace, 12-month contract: Wiz Essential (protect 100 cloud workloads) $24,000.00; Wiz Advanced (protect 100 cloud workloads) $38,000.00; add-ons: Wiz Sensor (100 sensors, for Wiz Advanced) $28,000.00, Wiz Code (100 licenses) $58,500.00, Wiz Defend (ingest 300 GB of logs per month, for Wiz Advanced) $18,000.00. The listing also offers 24-month and 36-month contracts, and a free trial on terms set by the vendor.

## Alternatives
- [Alternatives](https://findcloudsecurity.com/alternatives): Other vendors, compared on published facts.
- [Aqua Security alternatives](https://findcloudsecurity.com/alternatives/aqua): Other vendors and the facts that differ.
- [CrowdStrike Falcon Cloud Security alternatives](https://findcloudsecurity.com/alternatives/crowdstrike): Other vendors and the facts that differ.
- [Microsoft Defender for Cloud alternatives](https://findcloudsecurity.com/alternatives/microsoft-defender): Other vendors and the facts that differ.
- [Orca Security alternatives](https://findcloudsecurity.com/alternatives/orca): Other vendors and the facts that differ.
- [Palo Alto Networks Cortex Cloud alternatives](https://findcloudsecurity.com/alternatives/cortex-cloud): Other vendors and the facts that differ.
- [SentinelOne Singularity Cloud alternatives](https://findcloudsecurity.com/alternatives/sentinelone): Other vendors and the facts that differ.
- [Sysdig Secure alternatives](https://findcloudsecurity.com/alternatives/sysdig): Other vendors and the facts that differ.
- [Upwind alternatives](https://findcloudsecurity.com/alternatives/upwind): Other vendors and the facts that differ.
- [Wiz alternatives](https://findcloudsecurity.com/alternatives/wiz): Other vendors and the facts that differ.

## Which vendors fit
- [Which vendors fit](https://findcloudsecurity.com/fit): Published facts that meet specific needs.
- [an agentless core](https://findcloudsecurity.com/fit/agentless): The vendor records an agentless core.
- [FedRAMP](https://findcloudsecurity.com/fit/fedramp): The vendor states public-sector authorization, not an authorization in progress.
- [Oracle Cloud](https://findcloudsecurity.com/fit/oracle-cloud): The vendor names Oracle Cloud Infrastructure among its clouds.
- [Alibaba or Tencent Cloud](https://findcloudsecurity.com/fit/alibaba-tencent-cloud): The vendor names Alibaba or Tencent Cloud among its clouds.
- [Kubernetes](https://findcloudsecurity.com/fit/kubernetes): The vendor states Kubernetes runtime coverage.
- [air-gapped environments](https://findcloudsecurity.com/fit/air-gapped): The vendor states support for disconnected environments.
- [on-premises environments](https://findcloudsecurity.com/fit/on-premises): The vendor states support for on-premises environments.
- [published pricing](https://findcloudsecurity.com/fit/published-pricing): The vendor publishes list prices on its own site.
- [AI security](https://findcloudsecurity.com/fit/ai-security): The vendor states AI security coverage.

## Glossary terms
- [Admission controller](https://findcloudsecurity.com/cloud-security-glossary/admission-controller): A Kubernetes component that inspects requests to the cluster API before an object such as a pod is created, and can reject them. Security tools use one to stop images that fail a policy from being deployed. Upwind lists a container admission controller among its modules.
- [Agent](https://findcloudsecurity.com/cloud-security-glossary/agent): Software installed inside a machine, container host or cluster that reports what happens there and, depending on the product, can block activity. Agents see running processes that outside scanning cannot, at the cost of deployment and upkeep.
- [Agentless scanning](https://findcloudsecurity.com/cloud-security-glossary/agentless-scanning): Finding vulnerabilities, secrets, malware and misconfigurations without installing software on the workload, usually by reading cloud APIs and copies of workload disks. It covers a whole estate quickly but sees a moment in time rather than live activity.
