How we make this list: we compare pricing pages, product documentation and public user reviews. Ratings come from G2, Capterra or Trustpilot, with the date we checked them.
Key takeaways
- Wiz is the market's reference platform, agentless scanning feeding a security graph that surfaces toxic combinations of risks, quote priced per workload, and since March 2026 owned by Google after its $32 billion acquisition closed.
- Orca Security is the agentless rival winning mid market deals, a single edition priced per workload, with buyer reported median spend around $95,000 to $100,000 a year in current comparisons.
- Palo Alto Networks folded Prisma Cloud into Cortex Cloud in 2026, betting its firewall and SOC customers will consolidate, on a credit based pricing model buyers consistently describe as the most complex here.
- Microsoft Defender for Cloud is the consumption priced native option, roughly $5 to $15 per server per month for its plans, and the rational default for an Azure first estate already paying Microsoft.
Quick comparison
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
#1Wiz
Best for: Agentless graph based risk priority4.7/5 on
G2 (863 reviews, checked Oct 2026)
Visit wiz.io
Starting priceSee website
Free planNo
Wiz won this category's mind by solving the alert problem honestly: instead of 1,200 check categories shouting at once, its graph asks which findings combine, a public workload, an over privileged identity, a path to sensitive data, and puts those toxic combinations at the top. That prioritisation is the AI that matters here, and it is why a three person cloud team can operate Wiz where a raw scanner would bury them.
The trade is price shape and the new ownership. Per workload metering means success, more cloud, is a bigger bill, and Google's $32 billion acquisition, closed in March 2026, makes Wiz a Google product sold into AWS and Azure estates; the company says multi cloud is the strategy, and contracts should be written so that stays true.
What we like- The platform that defined modern CNAPP: fully agentless scanning across AWS, Azure and Google Cloud, with a security graph that correlates configuration, identity, network and data risks into attack paths, native data security and AI security posture modules in current platform comparisons, buyer reported estimates start around $24,000 a year for 100 workloads, with median enterprise spend reported near $111,500
Watch out for- Quote only per workload pricing that grows with every resource you add, detection and visibility are its core
- Active runtime blocking is a newer sensor, not its founding strength, now owned by Google, which rival cloud estates should weigh in a long contract
Starting priceSee website
Free planNo
Orca and Wiz are the agentless pair, and Orca's argument is simplicity: one platform, one edition, deployed by lunchtime, scanning workloads, containers, identities and data stores without a single agent rollout project. Mid market security teams, who cannot staff a platform team, keep choosing it for exactly that.
The trade is the runtime boundary. Reading snapshots tells you what is vulnerable and exposed; it watches the estate rather than standing in it. Orca has been adding detection capability, but a buyer whose threat model centres on live runtime defence should benchmark Sysdig and CrowdStrike below with equal care.
What we like- The original agentless SideScanning approach: full workload visibility from cloud APIs and snapshot analysis, live in hours with nothing installed on hosts, a single edition rather than a module maze, which simplifies the quote, strong attack path and data security coverage rivalling Wiz in current comparisons, both rated 4.7 of 5 on G2 in 2026 checks
Watch out for- Quote based per workload pricing, with buyer reported medians near six figures, runtime protection is thinner than agent based rivals, its own sensor story is developing, at the very largest estates Wiz's graph depth and ecosystem still edge it
Starting priceSee website
Free planNo
Cortex Cloud is the consolidation bet: Palo Alto took Prisma Cloud's cloud security and merged it into its Cortex security operations platform, so the cloud findings and the SOC investigating them share a console. Its runtime defenders remain the strongest active blocking story among the big CNAPPs.
The trade is the credit meter and the gravity. Credits per module, per resource, negotiated annually, produce the category's least predictable bill, and the value case depends on already being a Palo Alto customer. Inside that estate the consolidation is rational; outside it, Wiz and Orca present a simpler argument.
What we like- Prisma Cloud's capabilities folded into Cortex Cloud in 2026: code to cloud coverage from source scanning to runtime protection with agent based defenders that can actively block, the deepest runtime enforcement in this list, one vendor relationship for Palo Alto firewall and SOC estates, credit pricing maps to protected resources across modules
Watch out for- Credit based pricing is consistently rated the most complex here, with buyer reported per credit figures varying by module, the platform's breadth makes implementation a programme, buyers outside the Palo Alto estate lose the consolidation logic that justifies it
Starting priceSee website
Free planNo
Defender for Cloud is the tool already in the building for most enterprises: the marginal cost of enabling it is small, the Azure integration is total, and its secure score gives leadership a number to watch. For an Azure centred estate, it is the baseline every third party tool must beat by a margin worth a second platform.
