# An agent on a laptop and an agent on a container are not the same problem. Most endpoint vendors sell you the former and call it cloud security.

*Cloud & Workload Security — a TechBag decision guide. Last reviewed 2026-10-21.*

> Cloud security is two purchases wearing one name: **posture** — what is misconfigured, over-privileged or vulnerable across your accounts, read agentlessly from APIs — and **protection** — something running on the workload or in the cluster that can block and respond. Every vendor sells one well and the other as a module.

**The checkable fact:** Tenable Cloud Security is 100% agentless by design and provides no runtime protection. Wiz Defend needs the Wiz Sensor to act at runtime. Same category; opposite halves.

- Canonical: https://www.thetechbag.com/browse/security/cloud-workload-security
- Category: [Security](https://www.thetechbag.com/browse/security)
- Products compared: 19

## What cloud & workload security actually is

Your workloads are in someone else’s data centre, built by engineers, changed by pipelines, and exposed by configuration rather than by malware. Two disciplines grew up around that. **Posture** reads your cloud accounts through their APIs — with no agent — and finds misconfiguration, vulnerable images, over-privileged identities and the paths that join them. **Workload protection** runs on the VM, the container host or in the Kubernetes cluster and can block, isolate and respond at runtime.

The market has stitched them into one word, CNAPP — but every product here has a home half. The agentless specialists (Wiz, Tenable, Check Point) are posture-first and add runtime by module or agent; the endpoint vendors (CrowdStrike, SentinelOne, Trend, Sophos, Bitdefender, Kaspersky) are runtime-first and add posture by acquisition; the vulnerability vendors (Qualys, Tenable) extend their risk model into the cloud. Knowing which half a vendor was born in tells you where its depth is.

**The most common mis-purchase.** A **laptop agent** watches one user’s machine; a **workload sensor** must survive immutable images, autoscaling, ephemeral containers and Kubernetes admission — and often is not allowed at all. Ask every endpoint vendor how their cloud product works *without* their agent; ask every agentless vendor what happens *at runtime*.

## CSPM vs CWPP vs CIEM vs CNAPP

Four acronyms this buyer confuses, and nothing more. Three are scopes; the fourth is the bundle. None is a tier of quality — each adds something to read or run, costs more, and needs more owners on your side.

### CSPM — Cloud Security Posture Management

Reads your cloud accounts through their APIs and finds misconfiguration, exposure and drift against benchmarks — agentless by nature. The foundation, and the half the agentless specialists were born in. Finds; does not block.

### CWPP — Cloud Workload Protection Platform

Runs on the VM, the container host or in the cluster: vulnerability and malware detection, runtime behaviour, blocking and response. The half the endpoint vendors were born in. Needs something installed — a sensor, an agent, an admission controller.

### CIEM — Cloud Infrastructure Entitlement Management

Who (human or machine) can do what, to which resource, across accounts — effective permissions, toxic combinations, least-privilege recommendations. Identity is the cloud's perimeter; CIEM is the only scope that reads it. Agentless; findings need an owner in the platform team.

### CNAPP — Cloud-Native Application Protection Platform

The bundle: CSPM + CWPP + CIEM, usually plus code / IaC scanning and data posture, on one risk graph. Not a product you can buy whole from most vendors — it is the label on whichever half they started with plus the modules they added.

**Scopes, not tiers.** CSPM reads, CWPP runs, CIEM reads identity, CNAPP is the label for all of them together. Each adds cost and an owner; the posture-only buyer and the runtime-only buyer are both buying half — deliberately is fine, by accident is the failure mode of this category.

## The decision variables

Six variables decide this purchase. The instrument tests posture-vs-runtime, agentless-vs-agent, CIEM, code scanning, on-prem coverage and the small-estate floor; cloud depth and container depth are prose because every datasheet lists all three clouds and every product scans images.

**CSPM vs CWPP vs CIEM vs code — what's actually included.** Every vendor sells the bundle name; the chips name which scopes each SKU actually contains, and which are separate modules.

**Agentless vs agent-based vs both.** Agentless reads accounts in hours with nothing installed and cannot block; agents run on the workload and can. Most vendors now do both — the chip shows which side is native.

**Which clouds are genuinely covered at depth.** All list AWS, Azure, GCP; depth follows where each vendor's customers live. Ask for the supported-services list per cloud and test your smallest one.

**Container and Kubernetes depth.** Image scanning is universal; admission control and in-cluster runtime are not. Kaspersky Container Security, Wiz Defend, CrowdStrike, SentinelOne, Trend, FortiCNAPP, Check Point and Qualys document runtime.

