Prisma Cloud by Palo Alto Networks Reviews

We use it for visibility, compliance, and governance. It is the official CSPM solution for our bank.

The only module we are using is the compliance module.

In Prisma Cloud, we were able to create frameworks using the RQL language, frameworks that are modeled after our Archer security baselines. Archer is the tool that we used to track all exceptions and security baselines. With Prisma Cloud we have been able to create custom baselines, based on the Archer framework that we have, and not just go off of CIS or NIST frameworks. 

We have also been able to generate reports for teams using the automated scripting tools that Prisma Cloud provides. On a weekly basis, we share those reports with the teams that are impacted. They go back and remediate their findings as needed, or we fine-tune the Prisma Cloud compliance language as needed if there is any ambiguity in there. 

Over the course of a few weeks, the teams remediate these issues and our compliance percentage goes up. Our compliance percentage for production environments was 95 percent. We then made some new acquisitions and they were at 40 or 50 percent, which was very bad. When we brought them under our company's umbrella, we gave them these reports, and they improved their compliance percentage. That has been helping us hugely.

Also, it does a good job of providing a view of our overall posture. Our confidence in our security and compliance posture was what I would describe as a "head in the sand" type of situation before. People would say, "Ah, we should be okay." But once we started digging into stuff and started putting our Archer baselines into the Prisma Cloud queries, that's when we realized that things looked poorer than we had imagined or assumed. This has been a wake-up call for our organization, and everybody has taken notice that we really have a hard job ahead of us.

In addition, with this solution we are seeing a single pane of glass to protect all of our cloud resources and appliances. We are seeing multiple occurrences with multiple platforms under one roof. That has really helped to simplify things.

Prisma Cloud does have some good investigation built into it. When an alert is generated, it does a good job at correlation, not the greatest in the world, but it gives you a good starting point. So it has helped us work on those alerts or investigate them more easily. It reduces our investigation time by 40 to 50 percent because it does all the initial investigation and puts all the findings together. You don't have to manually log into a lot of different accounts or tools to find out that information.

Financially, the only way I can think of that the solution has improved things is in our compliance structure. We spend less time after audits by putting in the effort beforehand. Recently, we have had a lot of good wins where audits have not been able to find a lot of issues. In the past, they used to find 15 or 16 findings, and now, they're able to find only one or two. When you have fewer audit findings, you have fewer man-hours dedicated to dealing with them. We are able to move those man-hours into our actual work rather than just audit work. We have been able to achieve some productivity there. I would estimate it has saved us 5 to 10 percent, in terms of money.

The most valuable feature is the option to add custom queries using the RQL language that they supply so that we can customize the compliance frameworks to what we need to look for.

The comprehensive view that it offers, the compliance percentage based on a framework for a particular account or a particular environment, is extremely useful. We can give those reports to the individual application teams so that they can remediate the findings. It also helps that we can give them read-only access, so we don't even get involved. They log in on their own and can pull a report, based on our instructions, and then do the remediation themselves. It helps us not be the middleman and not waste our time just generating reports for the application teams.

Also, Prisma Cloud provides security for multi and hybrid-cloud environments. We started off using it for our AWS environments, but now Azure and GCP are starting to come into play. We haven't started using those yet, we have just started initial discussions with them, but it has already been decided that Prisma Cloud would be the CSPM even for our Azure and GCP environments.

One definite area for improvement is the auto-remediation or the CWP area. 

The second one is the RQL language. It is still not very flexible and does not cover a lot of use cases. The RQL language could be dramatically improved to add more options. The cloud is adding more and more complexity in terms of number of services or the number of options for each service, especially when it comes to security options like encryption at rest and encryption in transit. And there is the issue of the interlinking of these services. One cloud service uses another cloud service, like CloudFront in front of a load balancer. These interactions are creating numerous new combinations and the RQL language really needs enhancement to handle those queries. 

We ourselves have put in a lot of enhancement requests to Palo Alto, looking at these corner cases, so they can look into those and improve them.

I have been using Prisma Cloud by Palo Alto Networks for about two years.

Prisma Cloud is a little slow, but it is fairly stable.

It is a scalable solution. No matter how many accounts you add, it still can scale. Even the reports that we set up run pretty quickly. They have done a good job of making their platform scalable.

We have been acquiring companies quite a bit recently so we will be using Prisma Cloud heavily. This is our only company-approved CSPM tool. Even though we have some of the native tools in use, like Security Hub from AWS, or Azure Security Center, now called Defender for Cloud in Azure, the official CSPM is Prisma Cloud. It is the center of attraction for us so it is being used by everybody. In the future, we will be adding more accounts as needed until a decision is made on Wiz. We still have a good amount of time left in our Prisma Cloud contract, so we are not looking to switch to Wiz anytime soon.