- [AI-BOM](https://findcloudsecurity.com/cloud-security-glossary/ai-bom): An AI bill of materials: an inventory of the models, datasets, AI services and libraries an organization uses. Wiz and Upwind both list AI-BOM on their AI security pages.
- [AI-SPM](https://findcloudsecurity.com/cloud-security-glossary/ai-spm): AI security posture management: inventory and configuration checks for AI services, models, pipelines and agents in your cloud accounts, such as an exposed model endpoint or training data with weak access controls.
- [API security](https://findcloudsecurity.com/cloud-security-glossary/api-security): Discovering the APIs an application exposes and testing or monitoring them for weaknesses such as missing authentication. Orca and Upwind list API security among their modules.
- [Attack surface management (ASM)](https://findcloudsecurity.com/cloud-security-glossary/asm): Continuously finding the assets an organization exposes to the internet, including ones nobody registered, and checking them for weaknesses. Cloud platforms add it to show which cloud resources are reachable from outside.
- [ASPM](https://findcloudsecurity.com/cloud-security-glossary/aspm): Application security posture management: one view of findings from code scanners, tied to the applications and owners they belong to, so teams can decide which application risks to fix first. Wiz Code and CrowdStrike Falcon Cloud Security list ASPM.
- [Attack path](https://findcloudsecurity.com/cloud-security-glossary/attack-path): A chain of conditions an attacker could follow from an entry point to something valuable, for example an internet-facing machine with a vulnerable package whose role can read a sensitive database. Platforms compute attack paths to rank which findings matter.
- [Blast radius](https://findcloudsecurity.com/cloud-security-glossary/blast-radius): Everything an attacker could reach after compromising one identity, workload or credential. Reducing blast radius usually means narrower permissions and fewer network paths.
- [Cloud detection and response (CDR)](https://findcloudsecurity.com/cloud-security-glossary/cdr): Detecting attacks in cloud activity logs and workloads and helping teams investigate and respond, for example by isolating a workload or revoking a credential.
- [CIEM](https://findcloudsecurity.com/cloud-security-glossary/ciem): Cloud infrastructure entitlement management: computing what each human and machine identity can do in your cloud accounts and flagging permissions larger than the job needs.
- [CIS Benchmarks](https://findcloudsecurity.com/cloud-security-glossary/cis-benchmarks): Configuration guidelines published by the Center for Internet Security for operating systems, cloud accounts and services. Posture tools commonly ship rule sets based on them.
- [CNAPP](https://findcloudsecurity.com/cloud-security-glossary/cnapp): Cloud-native application protection platform: one product that combines posture, workload, identity, data and usually code checks over a single inventory, so related findings on the same asset are read together.
- [Code-to-cloud tracing](https://findcloudsecurity.com/cloud-security-glossary/code-to-cloud): Linking a problem found in a running cloud resource back to the code, template or pipeline that created it, so the fix lands in the source rather than in the live resource. Orca says its tracing can open pull requests.
- [Compliance framework](https://findcloudsecurity.com/cloud-security-glossary/compliance-framework): A published set of controls an organization must show it meets, such as an industry standard or a government authorization program. Posture tools map their findings to frameworks to produce audit views.
- [Container image](https://findcloudsecurity.com/cloud-security-glossary/container-image): The packaged file system and settings from which containers start. Because many containers start from one image, a vulnerability in the image repeats wherever it runs, which is why images are scanned before deployment.
- [Control plane](https://findcloudsecurity.com/cloud-security-glossary/control-plane): The management layer of a cloud or cluster: the APIs that create, change and delete resources and permissions. Activity on the control plane, such as a policy change, is a common detection source.
- [CSPM](https://findcloudsecurity.com/cloud-security-glossary/cspm): Cloud security posture management: reading cloud account configuration through provider APIs and flagging settings that break policy, such as public storage or disabled logging.