**Shift-left / IaC scanning.** Terraform, CloudFormation, Kubernetes manifests and images scanned in CI, tied to the production graph — only worth it if engineering wires the gate in.

**Runtime protection vs posture only.** The honest split: Tenable and the Wiz posture modules never block; the endpoint-heritage vendors and Wiz Defend do. Buying half is fine if you know which half.

## The 19 products

Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one.

### Wiz CSPM (Wiz Essential / Advanced) — Wiz

- **Who it's for:** The agentless reference: posture, vulnerabilities and attack paths across AWS, Azure and GCP in hours, with no agent — and the Security Graph everyone else now copies.
- **The honest limitation:** Posture SKU — runtime protection is Wiz Defend with the Sensor, and CIEM, Code and DSPM are separate modules; reported minimums rule out very small estates; India region not documented.
- **Price:** ~$15–30 (≈ ₹1,245) — per workload / year reported under 500 workloads (Essential ~$24k / yr for 100; $8–20 at 2,000–10,000; $6–15 above); agentless snapshot scanning; Google-owned (2026)
- **Details:** https://www.thetechbag.com/wiz/wiz-cspm

### Wiz CIEM — Wiz

- **Who it's for:** Wiz estates that need to know which identity can reach which data, and what to take away.
- **The honest limitation:** A module over Wiz's graph — not standalone; findings need an owner or they age.
- **Price:** Module — add-on module to Wiz — identities, entitlements, effective permissions, least-privilege recommendations
- **Details:** https://www.thetechbag.com/wiz/wiz-ciem

### Wiz Code — Wiz

- **Who it's for:** Teams fixing cloud risk in the pull request rather than in production.
- **The honest limitation:** A module; useful only with engineering adoption; priced as an enterprise add-on.
- **Price:** Module — add-on (reported ~$58,500 / yr) — IaC, container images, secrets and code-to-cloud tracing in CI
- **Details:** https://www.thetechbag.com/wiz/wiz-code

### Wiz Defend (runtime, with Wiz Sensor) — Wiz

- **Who it's for:** Wiz estates that need runtime detection and response, not just a prioritised posture list.
- **The honest limitation:** Needs the Sensor on the workloads — the agentless story ends here; on-prem coverage not documented; priced as modules on top of Wiz.
- **Price:** Module — add-on (reported ~$18,000 / yr) + Wiz Sensor (eBPF, reported ~$28,000 / yr) — cloud detection and response on running workloads and Kubernetes
- **Details:** https://www.thetechbag.com/wiz/wiz-defend

### Wiz DSPM — Wiz

- **Who it's for:** Wiz estates that want the sensitive data in the graph next to the path to it.
- **The honest limitation:** Data posture, not data protection — it finds and ranks; it does not encrypt or block; a module.
- **Price:** Module — add-on — data discovery and classification in cloud stores, joined to exposure paths
- **Details:** https://www.thetechbag.com/wiz/wiz-dspm

### Check Point CloudGuard CNAPP — Check Point

- **Who it's for:** Check Point estates wanting a prevention-first CNAPP — posture, entitlements and code scanning agentless, runtime where you deploy agents.
- **The honest limitation:** Quote-only consumption pricing; depth of runtime is agent-dependent; India region not documented.
- **Price:** Quote — consumption-based per billable asset; Agentless Workload Posture (AWP), CIEM, Effective Risk Management, pipeline security; runtime via workload agents
- **Details:** https://www.thetechbag.com/checkpoint/checkpoint-cloudguard-cnapp

### Qualys TotalCloud — Qualys

- **Who it's for:** Qualys estates extending VMDR's TruRisk into cloud posture, workload protection and IaC — one tenant for hosts and clouds.
- **The honest limitation:** Quote-only on two meters; strongest for Qualys customers; CIEM is newer than the rest of the suite.
- **Price:** Quote — per cloud connector (CSPM) + per workload (CWPP); FlexScan agent and agentless; TruRisk scoring; India platform
- **Details:** https://www.thetechbag.com/qualys/qualys-totalcloud

### Tenable Cloud Security — Tenable

- **Who it's for:** Tenable estates — and anyone who wants posture, entitlements and vulnerabilities with nothing installed — and accepts there is no runtime blocking.
- **The honest limitation:** Posture only by design: 100% agentless means no runtime protection on the workload; quote-only; India region not documented.
- **Price:** Quote — per billable resource (VMs, container hosts, functions, images, data stores); 100% agentless; CSPM + CIEM (Ermetic lineage) + vulnerability + IaC
- **Details:** https://www.thetechbag.com/tenable/tenable-cloud-security