Technical support is excellent. We have a dedicated account manager from Prisma Cloud who has an office hours session every Monday, and he also attends our standup calls. If Prisma Cloud has any new improvements or any updates that we might be interested in, he brings them up on those calls. We also have a weekly knowledge-sharing session where Prisma Cloud's personnel come in and make a 30-minute presentation and address the enhancement requests that we put in. They'll tell us what updates have happened, what improvements have happened, et cetera.

Positive

The initial setup was straightforward. It was done by one of our team leads, who is a cloud security fellow. He used to be a senior cyber security engineer. It took him three months of full-time work to set up those compliance frameworks, the custom RQL queries based on our Archer baseline, and then, import all the accounts. The importing of the accounts is pretty straightforward. They provide an API or you can even import manually. That's not at all a problem.

We have 10 to 15 users in the solution. Four or five of us are from cloud security proper, and we have administrative rights. Our cloud operations team, seven or eight people, looks at the alerts and investigates and resolves them. They engage us if they need any assistance because they're not very cloud aware yet. And we have a few pilot users who are from the application teams, and they have a read-only role. They generate a report for themselves. Many people still want spoon-feeding and say, "Can you generate a report for us or give us a screenshot of this and that?" We do that occasionally, but we are trying to move away from that process.

For maintenance, there are only two of us, and one of us is doing it full-time, more or less. The other one is more of a standby. We are documenting the procedures. We do weekly maintenance in Prisma Cloud, where we make sure the users are onboarded, there are no stale users, and take care of the general upkeep of the tool. The idea is that, in the future, we'll probably get a junior engineer for that role, while the senior engineer can perform enhancements or more advanced configurations.

When it comes to protecting the full cloud-native stack, Prisma Cloud is fairly okay. Compared to other tools out there, I don't think it is an extremely good product, but it's a reasonably okay product to work with. I've used Wiz in the past, and Wiz does a better job on full native-cloud security.

For example, there is the auto-remediation feature in Wiz, which Prisma Cloud eventually caught up to. Wiz also has agentless scanning that Prisma Cloud is, again, catching up to. There is also Terraform code scanning for CI/CD pipelines that Wiz came up with, ISC code scanning, et cetera. Those are some of the excellent features of Wiz.

Wiz also offers granular compliance frameworks in the sense that you could write your own compliance queries and make them part of a framework. Prisma Cloud's RQL is not that flexible. We are still running into some issues in some corner cases where there are no RQL queries available.

Prisma Cloud's security automation capabilities are very basic. Prisma Cloud is primarily a CSPM, not a CWPP. Even Wiz does not offer that many automation capabilities; they were coming out just at the end of the last year. But compared to other products that I have worked with, which are purely CWPP, Prisma Cloud would not even come close.

I would rate Prisma Cloud at about six out of 10 for helping to take a preventative approach to cloud security. It gets the job done. Our company has invested money in it, so we can't move away from it for another two or three years. But we are already piloting Wiz to see if we like it. Once the contract with Prisma Cloud is up, we will probably jump to Wiz. That's the idea within the company.

If I were to rate Prisma Cloud from one to 10, I would maybe rate it at six, while Wiz would be a nine.

We have started using some of the modules for securing the entire cloud-native development cycle across build, deploy, and run, but we have not really operationalized them. They're in the initial phases. It's not the maturity of Prisma Cloud that's in question, it's about the maturity of our company as a whole. Our company was not really tuned to CI/CD, secure DevOps, and the like, so we are slowly starting to integrate that. We haven't seen the results yet, but I would say it's very promising on that front at this time.

My advice would be to compare other products and understand what you want to do before you purchase or implement it.

We use this solution to detect misconfigurations in the cloud. It's a multi-cloud solution, so if you're running a multi-cloud environment like Azure, AWS, and GCP, you only need to deploy a single solution. It assists with improving the security posture of an organization.

I use CSPM and CWPP. The previous organization I worked for used both, but the company I work for now only uses CSPM. I've also worked with code security.

We recently acquired this solution, so it has slowly started gaining momentum in my organization.

This solution provides us with a single tool to protect all of our cloud resources and applications without having to manage and reconcile different security and compliance reports. It's a single solution for everything in a multi-cloud environment.

It enhances operations, but it's a pretty measurable tool. It provides comprehensive visibility.

It provides risk clarity at runtime across the entire pipeline and shows issues as they are discovered during the build phases. 