- [CVE](https://findcloudsecurity.com/cloud-security-glossary/cve): Common Vulnerabilities and Exposures: the public program that gives each disclosed vulnerability an identifier in the form CVE, year, number. Almost every vulnerability finding refers to one.
- [CWPP](https://findcloudsecurity.com/cloud-security-glossary/cwpp): Cloud workload protection platform: inspecting and protecting virtual machines, containers and serverless functions, from vulnerable packages to attacks in progress.
- [DAST](https://findcloudsecurity.com/cloud-security-glossary/dast): Dynamic application security testing: testing a running application from outside by sending it requests, rather than reading its code. Upwind lists DAST among its modules.
- [Drift](https://findcloudsecurity.com/cloud-security-glossary/drift): A change in a running resource that makes it differ from its intended configuration or image, such as a new binary in a container. Wiz Defend lists Kubernetes drift detection.
- [DSPM](https://findcloudsecurity.com/cloud-security-glossary/dspm): Data security posture management: finding and classifying sensitive data across cloud stores and showing who and what can reach it.
- [eBPF](https://findcloudsecurity.com/cloud-security-glossary/ebpf): A Linux kernel feature that runs small, verified programs to observe system activity such as process starts and network connections. Several runtime sensors, including those from Orca, Wiz and Upwind, are described as eBPF-based.
- [EDR](https://findcloudsecurity.com/cloud-security-glossary/edr): Endpoint detection and response: an agent that records activity on laptops and servers and detects and stops attacks. CrowdStrike's Falcon sensor and Microsoft Defender for Endpoint extend EDR to cloud servers.
- [Effective permissions](https://findcloudsecurity.com/cloud-security-glossary/effective-permissions): What an identity can actually do once every attached policy, group membership, role assumption and boundary is combined. It often differs from what any single policy suggests.
- [EPSS](https://findcloudsecurity.com/cloud-security-glossary/epss): The Exploit Prediction Scoring System, run by FIRST, which estimates the probability that a published vulnerability will be exploited in the next 30 days. Aqua says it uses EPSS scores when ranking vulnerabilities.
- [Falco](https://findcloudsecurity.com/cloud-security-glossary/falco): An open-source runtime detection project for hosts, containers and Kubernetes, created by Sysdig and a CNCF graduated project. Sysdig Secure's runtime detection is built on it.
- [FedRAMP](https://findcloudsecurity.com/cloud-security-glossary/fedramp): The US federal government's authorization program for cloud services sold to federal agencies. Wiz says Wiz for Government is FedRAMP High authorized, Aqua states FedRAMP High Authorization, Orca states FedRAMP Moderate, and Upwind's newsroom said in November 2025 that it was pursuing FedRAMP.
- [File integrity monitoring (FIM)](https://findcloudsecurity.com/cloud-security-glossary/file-integrity-monitoring): Watching important files on a workload for unexpected changes. Defender for Servers Plan 2 and Wiz Defend both list it.
- [GovRAMP](https://findcloudsecurity.com/cloud-security-glossary/govramp): An authorization program for cloud services sold to US state and local government. On 10 September 2026 Wiz said Wiz for Gov had achieved GovRAMP High authorization.
- [Infrastructure as code (IaC)](https://findcloudsecurity.com/cloud-security-glossary/iac): Defining cloud resources in template files, such as Terraform or CloudFormation, that are applied by a pipeline instead of being created by hand.
- [IaC scanning](https://findcloudsecurity.com/cloud-security-glossary/iac-scanning): Checking infrastructure-as-code templates for misconfigurations before they are applied, so a problem is fixed once in code rather than repeatedly in live resources.
- [Just-in-time access](https://findcloudsecurity.com/cloud-security-glossary/jit-access): Granting access to a machine or permission only when requested and only for a limited time, instead of leaving it open. Defender for Servers Plan 2 lists JIT access.