### Trend Vision One Cloud Security — Trend Micro

- **Who it's for:** Trend estates — including on-prem VMware servers — wanting posture and agent-based runtime in the same XDR as endpoint and email.
- **The honest limitation:** Credit-priced and opaque until you run it; CIEM depth not documented; strongest inside Vision One.
- **Price:** Credits — Vision One credits — Conformity posture (agentless), workload protection agents (Deep Security lineage), container security, template scanning
- **Details:** https://www.thetechbag.com/trendmicro/trendmicro-cloud-security

### Fortinet FortiCNAPP (Lacework) — Fortinet

- **Who it's for:** Fortinet estates — and Lacework's behavioural-anomaly fans — wanting a CNAPP with a published starter price.
- **The honest limitation:** A starter-pack floor, then quote; on-prem coverage via the agent is not documented here; India region not documented.
- **Price:** from ~$25,000 (≈ ₹20,75,000) — per year starter pack (annual or BYOL); agentless + Lacework agent; CSPM, CIEM, CWPP, code; Security Fabric integration
- **Details:** https://www.thetechbag.com/fortinet/fortinet-forticnapp

### Bitdefender GravityZone Cloud Security (CSPM+) — Bitdefender

- **Who it's for:** GravityZone estates adding cloud posture to the workload protection they already run on VMs and containers, cloud or on-prem.
- **The honest limitation:** CIEM and code scanning are not documented; quote-only; cloud posture is newer than the workload protection.
- **Price:** Quote — CSPM+ (agentless posture) per account; workload and container protection via GravityZone agents incl. on-prem virtualised servers
- **Details:** https://www.thetechbag.com/bitdefender/bitdefender-cloud-security

### SentinelOne Singularity Cloud Security — SentinelOne

- **Who it's for:** SentinelOne estates wanting agentless posture plus the Singularity agent's runtime on servers and Kubernetes, with an India region.
- **The honest limitation:** Quote-only; CNAPP breadth is newer than the endpoint heritage; strongest when SentinelOne is already the agent.
- **Price:** Quote — agentless CNAPP (PingSafe lineage) + Cloud Workload Security agent; CSPM, CIEM, IaC, Kubernetes runtime; Mumbai region
- **Details:** https://www.thetechbag.com/sentinelone/sentinelone-singularity-cloud-security

### CrowdStrike Falcon Cloud Security — CrowdStrike

- **Who it's for:** Falcon estates that want the sensor's runtime on servers and containers plus agentless posture in the same console as endpoint.
- **The honest limitation:** Quote-only; agentless is a fallback for where the sensor cannot go, not the design centre; India in-country cloud announced, not yet documented live.
- **Price:** Quote — Falcon sensor for workload protection + agentless snapshot scanning; CSPM, CIEM, IaC, cloud detection and response; quote-only
- **Details:** https://www.thetechbag.com/crowdstrike/crowdstrike-falcon-cloud-security

### Kaspersky Hybrid Cloud Security — Kaspersky

- **Who it's for:** Estates that want agent-based workload protection across private and public clouds from one console, including VMware and OpenStack.
- **The honest limitation:** Workload protection, not a CNAPP — no CSPM, CIEM or code scanning; procurement caveats in some sectors; quote-only.
- **Price:** Quote — per node (VM / server), agent-based; VMware, Hyper-V, OpenStack and AWS / Azure / GCP workloads
- **Details:** https://www.thetechbag.com/kaspersky/kaspersky-hybrid-cloud-security

### Kaspersky Container Security — Kaspersky

- **Who it's for:** Kubernetes estates — on-prem included — wanting image, admission and runtime security from one vendor.
- **The honest limitation:** Containers only; no cloud posture or entitlements; procurement caveats; quote-only.
- **Price:** Quote — per node; image scanning in CI / registry, admission control, runtime for Kubernetes on-prem or in cloud
- **Details:** https://www.thetechbag.com/kaspersky/kaspersky-container-security

