License & Deployment Mix: 12 tools – 7 OSS, 5 commercial SaaS.
Color: Blue team.
What Is This Category?
Continuous misconfiguration / compliance / identity / data / workload posture assessment across cloud accounts, Kubernetes clusters, and SaaS apps.
Cloud-Native Application Protection Platform (CNAPP) is Gartner’s consolidation term for what used to be five separate categories: CSPM (cloud-config misconfig), CWPP (workload protection), KSPM (Kubernetes), CIEM (cloud-identity entitlement), and IaC scanning (Terraform / CloudFormation). The category exists because every internet-exposed S3 bucket / public IAM role / kubelet anonymous-auth misconfiguration is now the dominant attack vector for cloud-native workloads.
Distinct from neighbouring categories
- Vulnerability Management – VM scans known assets for CVEs; CNAPP scans cloud accounts and Kubernetes clusters for misconfiguration and over-permissive identity
- Configuration Management & IaC – Config- mgmt enforces desired state on hosts; CNAPP evaluates the cloud control-plane and IaC templates
- GRC & Compliance – GRC tracks compliance across a programme; CNAPP feeds it the live cloud evidence
- Container Runtime Security – runtime threat detection inside containers; CNAPP is the static / posture-side, container- runtime is the live-syscall-detection side
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Overview
CNAPP is a multi-layer category. No single tool is the “right” answer – the question is which OSS scanners
- which commercial platform fit the customer’s cloud footprint, compliance posture, and budget. The OSS stack (Prowler + Kubescape + Checkov + Cloud Custodian) covers most of the CSPM / KSPM / IaC / enforcement needs at zero license cost; the commercial CNAPPs (Wiz, Orca, Lacework FortiCNAPP, Prisma Cloud, Defender for Cloud) add the unified-graph UX, agentless workload-side scanning, and the managed-service tier.
CNAPP Pillar Coverage
What each tool actually covers across the CNAPP pillars.
| Tool | CSPM | CWPP | KSPM | DSPM | CIEM | IaC |
|---|---|---|---|---|---|---|
| Prowler | yes | – | partial | – | partial | – |
| ScoutSuite | yes | – | – | – | – | – |
| CloudSploit | yes | – | partial | – | – | – |
| Kubescape | – | – | yes | – | – | yes |
| Checkov | – | – | – | – | – | yes |
| Cloud Custodian | yes* | – | – | – | – | – |
| Steampipe | yes** | – | yes** | – | yes** | – |
| Wiz | yes | yes | yes | yes | yes | yes |
| Orca Security | yes | yes | yes | yes | yes | yes |
| Lacework FortiCNAPP | yes | yes | yes | partial | yes | – |
| Prisma Cloud | yes | yes | yes | yes | yes | yes |
| Defender for Cloud | yes | yes | yes | partial | yes | – |
* Cloud Custodian’s role is policy-enforcement, not just scanning. Findings come from the policies an operator writes; coverage is whatever the team authors.
** Steampipe’s pillar coverage is via the steampipe-mod-* compliance mods rather than out-of-the-box behaviour.
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| Prowler | Apache-2.0 | yes | OSS CLI |
| ScoutSuite | GPL-2.0-only | yes | OSS CLI |
| CloudSploit | GPL-3.0-only | yes | OSS CLI |
| Kubescape | Apache-2.0 | yes | OSS CLI / operator |
| Checkov | Apache-2.0 | yes | OSS CLI |
| Cloud Custodian | Apache-2.0 | yes | OSS policy engine |
| Steampipe | AGPL-3.0-only | yes | OSS query engine |
| Wiz | Proprietary | – | SaaS CNAPP |
| Orca Security | Proprietary | – | SaaS CNAPP |
| Lacework FortiCNAPP | Proprietary | – | SaaS CNAPP |
| Prisma Cloud | Proprietary | – | SaaS + agent CNAPP |
| Defender for Cloud | Proprietary | – | SaaS CNAPP (MS) |
Cloud Provider Coverage
| Tool | AWS | Azure | GCP | OCI | Alibaba | K8s |
|---|---|---|---|---|---|---|
| Prowler | yes | yes | yes | – | – | yes |
| ScoutSuite | yes | yes | yes | yes | yes | – |
| CloudSploit | yes | yes | yes | yes | yes | – |
| Kubescape | n/a | n/a | n/a | n/a | n/a | yes |
| Checkov | yes | yes | yes | yes | yes | yes |
| Cloud Custodian | yes | yes | yes | – | – | yes |
| Steampipe | yes | yes | yes | yes | yes | yes |
| Wiz | yes | yes | yes | yes | – | yes |
| Orca Security | yes | yes | yes | yes | – | yes |
| Lacework FortiCNAPP | yes | yes | yes | yes | – | yes |
| Prisma Cloud | yes | yes | yes | yes | yes | yes |
| Defender for Cloud | yes | yes | yes | – | – | yes |
SSO / OIDC
The OSS CLIs have no auth surface of their own – they consume cloud SDK credentials. Auth questions apply only to the SaaS CNAPPs.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| OSS CLIs (7 of 12) | n/a | n/a | n/a | Cloud SDK creds gate access |
| Wiz | paid | paid | paid | Enterprise tier |
| Orca Security | paid | paid | paid | Enterprise tier |
| Lacework FortiCNAPP | paid | paid | paid | Enterprise tier |