The modules in CSPM and CWPP are visibility, compliance governance, threat detection, data security, host security, container security, serverless security, web application, and API security. This is an additional cost, so I don't think any organization uses all of the modules.

I previously worked for a health organization that was using this solution. They were able to get certified in HITRUST using this product.

Our developers are able to correct issues using the tools they use to code.

The CSPM and CWPP functionalities are pretty good. It depends on what kind of data you have in your cloud, your workload, and some other factors. If you're doing a lot of containers, you need CWPP models. If you just do regular cloud contributions, then you can use CSPM.

It provides security spanning multi and hybrid-cloud environments. My current organization's goal is to migrate to the cloud eventually. If that's your organization's goal, you need to have some kind of security mechanism or protection in place to make sure that the resources you're building in the cloud are built for the best security practices and are free of misconfiguration vulnerabilities. 

When we deploy containers in any cloud, the runtime protection is really good. If a container is running any kind of application, it can detect a cryptomining attack. The solution also provides File Integrity Monitoring testing.

It has various models and provides comprehensive visibility. It shows us how our assets are performing in any of our clouds. It gives us a holistic view of our native cloud environment, and we can also fine-tune the policies for our architecture.

The modules help us take a preventative approach to cloud security. Flow Logs provide a real-time assessment of our network.

It recently integrated with another company called Checkov. It checks all the misconfigurations that a developer could make during the build phase. This means that whenever we're building any kind of application or deploying any application, it will detect it right away. We can integrate it into our CI/CD pipeline or with any other Jenkins plugins. I tested those use cases as well. The solution has improved since they integrated the product with Checkov.

It provides good visibility. In terms of controls, it depends on how you want to do it. Sometimes, you need to be specific in terms of controls. With runtime detection, it's going to be more powerful. We're confident that our assets are secure.

The solution is capable of integrating security into our CI/CD pipeline and adding touch points into existing DevOps processes. We don't have the option to leverage it, but I have tested it in my previous organization.

This solution is more AWS and Azure-centric. It needs to be more specific on the GCP side, which they are working on.

I have been using this solution for about two and a half years.

The solution is reliable.

The solution is scalable.

Technical support is very helpful. I would rate them a nine out of ten. We have a weekly cadence.

Positive

The setup was very easy and straightforward. We haven't set up the automation perspective. We're still testing it, so we haven't leveraged it yet.

The setup didn't take very long, but it will be different for every organization. If your cloud architect team is willing to deploy with you, it shouldn't take more than a week. It also depends on how large the organization is and how many subscriptions are in the cloud environment.

We don't need to maintain anything on the console side.

We used an integrator from Palo Alto. They were very good and offered great support.

The solution is pretty expensive. It all depends on the organization's goals and needs.

The cost depends on the pricing model. Compared to other solutions, the cost isn't that bad.

I compared the solution to other security products like Fortinet, Lacework, and Security Command Center.

I would rate this solution as eight out of ten. 

Those who want to use this solution, need to understand the concept behind this product and get to know their own environment first. The solution will give you holistic visibility of your assets, which will show you what needs to be fixed. Security comes with an expense, so it depends on what you want to leverage and where.

I'm still testing the automation capabilities because my organization is specific to one cloud. They were more aggressive on Azure and AWS Prisma Cloud, but now they are considering GCP customers as well.

We're still in POC mode for continuous security that comes under runtime protection. I can't 100% guarantee that it reduces runtime alerts.

We had Azure, AWS, and a little bit of GCP, so we gave Prisma read access to all those accounts, subscriptions, etc., and monitored the alerts to mitigate risks based on what popped up in the dashboard.

While it's not our only tool, Prisma is managing about 80 percent. We still occasionally go into cloud-native tools to ensure certain compliance standards are being met. Sometimes, urgent issues need to be fixed that haven't been reported in Prisma because the native tools will catch them first. As a third-party solution, Prisma might take a little longer to build a report directory.

We had around 30 to 40 users who were a mix of cloud and DevOps engineers. There were also members of the security team who made decisions about what kind of security policies we had to follow. We used it extensively within the public cloud across all our Azure, AWS, and GCP subscriptions and projects. There was interest in using it on-premises with our vSphere environment as well. I don't know if that ever happened.

Prisma enabled us to get up-to-speed on enforcing TLS 1.2. It helped us look at different types of resources, like storage accounts and app services. I'm thinking particularly of Azure because that was my focus. I found all the resources from the Prisma list and remedied those issues so that they were displayed as resolved in Prisma.