### Sophos Cloud Native Security — Sophos

- **Who it's for:** Sophos Central estates that want server runtime (Intercept X) and cloud posture (Cloud Optix) beside their MDR — and a published PAYG meter.
- **The honest limitation:** Posture depth trails the agentless specialists; PAYG rates are on the marketplace, not a list; strongest inside Sophos.
- **Price:** PAYG — per user and per server, pay-as-you-go on AWS Marketplace or via partners; Intercept X for Server runtime + Cloud Optix posture / IAM visualisation / IaC; Sophos Central (Mumbai region)
- **Details:** https://www.thetechbag.com/sophos/sophos-cloud-native-security

### Carbon Black Workload (Broadcom) — Broadcom

- **Who it's for:** Data centres running vSphere that want server and VM protection with visibility of every unprotected VM.
- **The honest limitation:** Built around vSphere and servers rather than cloud posture or CIEM; the newest official videos are from 2023 and no Indian region is documented.
- **Price:** Quote — quoted; workload protection for servers and VMs with a sensor plus a vSphere appliance that lists unprotected VMs, CIS benchmarking and Live Query
- **Details:** https://www.thetechbag.com/broadcom/broadcom-carbon-black-workload

### Delinea Privilege Control for Cloud Entitlements — Delinea

- **Who it's for:** PAM-led estates that want cloud entitlements discovered and cut back by the same vendor that vaults their admin accounts.
- **The honest limitation:** Entitlement posture only: no workload runtime protection and no vulnerability or IaC scanning, so it is not a CNAPP. Three public clouds only, and how it connects is not stated.
- **Price:** Quote — quote-only with a 30-day trial; cloud entitlement management for AWS, Azure and GCP with Continuous Identity Discovery of human, machine and AI identities, shadow admins and stale accounts
- **Details:** https://www.thetechbag.com/delinea/delinea-privilege-control-for-cloud-entitlements

### Darktrace Cloud — Darktrace

- **Who it's for:** Teams that want behavioural cloud detection and response across AWS, Azure and GCP in the same model as their Darktrace network and email coverage, rather than a posture-first CNAPP.
- **The honest limitation:** Detection-and-response first: posture is a limited version of Proactive Exposure Management and no IaC or pipeline scanning is documented, so it is not a Wiz or CloudGuard substitute. Hosted in AWS in the EU, US, Canada, Singapore or Australia (Azure adds Japan) — no India region. Quote-only.
- **Price:** Quote — metered on an Identity Workload count (cloud identities plus weighted workloads); agentless enumeration through cloud APIs and logs, with optional vSensors, osSensors and containerSensors; cloud detection and response with autonomous actions, plus limited exposure management
- **Details:** https://www.thetechbag.com/darktrace/darktrace-cloud

## Why each constraint rules out what it does

The full narrowing logic, as prose. Nothing here is hidden behind an interaction.

**Runtime protection on the workload.** Rules out Wiz CSPM (Wiz Essential / Advanced) — a posture SKU; runtime is a separate module (Wiz Defend + Sensor) from the same vendor; Wiz CIEM, Wiz Code, Wiz DSPM, Tenable Cloud Security and Delinea Privilege Control for Cloud Entitlements — posture and visibility only; nothing runs on the workload to block or respond. That leaves Wiz Defend (runtime, with Wiz Sensor), Check Point CloudGuard CNAPP, Qualys TotalCloud, Trend Vision One Cloud Security, Fortinet FortiCNAPP (Lacework), Bitdefender GravityZone Cloud Security (CSPM+), SentinelOne Singularity Cloud Security, CrowdStrike Falcon Cloud Security, Kaspersky Hybrid Cloud Security, Kaspersky Container Security, Sophos Cloud Native Security, Carbon Black Workload (Broadcom) and Darktrace Cloud.

**Agentless only.** Rules out Wiz Defend (runtime, with Wiz Sensor), Kaspersky Hybrid Cloud Security, Kaspersky Container Security and Carbon Black Workload (Broadcom) — agent-based only. That leaves Wiz CSPM (Wiz Essential / Advanced), Wiz CIEM, Wiz Code, Wiz DSPM, Check Point CloudGuard CNAPP, Qualys TotalCloud, Tenable Cloud Security, Trend Vision One Cloud Security, Fortinet FortiCNAPP (Lacework), Bitdefender GravityZone Cloud Security (CSPM+), SentinelOne Singularity Cloud Security, CrowdStrike Falcon Cloud Security, Sophos Cloud Native Security, Delinea Privilege Control for Cloud Entitlements and Darktrace Cloud. It flags Check Point CloudGuard CNAPP — Agentless posture; runtime protection needs its agent / sensor, Qualys TotalCloud — Agentless posture; runtime protection needs its agent / sensor, Trend Vision One Cloud Security — Agentless posture; runtime protection needs its agent / sensor, Fortinet FortiCNAPP (Lacework) — Agentless posture; runtime protection needs its agent / sensor, Bitdefender GravityZone Cloud Security (CSPM+) — Agentless posture; runtime protection needs its agent / sensor, SentinelOne Singularity Cloud Security — Agentless posture; runtime protection needs its agent / sensor, CrowdStrike Falcon Cloud Security — Agentless posture; runtime protection needs its agent / sensor, Sophos Cloud Native Security — Agentless posture; runtime protection needs its agent / sensor and Darktrace Cloud — Agentless posture; runtime protection needs its agent / sensor — marked, not removed.

