Aqua Security: cloud security profile and facts (2026)
Visit Aqua's siteAqua Security
aquasec.com
* Not found on the pages we read; it may exist. Facts as the vendor states them on its own pages and marketplace listings, read September 2026, checked 3 Nov 2026. Not a measure of how well anything works.
Which categories does Aqua describe?
- Described on the vendor's pages we read
- Not in our sources (it may exist; we did not find it on the pages we read)
- CNAPPDescribed
Positions one platform across posture, pipeline scanning and runtime enforcement.
Source: Aqua cloud native security platform, read .
- CSPMDescribed
CSPM is listed among the capabilities on its pricing page, alongside CWPP, agentless and agent-based scanning and eBPF runtime detection.
Source: Aqua pricing, read .
- CWPPDescribed
Monitor, detect, enforce and contain inside running workloads, with kernel-layer enforcement.
Source: Aqua cloud native security platform, read .
- CIEMNot in our sources
Not named as an Aqua capability on the pricing or CSPM pages we read.
Source: Aqua CSPM product page, read .
- DSPMNot in our sources
Not described on the pages we read.
- Vulnerability managementDescribed
Ranks vulnerabilities by reachability, EPSS scores and evidence of active exploitation.
Source: Aqua cloud native security platform, read .
The map shows what each vendor's own pages describe. It is not a measure of how well a feature works.
How does Aqua deploy?
| Fact | Aqua |
|---|---|
| Agent approach | Agentless parts, agent for depth Offers agentless posture visibility; the platform's depth comes from kernel-layer enforcement on the workload. Source: Aqua cloud native security platform, read . |
| Runtime sensor | Kernel-layer enforcement that blocks attacks without killing the container itself. Source: Aqua cloud native security platform, read . |
| Clouds named | AWS, Azure, GCP, OCI, Alibaba Aqua names AWS, Azure, GCP, Oracle and Alibaba Cloud environments, plus Kubernetes; its platform page also describes private cloud and disconnected environments. Source: Aqua pricing, read . |
| Private cloud or on-premises | Supports private cloud environments. Source: Aqua cloud native security platform, read . |
| Disconnected environments | Supports disconnected environments. Source: Aqua cloud native security platform, read . |
What else does Aqua cover?
| Fact | Aqua |
|---|---|
| Code security | Scans images and repositories for vulnerabilities, secrets and misconfigurations and blocks noncompliant artifacts in the pipeline. Source: Aqua cloud native security platform, read . |
| AI security | GenAI application security from code to runtime, and detection of unsanctioned AI usage. Source: Aqua cloud native security platform, read . |
| Kubernetes runtime | Runtime enforcement for containers that blocks attacks without killing the container. Source: Aqua cloud native security platform, read . |
| Compliance reporting | Out-of-the-box compliance reporting, with built-in compliance and custom reports; the page does not list the frameworks. Source: Aqua pricing, read . |
| Public-sector authorization | States FedRAMP High Authorization. Source: Aqua cloud native security platform, read . |
| Open source | Trivy (maintained by Aqua Security, Apache-2.0) |
What does Aqua cost?
Not published No list prices. Cloud Security is priced by number of workloads (EC2 instances, Fargate containers, Lambda functions) and Dev Security by number of code repositories; request a trial or demo.
Source: Aqua pricing, read .
Where is Aqua strong, and where are its limits?
Strengths and limits come from the vendor's own pages and our sources; a limit can be something we did not find.
Strengths
- Kernel-layer enforcement that blocks an attack inside a container without killing the container.
- The only vendor here that describes support for disconnected (air-gapped) environments, and it states FedRAMP High Authorization.
- Maintains Trivy, so teams already scanning with Trivy can stay close to tooling they know.
Limits
- CIEM and DSPM are not described on the pages we read.
- No list prices: Cloud Security is priced by number of workloads, by quote.
What does Aqua say about itself?
Aqua says it serves "more than 500 of the world's largest enterprises".
Source: Aqua cloud native security platform, read .
What has Aqua announced recently?
22 Apr 2026
Announced Aqua Compass, an MCP server that lets AI agents investigate, contain and remediate runtime incidents with human oversight, and dashboards that express runtime risk as monetary exposure.
Source: Aqua press release: agentic response and runtime risk dashboards, read .
12 Feb 2026
Named a new leadership team and set out a focus on runtime exposure management.
Source: Aqua press release: new leadership and runtime focus, read .
Who should shortlist Aqua?
Consider Aqua if you run disconnected or private environments, or need FedRAMP High, or if you want enforcement inside containers and already use Trivy.
In our example finder profiles, Aqua is in the first group for: AWS and Azure, VMs and containers; Containers and code with Falco or Trivy; Public-sector with disconnected environments.
Run the finder with your answersHow does Aqua compare with each other vendor?
Frequently asked questions
Does Aqua need an agent?
Agentless parts, agent for depth. Offers agentless posture visibility; the platform's depth comes from kernel-layer enforcement on the workload.
Which clouds does Aqua name?
AWS, Azure, GCP, OCI and Alibaba. Aqua names AWS, Azure, GCP, Oracle and Alibaba Cloud environments, plus Kubernetes; its platform page also describes private cloud and disconnected environments.
Does Aqua publish its prices?
No list prices. Cloud Security is priced by number of workloads (EC2 instances, Fargate containers, Lambda functions) and Dev Security by number of code repositories; request a trial or demo.