| Prisma Cloud | paid | paid | paid | Enterprise tier |
| Defender for Cloud | native | native | native | Entra-native (the customer’s tenant) |
Deployment Comparison
| Tool | Deployment | Resources | Privileges |
|---|---|---|---|
| Prowler | pip / Docker / brew | trivial | Read-only IAM role per cloud |
| ScoutSuite | pip / Docker | trivial | Read-only IAM role |
| CloudSploit | npm / Docker | trivial | Read-only IAM role |
| Kubescape | Go binary / Helm operator | low | kubeconfig (cluster-reader) |
| Checkov | pip / Docker / brew | trivial | none (scans files) |
| Cloud Custodian | pip / Lambda | low | Per-policy IAM (often write) |
| Steampipe | Go binary | low | Cloud SDK creds |
| Wiz | SaaS | – | Cloud-side IAM role per account |
| Orca Security | SaaS | – | Cloud-side IAM role per account |
| Lacework FortiCNAPP | SaaS + workload agent | low | IAM role + lightweight agent |
| Prisma Cloud | SaaS + Twistlock Defenders | medium | IAM + per-host agent |
| Defender for Cloud | SaaS (Azure portal) | – | Entra subscription + (optional) Defender agents |
Composition Patterns
Three canonical CNAPP pipelines built from these tools.
1. OSS-only stack (zero license cost)
Prowler -- weekly cloud-wide compliance scan Kubescape -- daily Kubernetes posture Checkov -- on-PR IaC scan in CI Cloud Custodian -- continuous policy enforcement
Output: full CSPM / KSPM / IaC / enforcement coverage on AWS / Azure / GCP / Kubernetes without any commercial license.
2. Commercial CNAPP with OSS shift-left
Wiz (or Orca) -- continuous CSPM + CWPP + DSPM + CIEM Checkov -- on-PR IaC scan (still OSS) Kubescape -- in-cluster admission policy
Output: managed continuous CNAPP plus shift-left OSS guardrails. Standard pattern for managed customers in production.
3. Microsoft-aligned stack
Defender for Cloud -- foundational free + paid tiers Checkov -- IaC scan in Azure DevOps Cloud Custodian -- Azure Function-driven policy enforcement
Output: full CNAPP for Microsoft-heavy customers inside the Azure / Entra ecosystem.
Cost Tier
Rough TCO for a 1000-resource cloud footprint.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Prowler + Kubescape + Checkov + Cloud Custodian | $0 + operator time |
| Mid | Defender for Cloud (foundational free + Servers plan) | $5-15 per resource per month |
| High | Wiz / Orca / Prisma Cloud / Lacework | $20-50 per resource per month + Enterprise contract |
Tools
12 tools.
Checkov
Infrastructure-as-code static analysis from Bridgecrew (Palo Alto Prisma Cloud); Terraform / CloudFormation / Helm / Kubernetes / Dockerfile.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
Cloud Custodian
Stackset-style YAML-policy enforcement engine for AWS / Azure / GCP; created by Capital One, now CNCF.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
CloudSploit
Open-source cloud security scanner now maintained by Aqua Security; AWS, Azure, GCP, OCI, Alibaba, GitHub.
License: GPL-3.0-only (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
Kubescape
Kubescape is a CNCF-incubating open-source Kubernetes security scanner from ARMO that checks clusters, manifests, Helm charts, and images against frameworks like NSA/CISA, MITRE ATT&CK, and CIS.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: native, docker, k8s, package · SSO: none
Lacework FortiCNAPP
CNAPP focused on behavioural anomaly detection; acquired by Fortinet in 2024 and rebranded FortiCNAPP.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Microsoft Defender for Cloud
Microsoft’s CNAPP integrated into the Azure portal; multi-cloud (AWS / GCP) scanning from the Defender XDR fabric.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Orca Security
Cloud-side agentless CNAPP with SideScanning (TM); Wiz’s principal competitor in the agentless CNAPP market.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Prisma Cloud
Palo Alto Networks’ CNAPP combining Twistlock (CWPP) + Bridgecrew (IaC) + RedLock (CSPM) into one platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: OIDC, SAML
Prowler
Open-source multi-cloud security and compliance assessment tool; 400+ checks across AWS, Azure, GCP, M365, Kubernetes.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
ScoutSuite
Multi-cloud security auditing tool from NCC Group; AWS, Azure, GCP, OCI, Alibaba; HTML report output.
License: GPL-2.0-only (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
Steampipe
SQL queries against cloud APIs from Turbot; AWS / Azure / GCP / 140+ providers exposed as PostgreSQL tables.
License: AGPL-3.0-only (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
Wiz
Agentless CNAPP and the current market reference; cloud-side scanning of every layer (config, identity, secrets, vulns, runtime).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