**CIEM.** Rules out Wiz CSPM (Wiz Essential / Advanced), Wiz Code, Wiz Defend (runtime, with Wiz Sensor), Wiz DSPM, Kaspersky Hybrid Cloud Security, Kaspersky Container Security and Carbon Black Workload (Broadcom) — no cloud identity / entitlement management in this SKU. That leaves Wiz CIEM, Check Point CloudGuard CNAPP, Qualys TotalCloud, Tenable Cloud Security, Trend Vision One Cloud Security, Fortinet FortiCNAPP (Lacework), Bitdefender GravityZone Cloud Security (CSPM+), SentinelOne Singularity Cloud Security, CrowdStrike Falcon Cloud Security, Sophos Cloud Native Security, Delinea Privilege Control for Cloud Entitlements and Darktrace Cloud. It flags Trend Vision One Cloud Security — CIEM depth not documented and Bitdefender GravityZone Cloud Security (CSPM+) — CIEM depth not documented — marked, not removed.

**Shift-left and IaC scanning.** Rules out Wiz CSPM (Wiz Essential / Advanced), Wiz CIEM, Wiz Defend (runtime, with Wiz Sensor), Wiz DSPM, Kaspersky Hybrid Cloud Security, Carbon Black Workload (Broadcom) and Delinea Privilege Control for Cloud Entitlements — no IaC / code scanning in this SKU. That leaves Wiz Code, Check Point CloudGuard CNAPP, Qualys TotalCloud, Tenable Cloud Security, Trend Vision One Cloud Security, Fortinet FortiCNAPP (Lacework), Bitdefender GravityZone Cloud Security (CSPM+), SentinelOne Singularity Cloud Security, CrowdStrike Falcon Cloud Security, Kaspersky Container Security, Sophos Cloud Native Security and Darktrace Cloud. It flags Bitdefender GravityZone Cloud Security (CSPM+) — Code scanning not documented and Darktrace Cloud — Code scanning not documented — marked, not removed.

**Private-cloud and on-prem workloads.** Rules out Wiz CSPM (Wiz Essential / Advanced), Wiz CIEM, Wiz Code, Wiz DSPM, Tenable Cloud Security, Delinea Privilege Control for Cloud Entitlements and Darktrace Cloud — public-cloud accounts only. That leaves Wiz Defend (runtime, with Wiz Sensor), Check Point CloudGuard CNAPP, Qualys TotalCloud, Trend Vision One Cloud Security, Fortinet FortiCNAPP (Lacework), Bitdefender GravityZone Cloud Security (CSPM+), SentinelOne Singularity Cloud Security, CrowdStrike Falcon Cloud Security, Kaspersky Hybrid Cloud Security, Kaspersky Container Security, Sophos Cloud Native Security and Carbon Black Workload (Broadcom). It flags Wiz Defend (runtime, with Wiz Sensor) — On-prem workload coverage not documented, Check Point CloudGuard CNAPP — On-prem workload coverage not documented and Fortinet FortiCNAPP (Lacework) — On-prem workload coverage not documented — marked, not removed.

**Under 100 workloads.** Rules nothing out on published terms. It flags Wiz CSPM (Wiz Essential / Advanced) — Essential ≈ $24,000 / yr for 100 workloads, Wiz Code — Reported ~$58,500 / yr add-on, Wiz Defend (runtime, with Wiz Sensor) — Reported ~$18,000 / yr add-on; Sensor ~$28,000 / yr and Fortinet FortiCNAPP (Lacework) — Starter packs from ~$25,000 / yr — marked, not removed.

**Which clouds are genuinely covered at depth.** Rules nothing out on documentation — every product here lists AWS, Azure and GCP. Depth is the question the datasheet cannot answer: the agentless specialists (Wiz, Tenable, Check Point AWP) document the widest service coverage across all three; the endpoint-heritage vendors are deepest on the cloud their customers run most; Kaspersky Hybrid Cloud is deepest on private virtualisation. Ask for the list of supported services per cloud, and test the one you use least.