The trade is exactly that baseline status. Multi cloud estates consistently report the specialists seeing more and prioritising better, and Defender's pricing, a mosaic of per resource plans, can surprise at scale too. Treat it as the floor: enable it everywhere, then buy a specialist only for the gaps you can name.
What we like- Native to Azure, switched on in the portal, with posture management, workload protection and attack path analysis, extending to AWS and Google Cloud, consumption pricing, broadly $5 to $15 per server per month for defender plans in current comparisons, turns licences an E5 estate already owns into working cloud security, integrates with Sentinel for the SOC
Watch out for- Azure is plainly its first class citizen
- Multi cloud depth trails the specialists, the plan and pricing structure across dozens of defender sub plans takes real untangling, graph and prioritisation polish trail Wiz in comparisons
Starting priceSee website
Free planNo
CrowdStrike's cloud play is the platform argument: the agent already on every endpoint extends to servers and containers, the console the SOC already watches shows the cloud findings, and identity risk from both worlds correlates in one place. For its installed base, that continuity is worth real money.
The trade is architectural origin. Falcon thinks in agents; Wiz and Orca think in APIs and graphs, and on pure posture discovery across a sprawling multi cloud estate the born agentless tools still set the pace. CrowdStrike estates should start here; others should make it beat the specialists on evidence, not on brand.
What we like- One Falcon agent and one console from laptops to cloud workloads, which is a genuine operational simplification for CrowdStrike shops, strong runtime protection heritage from its endpoint detection core, cloud posture, identity and container coverage built onto that base
Watch out for- Quote based platform pricing with modules, the cloud posture depth of the agentless specialists is a newer layer on an agent first architecture, value concentrates in existing Falcon estates
- A greenfield cloud buyer compares it against tools born for the job
Starting priceSee website
Free planNo
Lacework's difference is epistemology: where rivals check configuration against known rules, Polygraph watches behaviour for the unknown wrong. In mature estates, that catches the compromised credential doing unusual things at unusual hours, which no CIS benchmark check will ever see.
The trade is patience. Behavioural systems begin noisy and earn their keep over a tuning quarter, and a small team wanting answers this week will prefer the graph tools' instant priorities. Under Fortinet, Lacework's future is a platform chapter; buyers should contract for the product they tested, with terms that survive repackaging.
What we like- Now Fortinet's FortiCNAPP, Lacework's founding idea is behavioural: its Polygraph learns what normal activity looks like across users, applications and processes, then flags the anomalies that rules cannot anticipate, agent and agentless coverage in one platform, the Fortinet relationship brings the network security estate with it
Watch out for- Quote based pricing, behavioural detection needs a learning period and tuning before its alerts earn trust, the change of ownership means roadmap and packaging questions for existing buyers, posture checklist depth is table stakes it matches rather than leads
Starting priceSee website
Free planNo
Sysdig answers the question the agentless tools cannot: not what could be attacked, but what is happening right now inside this container. Its Falco based detection sees processes, network calls and file access as they happen, which is the ground truth of an active compromise.
The trade is scope, by design. Sysdig is the runtime layer a CNAPP programme needs and not the whole programme; posture, identity and data security around it will come from its own modules or a partner platform. Container heavy estates should test it for the detection layer regardless of which posture platform they choose.
What we like- Built on Falco, the open source runtime detection standard Sysdig created, giving it the deepest Kubernetes and container runtime visibility here, real time detection grounded in system call level truth rather than snapshots, strong forensics: what the workload actually did, process by process, cloud posture included in its Secure platform
Watch out for- Quote based pricing, its centre of gravity is runtime, so posture breadth across the whole CNAPP checklist is narrower than Wiz or Cortex, Falco's openness means sophisticated teams can self build part of the value, which caps what the commercial platform can charge for
Starting priceSee website
Free planNo
Aqua is the supply chain conscience of this list. Its argument: most cloud compromises begin as an image, a dependency, a pipeline permission, long before runtime, and Aqua's tooling guards that chain, scanning, signing, gating, with Trivy's ubiquity as its credibility.
The trade is the generalist gap. An estate that is mostly virtual machines and managed services will find Aqua's container depth partly wasted, and the platform vendors cover its checklist items adequately. A container first estate with real supply chain exposure will find the reverse. Match the tool to where your workloads actually live.