- [Kubernetes](https://findcloudsecurity.com/cloud-security-glossary/kubernetes): An open-source system for running containers across a cluster of machines. Its own permissions, network rules and admission controls add a layer that cloud posture tools only partly see.
- [Least privilege](https://findcloudsecurity.com/cloud-security-glossary/least-privilege): Giving each identity only the permissions it needs for its job and nothing more. CIEM tools measure the gap between granted and used permissions to move toward it.
- [Machine identity](https://findcloudsecurity.com/cloud-security-glossary/machine-identity): An identity used by software rather than a person: a role assumed by a function, a service account used by a pipeline, a key used by a workload. In most cloud estates they outnumber human users.
- [MCP server](https://findcloudsecurity.com/cloud-security-glossary/mcp-server): A service that exposes data or tools to AI applications through the Model Context Protocol. Because an MCP server can act on behalf of an AI agent, it is a new item to inventory; Orca and Upwind mention MCP servers in their AI security pages.
- [Misconfiguration](https://findcloudsecurity.com/cloud-security-glossary/misconfiguration): A setting that leaves a resource less safe than intended, such as storage open to the internet or logging switched off. Misconfigurations are the main thing posture tools find.
- [Multi-cloud](https://findcloudsecurity.com/cloud-security-glossary/multi-cloud): Running workloads on more than one cloud provider. Each provider has its own APIs, permission model and services, which multiplies what a security team must check.
- [NIST SP 800-53](https://findcloudsecurity.com/cloud-security-glossary/nist-sp-800-53): The catalog of security and privacy controls published by the US National Institute of Standards and Technology. Government authorization programs assess cloud services against it.
- [OCI](https://findcloudsecurity.com/cloud-security-glossary/oci): Oracle Cloud Infrastructure, Oracle's public cloud. Orca, Aqua, Cortex Cloud, CrowdStrike, Sysdig, Upwind and Wiz name it among the clouds they cover; Sysdig supports posture only there.
- [PaaS](https://findcloudsecurity.com/cloud-security-glossary/paas): Platform as a service: managed services such as databases, queues and app platforms where the provider runs the servers. You cannot install an agent on them, so they are covered through APIs.
- [Security posture](https://findcloudsecurity.com/cloud-security-glossary/posture): The overall state of an environment's security settings at a point in time: what is configured well, what is not, and what is exposed.
- [Runtime protection](https://findcloudsecurity.com/cloud-security-glossary/runtime-protection): Detecting and stopping attacks inside workloads while they run, by watching processes, files and network activity. It needs a sensor or agent on the workload.
- [SAST](https://findcloudsecurity.com/cloud-security-glossary/sast): Static application security testing: analysing source code for security flaws without running it. Orca lists SAST among its application security scanners; SAST is not among Upwind's listed modules.
- [SBOM](https://findcloudsecurity.com/cloud-security-glossary/sbom): Software bill of materials: a list of the components and versions inside a piece of software, used to answer whether a newly disclosed vulnerability affects you.
- [SCA](https://findcloudsecurity.com/cloud-security-glossary/sca): Software composition analysis: identifying the open-source and third-party packages an application uses and flagging those with known vulnerabilities or license issues.
- [Secrets scanning](https://findcloudsecurity.com/cloud-security-glossary/secrets-scanning): Searching code, images and disks for credentials such as API keys and passwords that should not be stored there. SentinelOne says its scanning validates 850+ secret types.
- [Security graph](https://findcloudsecurity.com/cloud-security-glossary/security-graph): A data model that stores cloud resources, identities, data stores and findings as connected nodes, so a platform can follow relationships between them. Wiz calls its version the Security Graph.
- [Serverless function](https://findcloudsecurity.com/cloud-security-glossary/serverless): Code that runs on demand on infrastructure the provider manages, billed per execution. There is no machine to install an agent on, so protection relies on APIs, package scanning and the function's permissions.