**Containers and Kubernetes depth.** Rules nothing out as a chip because every product here scans images; what differs is admission control and runtime in the cluster: Kaspersky Container Security, Wiz Defend, CrowdStrike, SentinelOne, Trend, FortiCNAPP, Check Point and Qualys document runtime; Tenable and the Wiz posture modules scan images and configuration without running in the cluster; Bitdefender and Sophos run via their server agents. Ask which Kubernetes distributions and which node types.

**India data residency.** Documented: SentinelOne (Mumbai), Sophos Central (Mumbai), Qualys (India platform). CrowdStrike's India in-country cloud is announced (January 2026); Wiz, Check Point, Tenable, Trend, Fortinet, Bitdefender and Kaspersky do not document an India region for cloud-security telemetry — flagged, not ruled out. Note that the workloads themselves already live in a region; the question is where the findings and snapshots are stored.

## Eight situations, eight shortlists — starting from whether agents are allowed

Every shortlist begins with posture or protection, agent or not. The vendor's home half follows.

### Three clouds, no agents allowed, answer in a week

**Shortlist:** Wiz CSPM (Wiz Essential / Advanced), Tenable Cloud Security, Check Point CloudGuard CNAPP

**Why:** Agentless posture, vulnerabilities, entitlements and attack paths across AWS, Azure and GCP from API access alone — Wiz's design centre, Tenable's 100%-agentless stance, Check Point's AWP.

**Trade-off:** Posture only: nothing blocks at runtime until you add Wiz Defend's Sensor or Check Point's agents; Tenable never does. Reported minimums put Wiz out of reach below ~100 workloads.

### Something is running in the cluster and must be stopped

**Shortlist:** Wiz Defend (runtime, with Wiz Sensor), CrowdStrike Falcon Cloud Security, SentinelOne Singularity Cloud Security

**Why:** Runtime detection and response on workloads and Kubernetes: Wiz Defend with the eBPF Sensor, the Falcon sensor, the Singularity agent — the endpoint vendors' strength.

**Trade-off:** All three need something installed; the agentless story ends at runtime. Kaspersky Container Security and Trend are the on-prem-friendly alternatives.

### You already run CrowdStrike, SentinelOne, Trend or Sophos on servers

**Shortlist:** CrowdStrike Falcon Cloud Security, SentinelOne Singularity Cloud Security, Trend Vision One Cloud Security

**Why:** The sensor you already run becomes the workload-protection agent, with agentless posture added in the same console — one agent estate, one XDR.

**Trade-off:** Posture depth trails the agentless specialists; quote-only (Trend in credits); an agent on a laptop is still not an agent on a container — test the Kubernetes story specifically.

### You already run Qualys or Tenable for vulnerabilities

**Shortlist:** Qualys TotalCloud, Tenable Cloud Security

**Why:** TruRisk or VPR extended into cloud accounts and workloads from the tenant you already use — one risk model for hosts and clouds.

**Trade-off:** Qualys meters per connector and per workload on quote; Tenable is posture only with no runtime. Neither is a reason to skip runtime protection if you need it.

### Private cloud — VMware, OpenStack, on-prem Kubernetes

**Shortlist:** Kaspersky Hybrid Cloud Security, Kaspersky Container Security, Bitdefender GravityZone Cloud Security (CSPM+)

**Why:** Agent-based workload and container protection that documents VMware, Hyper-V and OpenStack alongside the public clouds; Trend and Sophos server agents are the other on-prem-friendly paths.

**Trade-off:** Kaspersky carries procurement caveats in some sectors and brings no posture or CIEM; Bitdefender's posture is newer than its workload protection.

### Cloud identity is the attack surface — who can reach what

**Shortlist:** Wiz CIEM, Tenable Cloud Security, Check Point CloudGuard CNAPP

**Why:** Entitlement analysis and least-privilege recommendations: Wiz's CIEM module, Tenable's Ermetic lineage, CloudGuard's CIEM with effective risk.

**Trade-off:** CIEM findings need an owner in the platform team; a list of over-privileged roles nobody removes is the cloud version of scan results nobody actions.

