Color: Blue team.
What Is This Category?
Mix (12 tools)
- License: 7 open source · 5 proprietary
- Hosting: 7 self-hosted · 4 SaaS · 1 both
Continuous misconfiguration / compliance / identity / data / workload posture assessment across cloud accounts, Kubernetes clusters, and SaaS apps.
Cloud-Native Application Protection Platform (CNAPP) is Gartner’s consolidation term for what used to be five separate categories: CSPM (cloud-config misconfig), CWPP (workload protection), KSPM (Kubernetes), CIEM (cloud-identity entitlement), and IaC scanning (Terraform / CloudFormation). The category exists because every internet-exposed S3 bucket / public IAM role / kubelet anonymous-auth misconfiguration is now the dominant attack vector for cloud-native workloads.
Distinct from neighbouring categories
- Vulnerability Management – VM scans known assets for CVEs; CNAPP scans cloud accounts and Kubernetes clusters for misconfiguration and over-permissive identity
- Configuration Management & IaC – Config- mgmt enforces desired state on hosts; CNAPP evaluates the cloud control-plane and IaC templates
- GRC & Compliance – GRC tracks compliance across a programme; CNAPP feeds it the live cloud evidence
- Container Runtime Security – runtime threat detection inside containers; CNAPP is the static / posture-side, container- runtime is the live-syscall-detection side
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Overview
CNAPP is a multi-layer category. No single tool is the “right” answer – the question is which OSS scanners
- which commercial platform fit the customer’s cloud footprint, compliance posture, and budget. The OSS stack (Prowler + Kubescape + Checkov + Cloud Custodian) covers most of the CSPM / KSPM / IaC / enforcement needs at zero license cost; the commercial CNAPPs (Wiz, Orca, Lacework FortiCNAPP, Prisma Cloud, Defender for Cloud) add the unified-graph UX, agentless workload-side scanning, and the managed-service tier.
CNAPP Pillar Coverage
What each tool actually covers across the CNAPP pillars.
| Tool | CSPM | CWPP | KSPM | DSPM | CIEM | IaC |
|---|---|---|---|---|---|---|
| Prowler | yes | – | partial | – | partial | – |
| ScoutSuite | yes | – | – | – | – | – |
| CloudSploit | yes | – | partial | – | – | – |
| Kubescape | – | – | yes | – | – | yes |
| Checkov | – | – | – | – | – | yes |
| Cloud Custodian | yes* | – | – | – | – | – |
| Steampipe | yes** | – | yes** | – | yes** | – |
| Wiz | yes | yes | yes | yes | yes | yes |
| Orca Security | yes | yes | yes | yes | yes | yes |
| Lacework FortiCNAPP | yes | yes | yes | partial | yes | – |
| Prisma Cloud | yes | yes | yes | yes | yes | yes |
| Defender for Cloud | yes | yes | yes | partial | yes | – |
* Cloud Custodian’s role is policy-enforcement, not just scanning. Findings come from the policies an operator writes; coverage is whatever the team authors.
** Steampipe’s pillar coverage is via the steampipe-mod-* compliance mods rather than out-of-the-box behaviour.
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| Prowler | Apache-2.0 | yes | OSS CLI |
| ScoutSuite | GPL-2.0-only | yes | OSS CLI |
| CloudSploit | GPL-3.0-only | yes | OSS CLI |
| Kubescape | Apache-2.0 | yes | OSS CLI / operator |
| Checkov | Apache-2.0 | yes | OSS CLI |
| Cloud Custodian | Apache-2.0 | yes | OSS policy engine |
| Steampipe | AGPL-3.0-only | yes | OSS query engine |
| Wiz | Proprietary | – | SaaS CNAPP |
| Orca Security | Proprietary | – | SaaS CNAPP |
| Lacework FortiCNAPP | Proprietary | – | SaaS CNAPP |
| Prisma Cloud | Proprietary | – | SaaS + agent CNAPP |
| Defender for Cloud | Proprietary | – | SaaS CNAPP (MS) |
Cloud Provider Coverage
| Tool | AWS | Azure | GCP | OCI | Alibaba | K8s |
|---|---|---|---|---|---|---|
| Prowler | yes | yes | yes | – | – | yes |
| ScoutSuite | yes | yes | yes | yes | yes | – |
| CloudSploit | yes | yes | yes | yes | yes | – |
| Kubescape | n/a | n/a | n/a | n/a | n/a | yes |
| Checkov | yes | yes | yes | yes | yes | yes |
| Cloud Custodian | yes | yes | yes | – | – | yes |
| Steampipe | yes | yes | yes | yes | yes | yes |
| Wiz | yes | yes | yes | yes | – | yes |
| Orca Security | yes | yes | yes | yes | – | yes |
| Lacework FortiCNAPP | yes | yes | yes | yes | – | yes |
| Prisma Cloud | yes | yes | yes | yes | yes | yes |
| Defender for Cloud | yes | yes | yes | – | – | yes |
SSO / OIDC
The OSS CLIs have no auth surface of their own – they consume cloud SDK credentials. Auth questions apply only to the SaaS CNAPPs.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| OSS CLIs (7 of 12) | n/a | n/a | n/a | Cloud SDK creds gate access |
| Wiz | paid | paid | paid | Enterprise tier |
| Orca Security | paid | paid | paid | Enterprise tier |
| Lacework FortiCNAPP | paid | paid | paid | Enterprise tier |
| Prisma Cloud | paid | paid | paid | Enterprise tier |