It gave us visibility into and control over complex cloud environments, which helped us feel better about our security and secure the environment with the clinical data. Our security team was pleased when we showed them clean Prisma reports. It boosted their confidence and their comfort level that we were being compliant.

Prisma made it much easier to ensure that all of the security pieces are handled. It simplified our security issue resolution. It cut down our investigation time by giving us one place to look. It cleaned up our operations considerably because finding what resources needed to be resolved, mitigated, or updated was easier. It probably saved us several hours every week. It also saved us some money, but I couldn't quantify the savings because other environments also used it.

It helped us develop a preventative approach to security. Nine out of ten times, we could find issues that needed to be fixed ahead of time. We had a monthly meeting where we would review the high-severity alerts on the dashboard and assign people to remedy them. Once we got through the high severity alerts, we looked at mediums and low severity alerts. Prisma enabled us to identify resources we needed to fix, which was quite handy.

We were pleased with Prisma's custom and built-in reports. We could go into the dashboard and see all these notifications telling us which subscriptions didn't have TLS 1.2 enabled. The security controls were the most valuable features. 

Prisma's multi-cloud capabilities were essential. We wouldn't have used it without them. We would have just used the native cloud vendors' security solutions. Its protection of our full cloud-native stack is pretty comprehensive. I would rate it at least an eight out of ten. It stacks up well compared to the security alerts and notifications we got from solutions like Defender.

It sometimes took Prisma a little while to build queries, so new services or features wouldn't appear. It wouldn't get flagged in Prisma for a bit. It would be helpful if they sped up how quickly they got their default notifications, queries, and alerts.

The access controls for our bank roles were not granular enough. We needed specific people to do particular actions, and we often had to give some people way too much access for them to be able to do what they needed in Prisma. They couldn't do their jobs if they didn't have that level of access, so other people had to do that part for them. It would help to have more granular role-based access controls.

We used the solution for about three years at my previous company. 

Prisma seemed highly stable, but I wasn't managing the solution. I was more of a user.

Prisma seemed to scale pretty well. It covered several large environments and didn't seem to struggle when loading information for us. I think it did well.

I rate Palo Alto support a six out of ten. The support was adequate, but I can't say it was great. If we had an issue with a feature or a query, it could take them a little while to get back, especially if it was a feature improvement or a new alert. They were very slow to add new warnings and features.

Neutral

The company never had a public cloud solution before Prisma, but they had something for on-prem. I don't know what it was. They also used cloud-native solutions like Defender for Cloud and the native tool for AWS.

We switched to Prisma because we wanted a single pane of glass that would allow the security team to see security issues across all of the public cloud vendors that we used, so they wouldn't have to jump to each individual cloud vendor's tool.

I was involved in the POC several years ago. It was like a lab test. After we tested that for several months, we rolled out the official one. At that point, I was just helping them test as they tried out the product. I didn't actually install the software.

The setup seemed pretty straightforward. There were clear instructions on how we just needed to create service principles with specific permissions and then grant Prisma the credentials for the service. I think they only had about five people maintaining the Prisma environment, and each was responsible for bits and pieces of it.

I believe the company saw a return using Prisma.

I know that the guys who handled the pricing said Prisma was costly, but I don't know how that compares to other products.

I know the team evaluated other options, but I wasn't involved.

I rate Prisma Cloud an eight out of ten. Having one place to go for all of your security alerts and notifications makes it easier to solve issues than going to each vendor's security tool.

We are a system integrator. My organization has a cloud practice, and we focus on cloud security. Predominantly, Prisma Cloud is used to identify misconfigurations in the cloud.

We have been using Prisma Cloud for two specific customers on Azure Cloud. It is quite a new organization, and we currently have two customers, but in my previous organization, we had about eight customers.

We predominantly focus only on the cloud. We don't work with hybrid models. MultiCloud is there, but we haven't worked on MultiCloud as of now. This specific region is more into Azure Cloud. Azure has a data center over here. Therefore, the adoption of AWS or Google is not high in this region. For data compliance, customers want to stick to a cloud vendor that has a data center in this region.

My 18 years of experience is purely in serving the US and Europe markets. I am quite new to the UAE and the gulf region, and I found that this region is not very mature when it comes to cloud security. The majority of the CISOs are not aware of cloud security controls that need to be implemented, and they only speak about traditional security such as EDR, endpoint security, DLP, etc. So, there is a big potential for cloud security, specifically at the containers and serverless layer.

