Defender for Cloud vs Wiz: cloud security facts side by side
How do their category maps compare?
- Described on the vendor's pages we read
- Not in our sources (it may exist; we did not find it on the pages we read)
What are the facts, side by side?
| Fact | Defender for Cloud | Wiz |
|---|---|---|
| Positioning | Microsoft's cloud security product: a free posture tier, paid posture and server plans billed per resource, across Azure, AWS and Google Cloud. | An agentless cloud security platform (Wiz Cloud, Wiz Code, Wiz Defend) built around the Security Graph, part of Google since 11 March 2026. |
| Agent approachDiffers | Agentless parts, agent for depth Agentless VM, secrets and Kubernetes scanning exist, but only in the paid Defender CSPM plan and Defender for Servers Plan 2. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Agentless core Connects by cloud API and, Wiz states, reaches VMs, containers, serverless, PaaS and AI resources without agents. Source: Wiz platform overview, read . |
| Runtime sensor | Defender for Servers Plan 1 and Plan 2 bring Microsoft Defender for Endpoint EDR to servers. Source: Microsoft Learn: Defender for Servers overview, read . | The optional Wiz Sensor is eBPF-based and blocks threats on VMs, containers and serverless containers (Wiz Defend). Source: Wiz Defend and Wiz Sensor, read . |
| Clouds namedDiffers | Azure, AWS, GCP Azure, AWS and Google Cloud, plus on-premises machines through Azure Arc. Source: Microsoft Learn: Defender for Servers overview, read . | AWS, Azure, GCP, OCI, Alibaba Wiz names AWS, Azure, Google Cloud, OCI and Alibaba Cloud among its supported environments; Tencent Cloud is not named. Source: Wiz environments: Alibaba Cloud, read . |
| CNAPP | Described Posture (Defender CSPM) and workload protection (Defender for Servers) are separate plans in one product; the full set needs paid plans. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described Wiz Cloud, Wiz Code and Wiz Defend on one Security Graph. Source: Wiz platform overview, read . |
| CSPM | Described Foundational CSPM is free; Defender CSPM adds attack path analysis and the cloud security explorer. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described Agentless, API-connected scanning of cloud resources, including Alibaba Cloud, as the vendor states. Source: Wiz extends CNAPP leadership with protection for Alibaba Cloud, read . |
| CWPP | Described Defender for Servers Plan 1 and Plan 2, with file integrity monitoring and just-in-time access in Plan 2. Source: Microsoft Learn: Defender for Servers overview, read . | Described Agentless workload scanning plus the Wiz Sensor for runtime blocking, Kubernetes file integrity monitoring and drift detection. Source: Wiz Defend and Wiz Sensor, read . |
| CIEM | Described Defender for Cloud includes native CIEM, supporting Microsoft Entra ID, AWS IAM and Google Cloud IAM. Source: Microsoft Learn: CIEM in Defender for Cloud, read . | Described Wiz has a named CIEM solution (Wiz for CIEM). Source: Wiz for CIEM, read . |
| DSPM | Described DSPM is part of the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described Wiz DSPM discovers and classifies sensitive data and detects data risks. Source: Wiz DSPM, read . |
| Vulnerability management | Described Agentless VM vulnerability scanning is in the paid Defender CSPM plan and Defender for Servers Plan 2. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described Named Unified Vulnerability Management solution, described as agentless cloud vulnerability management. Source: Wiz Unified Vulnerability Management, read . |
| Code securityDiffers | Code-to-cloud mapping in the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Wiz Code: SCA and SBOM, IaC, secrets and malware scanning, IDE scanning, GitHub, an MCP server, ASPM and code-to-cloud tracing. Source: Wiz Code, read . |
| AI securityDiffers | AI-SPM in the paid Defender CSPM plan; Defender for AI Services is billed per 1,000 tokens. Source: Azure: Defender for Cloud pricing, read . | Agentless AI-BOM across SageMaker, OpenAI, Bedrock and Vertex AI, AI attack paths, and runtime detection of prompt injection and rogue agents. Source: Wiz AI-SPM, read . |
| Kubernetes runtimeDiffers | Agentless Kubernetes discovery in the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Kubernetes file integrity monitoring and drift detection in Wiz Defend. Source: Wiz Defend and Wiz Sensor, read . |
| Private cloud or on-premisesDiffers | On-premises machines through Azure Arc. Source: Microsoft Learn: Defender for Servers overview, read . | Not in our sources |
| Disconnected environments | Not in our sources | Not in our sources |