| Defender for Cloud | native | native | native | Entra-native (the customer’s tenant) |
Deployment Comparison
| Tool | Deployment | Resources | Privileges |
|---|---|---|---|
| Prowler | pip / Docker / brew | trivial | Read-only IAM role per cloud |
| ScoutSuite | pip / Docker | trivial | Read-only IAM role |
| CloudSploit | npm / Docker | trivial | Read-only IAM role |
| Kubescape | Go binary / Helm operator | low | kubeconfig (cluster-reader) |
| Checkov | pip / Docker / brew | trivial | none (scans files) |
| Cloud Custodian | pip / Lambda | low | Per-policy IAM (often write) |
| Steampipe | Go binary | low | Cloud SDK creds |
| Wiz | SaaS | – | Cloud-side IAM role per account |
| Orca Security | SaaS | – | Cloud-side IAM role per account |
| Lacework FortiCNAPP | SaaS + workload agent | low | IAM role + lightweight agent |
| Prisma Cloud | SaaS + Twistlock Defenders | medium | IAM + per-host agent |
| Defender for Cloud | SaaS (Azure portal) | – | Entra subscription + (optional) Defender agents |
Composition Patterns
Three canonical CNAPP pipelines built from these tools.
1. OSS-only stack (zero license cost)
Prowler -- weekly cloud-wide compliance scan Kubescape -- daily Kubernetes posture Checkov -- on-PR IaC scan in CI Cloud Custodian -- continuous policy enforcement
Output: full CSPM / KSPM / IaC / enforcement coverage on AWS / Azure / GCP / Kubernetes without any commercial license.
2. Commercial CNAPP with OSS shift-left
Wiz (or Orca) -- continuous CSPM + CWPP + DSPM + CIEM Checkov -- on-PR IaC scan (still OSS) Kubescape -- in-cluster admission policy
Output: managed continuous CNAPP plus shift-left OSS guardrails. Standard pattern for managed customers in production.
3. Microsoft-aligned stack
Defender for Cloud -- foundational free + paid tiers Checkov -- IaC scan in Azure DevOps Cloud Custodian -- Azure Function-driven policy enforcement
Output: full CNAPP for Microsoft-heavy customers inside the Azure / Entra ecosystem.
Cost Tier
Rough TCO for a 1000-resource cloud footprint.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Prowler + Kubescape + Checkov + Cloud Custodian | $0 + operator time |
| Mid | Defender for Cloud (foundational free + Servers plan) | $5-15 per resource per month |
| High | Wiz / Orca / Prisma Cloud / Lacework | $20-50 per resource per month + Enterprise contract |
Tools
12 tools.
Checkov
Infrastructure-as-code static analysis from Bridgecrew (Palo Alto Prisma Cloud); Terraform / CloudFormation / Helm / Kubernetes / Dockerfile.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
Cloud Custodian
Stackset-style YAML-policy enforcement engine for AWS / Azure / GCP; created by Capital One, now CNCF.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
CloudSploit
Open-source cloud security scanner now maintained by Aqua Security; AWS, Azure, GCP, OCI, Alibaba, GitHub.
License: GPL-3.0-only (OSS) · Kind: cli · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
Kubescape
Kubescape is a CNCF-incubating open-source Kubernetes security scanner from ARMO that checks clusters, manifests, Helm charts, and images against frameworks like NSA/CISA, MITRE ATT&CK, and CIS.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: direct, docker, k8s, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
Lacework FortiCNAPP
CNAPP focused on behavioural anomaly detection; acquired by Fortinet in 2024 and rebranded FortiCNAPP.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Microsoft Defender for Cloud
Microsoft’s CNAPP integrated into the Azure portal; multi-cloud (AWS / GCP) scanning from the Defender XDR fabric.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Orca Security
Cloud-side agentless CNAPP with SideScanning (TM); Wiz’s principal competitor in the agentless CNAPP market.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Prisma Cloud
Palo Alto Networks’ CNAPP combining Twistlock (CWPP) + Bridgecrew (IaC) + RedLock (CSPM) into one platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Prowler
Open-source multi-cloud security and compliance assessment tool; 400+ checks across AWS, Azure, GCP, M365, Kubernetes.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
ScoutSuite
Multi-cloud security auditing tool from NCC Group; AWS, Azure, GCP, OCI, Alibaba; HTML report output.
License: GPL-2.0-only (OSS) · Kind: cli · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
Steampipe
SQL queries against cloud APIs from Turbot; AWS / Azure / GCP / 140+ providers exposed as PostgreSQL tables.
License: AGPL-3.0-only (OSS) · Kind: cli · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
Wiz
Agentless CNAPP and the current market reference; cloud-side scanning of every layer (config, identity, secrets, vulns, runtime).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