What we like- A container security specialist covering the supply chain end to end: image scanning, pipeline gates, Kubernetes posture and runtime defence for containerised workloads, deep software supply chain features, SBOM and signing, that generalist platforms treat as checkboxes, a long open source footprint, Trivy, the widely used scanner, comes from Aqua
Watch out for- Quote based pricing, its breadth beyond containers and cloud native workloads is thinner than the platform vendors, in a consolidating market, standalone specialists face constant acquisition questions buyers should price into contract length
How we chose
We picked the platforms that define cloud protection in 2026 across the category's three architectures: agentless graph platforms, consolidated suites and runtime specialists, and weighted multi cloud coverage, prioritisation quality and pricing model clarity. Almost nothing in this category publishes a price; buyer reported figures from current comparisons are labelled as reported wherever they appear, and we did not claim hands-on testing. Market rankings and ratings cited are from the comparisons named in Sources, not our own scoring.
What the AI can and cannot do for your cloud
The genuine advance in these platforms is triage. A modern cloud estate generates thousands of findings; the graph based tools rank them by exploitability in context, exposed, privileged, next to valuable data, and that ranking is the difference between a backlog and a work queue. Data security modules extend the same logic to content, alerting on the bucket that is both public and full of personal data, not the empty one. AI security posture, the newest module class, inventories the AI services and agents an organisation has quietly deployed, a real and growing blind spot.
Now the limits, stated plainly. Detection is not remediation: someone must still rewrite the policy, rotate the key, rebuild the image, and the platforms' fix suggestions occasionally conflict with how the application actually works. Agentless scanning reads snapshots, so there is a window between scans where a new exposure is invisible; runtime tools close that window at the cost of agents to run. And every platform's risk score is a model, with false confidence in both directions; the toxic combination at the top of the list deserves verification before it becomes a Sev 1, because the business learns to ignore a tool that cries wolf in graph form.
Staffing is the final honesty. These tools reduce the people needed to find problems and increase the premium on people who can fix them. A CNAPP without an owner who works its queue daily becomes the most expensive screensaver in the security budget, a pattern the pricing teardown literature on this category describes with unusual bitterness. Buy the platform your team will actually operate, at the tier whose findings they can clear, and let coverage you cannot act on wait for the budget cycle that brings the engineer with it.
Frequently asked questions
What does CNAPP actually cover?
Cloud native application protection platform bundles the alphabet: posture management for misconfigurations, workload protection for servers and containers, identity risk analysis, data security posture, and increasingly AI security posture, in one platform with a shared risk graph. The consolidation is the point: findings that used to live in four tools now correlate in one queue.
Agentless or agent based, which is right?
Agentless deploys in hours and sees everything the cloud APIs can see, which is most posture risk; it is the correct start. Agents see inside the workload at runtime, processes, behaviour, live attacks, which posture tools cannot. Mature programmes run agentless everywhere and agents where runtime risk justifies them, critical production workloads first. The vendors' argument about which is enough is really an argument about your threat model.
How much do these platforms cost?
Almost none publish prices. Current buyer reported figures put Wiz from about $24,000 a year at 100 workloads with median enterprise spend near $111,500, Orca's median near $95,000 to $100,000, and Prisma's successor on a per credit model buyers describe as complex. Microsoft Defender is the exception, with consumption pricing per protected resource. Treat every number as a negotiation anchor, not a quote.
Can one of these tools replace our cloud security team?
No. It can replace the team's spreadsheet era: manual configuration review, spreadsheet risk registers, blind spots between quarterly audits. The team that remains does harder and better work, remediation, architecture, response. A platform bought to avoid hiring usually ends as shelfware with a graph on it; a platform bought to aim a small team is the category's real success story.
Does the Wiz acquisition by Google change the buying decision?
It changes the questions, not the product's current standing. Wiz remains the reference platform and states multi cloud support as its strategy. Buyers on AWS or Azure should ask for contractual clarity on roadmap, data handling and term protection, as they should after any acquisition, and note that rival vendors will use the deal against it in every sales cycle this year.
Sources we checked (0)
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Shihab Mia · Founder, Rankite
Shihab has 5+ years in B2B and SaaS SEO. He writes Rankite's software buying guides from pricing pages, documentation and public user reviews. More about Shihab.
Orca Security
Cortex Cloud
Microsoft Defender for Cloud
CrowdStrike Falcon Cloud Security
Lacework FortiCNAPP
Sysdig
Aqua Security