### Fix it in the pull request — IaC, images, secrets

**Shortlist:** Wiz Code, Check Point CloudGuard CNAPP, Fortinet FortiCNAPP (Lacework)

**Why:** Shift-left scanning tied to the same risk graph as production: Wiz Code's code-to-cloud tracing, CloudGuard pipeline security, FortiCNAPP's IaC and image scanning — CrowdStrike, SentinelOne, Qualys, Trend and Tenable also scan IaC.

**Trade-off:** Engineering adoption decides the value; a CI gate nobody wired in is a licence. Wiz Code is priced as an enterprise add-on.

### Published price, Fortinet fabric, or a PAYG meter

**Shortlist:** Fortinet FortiCNAPP (Lacework), Sophos Cloud Native Security, Wiz CSPM (Wiz Essential / Advanced)

**Why:** FortiCNAPP publishes a ~$25,000 starter pack; Sophos Cloud Native Security is pay-as-you-go per user and server on AWS Marketplace; Wiz's tiers are reported by resellers (~$24k Essential for 100 workloads).

**Trade-off:** Starter packs and PAYG are floors, not ceilings; the rest of the field is quote-only or credit-priced — the normal state of this market.

## At scale

Cloud estates scale by workloads that appear and vanish hourly. The meter, the alert volume and the number of owners are what change.

### 100 workloads — The floor is the constraint

- Reported minimums (Wiz Essential ~$24k / yr for 100 workloads; FortiCNAPP ~$25k starter) decide the field before features do.
- Your cloud provider's native tools (Defender for Cloud, Inspector, Security Command Center) may be the honest posture layer at this size.
- One platform engineer owns everything — including the findings.

**The test:** Connect one account to a trial, count the findings, and ask who will close the top ten this week.

### 1,000 workloads — Ownership and noise are the constraint

- Intentional misconfigurations (public buckets that are meant to be public) generate alerts nobody wants; exceptions need an owner.
- CIEM findings pile up in the platform team's queue; runtime alerts in the SOC's — two owners, one graph.
- Agent rollout into autoscaling groups and clusters is an engineering project, not a security one.

**The test:** Measure alert volume per owner for a month; test the exception workflow; deploy the agent through your image pipeline, not by hand.

### 10,000 workloads — Multi-cloud depth and meters are the constraint

- Per-workload and per-resource meters climb with ephemeral workloads; ask how short-lived containers are counted.
- Depth on your second and third cloud is where the agentless specialists and the endpoint lineage diverge most.
- Data residency for snapshots and findings becomes a question — three vendors document an India region.

**The test:** Pull the full inventory through the API and reconcile it with the cloud billing export; price ephemeral workloads explicitly.

Wiz, CrowdStrike, SentinelOne, Check Point, Qualys, Tenable, Trend and FortiCNAPP document very large estates; Bitdefender’s and Sophos’s cloud posture and Kaspersky’s container product document less at scale — flagged in prose, not ruled out. Where a specific console strains for your estate: [TechBag to confirm].

## Switching posture tools is a re-connect; switching runtime is a re-deploy

Agentless products leave in an afternoon; agents leave with the next image build. The findings, exceptions and pipeline gates are what move slowly.

**Agentless connectors** — Revoke the old read-only roles, grant the new; findings repopulate in hours. The lightest switch in security — which is also why agentless vendors fight hardest on renewals. *(Re-connect)*

**Agents and sensors** — Rebuild images, roll autoscaling groups, redeploy DaemonSets; the old sensor lingers on long-lived VMs until someone removes it. *(Re-deploy)*

**Exceptions and risk acceptances** — Every accepted public bucket, every tolerated permission and every suppressed rule is rebuilt by hand in the new graph. *(Rebuild)*

**Pipeline gates and integrations** — CI gates, ticketing, SIEM and MDR integrations are re-wired; a different risk model re-baselines every SLA. *(Re-wire)*

**Re-connect, re-deploy and exception-rebuild effort for your estate:** [TechBag to confirm] — TechBag scopes it from your accounts, clusters and pipeline.

## Per workload, per resource, per connector, per credit — and the native tools you already pay for

What your cloud already includes, the meters compared in USD and INR at three estate sizes, and what the licence leaves out.

### Do you already own one?

Four places posture or protection may already be on the invoice.

- **Your cloud provider — Partly.** AWS (Inspector, GuardDuty, Security Hub), Azure (Defender for Cloud) and Google (Security Command Center) each secure their own cloud natively, on consumption. One cloud each, deep on their services — the honest posture layer at small scale.

- **Your endpoint vendor — Often.** CrowdStrike, SentinelOne, Trend, Sophos, Bitdefender and Kaspersky all sell the workload half on the sensor you run; posture is the newer add-on.