- [Shadow AI](https://findcloudsecurity.com/cloud-security-glossary/shadow-ai): AI services, models or apps used inside an organization without the security team's knowledge. Orca lists shadow AI discovery; Aqua lists detection of unsanctioned AI usage.
- [Shared responsibility model](https://findcloudsecurity.com/cloud-security-glossary/shared-responsibility): The split of security duties between a cloud provider and its customer: the provider secures the underlying infrastructure, and the customer secures its own configuration, identities, data and workloads.
- [Shift left](https://findcloudsecurity.com/cloud-security-glossary/shift-left): Moving security checks earlier in the delivery process, into code review and build pipelines, so problems are fixed before deployment.
- [SideScanning](https://findcloudsecurity.com/cloud-security-glossary/sidescanning): Orca Security's name for its agentless method: it reads a workload's block storage out of band and reconstructs the file system in a read-only view to find vulnerabilities and other risks. Orca describes it as patented.
- [Snapshot scanning](https://findcloudsecurity.com/cloud-security-glossary/snapshot-scanning): A form of agentless scanning that analyses a copy of a workload's disk rather than the running machine. It finds what is installed, not what is currently running.
- [Toxic combination](https://findcloudsecurity.com/cloud-security-glossary/toxic-combination): Two or more findings that are minor alone but serious together, such as a public endpoint, a vulnerable package and an over-permissioned role on the same workload.
- [Trivy](https://findcloudsecurity.com/cloud-security-glossary/trivy): An open-source scanner for container images, file systems, code repositories and infrastructure-as-code, maintained by Aqua Security under the Apache-2.0 license.
- [Vulnerability management](https://findcloudsecurity.com/cloud-security-glossary/vulnerability-management): The ongoing work of finding known vulnerable software, ranking it by risk and getting it fixed.
- [Workload](https://findcloudsecurity.com/cloud-security-glossary/workload): Anything that runs application code in the cloud: a virtual machine, a container, a serverless function.
- [Zero-day](https://findcloudsecurity.com/cloud-security-glossary/zero-day): A vulnerability that attackers know about before a fix is available. Scanners that match known CVEs cannot find it, which is one reason runtime detection exists.

## Learn
- [Academy](https://findcloudsecurity.com/learn): 10 short lessons in three tracks on choosing a tool category.
- [Taking Stock of Your Cloud Estate Before Choosing a Security Tool](https://findcloudsecurity.com/learn/taking-stock-of-your-cloud-estate): Before picking a cloud security tool, list your accounts, clouds, workload types, data stores and owners. A one-page inventory that makes every later decision easier.
- [Shared Responsibility in Practice: What Your Cloud Provider Leaves to You](https://findcloudsecurity.com/learn/shared-responsibility-in-practice): The cloud provider secures its infrastructure; you secure configuration, identities, data and workloads. How that split decides which security tools you need.
- [Machine Identities and Cloud Permissions: Why CIEM Exists](https://findcloudsecurity.com/learn/machine-identities-and-permissions): Roles, service accounts and keys used by software outnumber people in most clouds. How machine identities create permission risk and what CIEM tools do about it.
- [Why Most Teams Start with Cloud Posture (CSPM)](https://findcloudsecurity.com/learn/why-posture-comes-first): CSPM covers every connected account without installing anything, which is why it is usually the first cloud security tool. What it finds, and the point where it stops.
- [Agent Tolerance: Deciding How Far to Go with Agents on Cloud Workloads](https://findcloudsecurity.com/learn/deciding-how-far-to-go-with-agents): Agentless scanning, optional sensors and agent-led platforms: what each approach sees and costs, and how to decide where your team can install software.
- [Finding Sensitive Data in Cloud Storage: When DSPM Earns Its Place](https://findcloudsecurity.com/learn/finding-sensitive-data): How data security posture management finds and classifies sensitive data across cloud stores, joins it with access and exposure, and when it should come before other tools.