| Compliance reporting | Compliance standards include CIS, PCI DSS v4.0.1, HIPAA, ISO/IEC 27001:2022, SOC 2023, NIST CSF v2.0 and NIST SP 800-53, assignable to Azure subscriptions, AWS accounts and GCP projects. Source: Microsoft Learn: regulatory compliance standards, read . | Its compliance solution names benchmarks including NIST, HIPAA, CIS, HITRUST and SOC 2. Source: Wiz compliance, read . |
| Public-sector authorization | Microsoft lists Defender for Cloud in FedRAMP High audit scope for Azure and Azure Government. Source: Azure and other Microsoft cloud services compliance scope, read . | Wiz for Government is described as a FedRAMP High authorized platform; Wiz for Gov also achieved GovRAMP High authorization (10 September 2026). Source: Wiz for Government, read . |
| PriceDiffers | Foundational CSPM is free. Defender CSPM is $5.11 per billable resource per month (8 functions or web apps count as 1 resource). Defender for Servers is $4.906 per server per month for Plan 1 and $14.60 for Plan 2. Defender for Containers is $6.8693 per vCore per month. USD list prices, East and Central US; free for the first 30 days. Source: Azure: Defender for Cloud pricing (re-read), read . | Not published Wiz's own pages we read publish no price. AWS Marketplace, 12-month contract: Wiz Essential (protect 100 cloud workloads) $24,000.00; Wiz Advanced (protect 100 cloud workloads) $38,000.00; add-ons: Wiz Sensor (100 sensors, for Wiz Advanced) $28,000.00, Wiz Code (100 licenses) $58,500.00, Wiz Defend (ingest 300 GB of logs per month, for Wiz Advanced) $18,000.00. The listing also offers 24-month and 36-month contracts, and a free trial on terms set by the vendor. Source: AWS Marketplace: Wiz Cloud Infrastructure Security Platform, read . |
| Open source | None named | None named |
| Ownership | Microsoft. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Part of Google since 11 March 2026; the $32 billion all-cash deal was announced on 18 March 2025. Source: Wiz blog: Google closes deal to acquire Wiz, read . |
Where do they differ?
- Agent approach: Defender for Cloud has agentless parts and an agent for depth; Wiz has an agentless core.
- Clouds named: Defender for Cloud names Azure, AWS and GCP; Wiz names AWS, Azure, GCP, OCI and Alibaba.
- Code security: Defender for Cloud partly matches; Wiz matches.
- AI security: Defender for Cloud partly matches; Wiz matches.
- Kubernetes runtime: Defender for Cloud partly matches; Wiz matches.
- Private cloud or on-premises: Defender for Cloud matches; Wiz is not in our sources.
- Price: Defender for Cloud matches; Wiz partly matches.
Choose Defender for Cloud if
- Most of your estate is on Azure and you already use Microsoft security products.
- You need to model cost from public prices before talking to anyone.
Choose Wiz if
- You want an agentless start across AWS, Azure, Google Cloud, OCI and Alibaba Cloud with attack paths across identities and data.
- You sell to US government and need FedRAMP High or GovRAMP High.
Which limits should you check?
Defender for Cloud
- Agentless scanning, attack paths, DSPM and AI-SPM sit in the paid Defender CSPM plan ($5.11 per billable resource per month), not the free tier.
- Oracle Cloud and Alibaba Cloud are not named, and from 27 October 2026 the free tier becomes opt-in for new Azure subscriptions.
Wiz
- Its own pages publish no price; on AWS Marketplace a 12-month contract for Wiz Essential (100 cloud workloads) is $24,000.
- Tencent Cloud is not named, and runtime blocking needs the optional Wiz Sensor.
Frequently asked questions
How do Defender for Cloud and Wiz differ?
Neither is scored on this site. Defender for Cloud describes 6 of six categories and Wiz 6 on the pages we read, and they differ on 7 recorded facts. Which fits depends on your clouds, agent tolerance and existing tools; the finder checks those.
Which of the two needs an agent?
Defender for Cloud: Agentless parts, agent for depth. Wiz: Agentless core.
Do Defender for Cloud or Wiz publish prices?
Defender for Cloud: Foundational CSPM is free. Defender CSPM is $5.11 per billable resource per month (8 functions or web apps count as 1 resource). Defender for Servers is $4.906 per server per month for Plan 1 and $14.60 for Plan 2. Defender for Containers is $6.8693 per vCore per month. USD list prices, East and Central US; free for the first 30 days. Wiz: Wiz's own pages we read publish no price. AWS Marketplace, 12-month contract: Wiz Essential (protect 100 cloud workloads) $24,000.00; Wiz Advanced (protect 100 cloud workloads) $38,000.00; add-ons: Wiz Sensor (100 sensors, for Wiz Advanced) $28,000.00, Wiz Code (100 licenses) $58,500.00, Wiz Defend (ingest 300 GB of logs per month, for Wiz Advanced) $18,000.00. The listing also offers 24-month and 36-month contracts, and a free trial on terms set by the vendor.