- **Your vulnerability vendor — Often.** Qualys TotalCloud and Tenable Cloud Security extend the risk model you already pay for into cloud accounts. Tenable stays posture-only.

- **Microsoft 365 E5 — No.** E5 is endpoints, mail and identity. Defender for Cloud is a separate Azure consumption bill — and it covers AWS and GCP too, which is why it is the comparator for every agentless quote on an Azure-heavy estate.

If the native tool covers your one cloud, we say so — and then talk about the second cloud and the runtime half.

### What the rest actually cost

Reported and published meters (INR for scale), then worked at 100 / 1,000 / 10,000 workloads. Most of this market is quote-only or credit-priced; the grid says so rather than inventing a number.

### What isn't in the licence price

- **The owners.** Posture findings belong to the platform team; runtime alerts to the SOC; CIEM findings to identity; pipeline gates to engineering. A CNAPP without four owners is four queues nobody reads.

- **The agent rollout.** Runtime protection means a sensor in images, autoscaling groups and clusters — an engineering project the security licence does not include. Price it as one.

- **The exceptions.** Intentional public buckets, tolerated permissions, accepted CVEs — the exception workflow is the product in year two. It is rebuilt by hand if you switch ([switching cost](#migration)); your count is [TechBag to confirm].

## What goes wrong

Documented architectural behaviour, cross-checked against TechBag engagements before any becomes a named case. Most of these are halves bought as wholes.

- **Posture-only tools mistaken for runtime protection.** The graph was perfect; the cryptominer ran for a week. Tenable and the Wiz posture modules never block — by design. Know which half you bought.

- **Agentless blind spots at runtime.** Snapshots every few hours miss what happens between them. Agentless is for posture; runtime needs something running.

- **Multi-cloud support deep on one and thin elsewhere.** All three logos on the datasheet; service coverage on the third cloud was a checklist. Test your smallest cloud first.

- **CIEM findings nobody owns.** A list of over-privileged roles in the security console; the platform team never saw it. Findings need an owner in the team that can change the role.

- **Alert volume from intentional misconfigurations.** Public buckets that should be public, open ports that are meant to be open — flagged forever until exceptions are designed in.

- **An endpoint agent sold as cloud security.** The laptop sensor would not survive the immutable image; the container story was a roadmap. Ask every endpoint vendor how it works without the agent.

- **Ephemeral workloads on a per-workload meter.** Containers that lived an hour counted like servers; the renewal was a surprise. Ask how the meter counts before the first connector.

- **The native tool already switched on.** Defender for Cloud or Security Hub was already doing the posture the new tool was bought for. Compare against the native tool first.

## Questions this guide answers

### What is the difference between CSPM, CWPP, CIEM and CNAPP?

CSPM reads cloud accounts through their APIs and finds misconfiguration, exposure and drift — agentless, finds but does not block. CWPP runs on the VM, container host or Kubernetes cluster and can detect, block and respond at runtime — needs something installed. CIEM reads identities and entitlements — who can do what to which resource. CNAPP is the label for the bundle of all three plus code / IaC scanning and data posture on one risk graph. Scopes, not tiers; most vendors sell the half they were born in plus modules.

### Agentless or agent-based cloud security?

Agentless (Wiz, Tenable, Check Point AWP, Qualys FlexScan, CrowdStrike snapshot scanning and others) connects every account in hours with nothing installed, but cannot block at runtime and has a blind spot between snapshots. Agent-based (the Falcon and Singularity sensors, Trend, Sophos, Bitdefender, Kaspersky, the Wiz Sensor, Lacework and CloudGuard agents) gives live runtime detection and blocking but must be deployed into images, autoscaling groups and clusters. Most vendors now offer both; the question is which side is native. Tenable is 100% agentless by design and offers no runtime protection.

### How much does Wiz cost?

Wiz does not publish a list. Reseller and buyer reports put Wiz Essential at roughly $24,000 a year for 100 workloads and Advanced at about $38,000; under 500 workloads around $15–30 per workload per year, $8–20 at 2,000–10,000 and $6–15 above; Wiz Sensor, Wiz Code and Wiz Defend are separate add-ons reported at roughly $28,000, $58,500 and $18,000 a year. FortiCNAPP publishes a starter pack from about $25,000 a year; Sophos Cloud Native Security is pay-as-you-go on AWS Marketplace; the rest of the field is quote or credit priced.

---

*Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.*
*TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/security/cloud-workload-security*