- [Cloud Vulnerabilities from Pipeline to Runtime: Where to Look and What to Fix First](https://findcloudsecurity.com/learn/vulnerabilities-from-pipeline-to-runtime): Cloud vulnerability management happens in build pipelines, account scans and running workloads. How each finds vulnerable software and how findings get ranked.
- [One Cloud Security Platform or Several Tools? The CNAPP Trade-Off](https://findcloudsecurity.com/learn/one-platform-or-several-tools): When a CNAPP is the right buy and when separate tools serve better: coverage, uneven depth, consoles, contracts and the categories you need most.
- [Cloud Security for a Team of One or Two: What to Buy First](https://findcloudsecurity.com/learn/cloud-security-for-a-small-team): A one- or two-person cloud security team needs coverage without upkeep. Why posture comes first, why one console matters, and what to check on price.
- [Mapping Compliance Needs to Cloud Security Tool Categories](https://findcloudsecurity.com/learn/mapping-compliance-needs-to-categories): Continuous compliance reporting, US public-sector authorization and disconnected environments: how each compliance need changes which tool category and vendors fit.
- [Glossary](https://findcloudsecurity.com/cloud-security-glossary): 62 terms defined plainly.
- [FAQ](https://findcloudsecurity.com/cloud-security-faq): 30 questions on categories, choosing, vendors and this site.

## Journal
- [The Journal](https://findcloudsecurity.com/journal): Dated notes on choosing cloud security tools.
- [Defender for Cloud's Free Posture Tier Goes Opt-In on 27 October 2026](https://findcloudsecurity.com/journal/foundational-cspm-opt-in-october-2026): From 27 October 2026, Microsoft's free Foundational CSPM is no longer on by default for new Azure subscriptions. Who is affected, what stays the same and what to check.
- [Oracle, Alibaba and Tencent Cloud: Which Cloud Security Vendors Name Them](https://findcloudsecurity.com/journal/which-clouds-do-vendors-name): Every vendor here names AWS, Azure and Google Cloud. 7 name Oracle Cloud, 4 name Alibaba or Tencent Cloud. What vendors' own pages say.
- [Already Running CrowdStrike, SentinelOne or Microsoft Defender? What They Offer for Cloud](https://findcloudsecurity.com/journal/endpoint-vendor-already-installed): If an endpoint agent already runs on your servers, its vendor may extend it to cloud workloads. What CrowdStrike, SentinelOne and Microsoft describe, and what still comes from elsewhere.
- [What Cloud Security Vendors Publish About Price: Nine Vendors Checked](https://findcloudsecurity.com/journal/what-cloud-security-vendors-publish-about-price): One of nine cloud security vendors publishes list prices on its own site; five have public AWS Marketplace prices; two quote only through sales. What each price covers.
- [Three Example Teams Run Through the Cloud Security Finder](https://findcloudsecurity.com/journal/three-example-teams-through-the-finder): A small Azure team, a Kubernetes team on open-source tools and a four-cloud enterprise with no agents: how the finder's published rules handle each, step by step.
- [Kubernetes Security: Where Falco, Trivy and the Commercial Platforms Fit](https://findcloudsecurity.com/journal/kubernetes-falco-trivy-and-platforms): Falco detects runtime threats and Trivy scans images and code; both are open source. Where they stop, and how nine commercial platforms describe Kubernetes runtime coverage.
- [AI Agents Inside Cloud Security Products: What Five Vendors Announced in 2026](https://findcloudsecurity.com/journal/ai-agents-inside-cloud-security-products-2026): From Aqua Compass to Sysdig Secure AI and Palo Alto Networks' Console deal: dated 2026 announcements that put AI agents and AI-built apps into cloud security products.
- [What the Cloud Security Finder Cannot Tell You: Five Checks to Run Yourself](https://findcloudsecurity.com/journal/what-the-finder-cannot-tell-you): The finder narrows categories and vendors from public facts. Five things it cannot know, and how to test them in a trial: coverage, noise, routing, sensor cost and contract scope.