When we evaluated solutions, we carried out PoC not only for two customers but also for the other six accounts, and they were pretty shocked to know that there were a lot of misconfigurations in the cloud. This region lacks cloud security skills, and there are not many cloud security experts or solution architects to design proper architecture. When we carried out the PoC, they became aware of the misconfigurations and security gaps. It helped them to identify the potential risks they have in the cloud. Generally, with security, it is not easy to measure the outcome or gain from a solution because it purely depends on the breach and the data loss, but so far, we have helped two organizations in fully implementing the solution, and the other four are still in the PoC process.

We purely focus on the container and serverless security, and we predominantly work with Cloud Posture Management (CPM). We opted for Prisma Cloud because we found Prisma Cloud to be better in terms of the overall posture and integration. There are other products in the market, but they don't have a complete and broad portfolio range when it comes to containers or serverless functions. Prisma Cloud has good integrations. You can integrate vulnerability management for the overall risk score. When it comes to commercials, costing-wise also, it is far more reasonable for the customers.

It is good for helping us to take a preventative approach to cloud security. It identifies all the controls and gives an overall picture. For example, it tells us the portion that has misconfiguration. So, we can fix that portion. It is a very good preventative tool. Certain customers predominantly use it for one-time assessments, which I don't recommend. It should be an ongoing assessment to have a good incident response as soon as an alert comes in. Normally, people just ask for a weekly report or monthly report to identify their security posture. Instead of that, they should have a real-time incident response solution to act as a preventative tool. As soon as an alert is generated, there must be someone to immediately work on it, and having such a tool really helps.

It provides the visibility and control we need. In my previous organization, we had quite a complex environment with about 30 Kubernetes clusters. As compared to other tools, it provided better insights, but I haven't evaluated it for much more complex architectures. When it comes to serverless architectures, our work has been minimal. Therefore, I cannot confirm or guarantee whether Prisma Cloud will satisfy a highly complex environment.

It gives the overall picture of compliance when it comes to the cloud security portion. We also have a couple of custom dashboards wherein we integrate the security risk score from other tools. Before implementing this solution for the customers, there was no proper mechanism for the cloud. They only had the vulnerability management reports, the SIEM score, or the application VAPT reports, but they did not have any visibility to anything on the cloud in terms of overall compliance and container security. It definitely gave visibility to the CISOs. A lot of people are still concerned about whether the cloud is secure, whether they need to migrate to it, and whether they have proper security controls for containers and serverless security. It gives better exposure to them. We do have proper tools with CISO-enabled dashboards using which they'll be able to see the score. 

It has reduced runtime alerts by 60% to 70%. 

It has reduced the alert investigation time. False positives are reduced. So, we are able to focus on what has been highlighted. At certain times, we need to accept certain changes, and it also gives us the flexibility to mark something as safe. Based on the change control, we can disable the alert so that the alert is not repeated until the change is completed. We have the functionality to do it.

The container and serverless security is most valuable. It is quite a new technology for this region. Even though containers have been there for a long time, the adoption of containers is very minimal in this region. When it comes to using Kubernetes containers in a complex architecture, there is a lack of security in the market. People aren't aware of the security controls or the process for governance. Container security provided by Prisma Cloud is quite good at filling that gap.

We identified two things that we felt would be great to have, but they are under NDA. So, I can't disclose them. Other than those two things, we identified a generic bug in the secret key management service on AWS that needs to be fixed. We reported it to them, and we want them to fix it.

It is very good with predominant cloud vendors, such as AWS, Azure, and GCP, but I am not sure about its efficiency when it comes to other cloud vendors. They should expand its coverage to other cloud vendors such as Alibaba Cloud and Oracle Cloud, which are quite common in this region. I am not sure if they have a full-fledged Oracle Cloud controls evaluation. If they can improve it in terms of the MultiCloud aspect for the organization, it will be helpful, especially in this region.

I have been working with this solution for almost three years. In my previous organization, I worked with it for two years, and it has been about eight months since I joined my current organization. Here also, we have opted for Prisma Cloud.

Its stability is good. We didn’t have any issues with it.

In my earlier organization, we used it for a bigger client with about 3,000 VMs in AWS and about 30 to 40 clusters. We did not have any challenge with its scalability. As we started putting things, it was working well. 

In this organization, we only have two small customers. There is not much workload. We haven't had any issues. It works fine.

In my earlier organization, I worked directly with Prisma Cloud support. Their support was good. My engagement was minimal, but the initial support from them was quite good. When I had some RFCs and RFIs coming in, their turnaround times were quite less. We had a very good rapport with them. We had a specific account manager who handled any RFCs and PoCs. Their support was good, and we didn't have any challenges. 

In this organization, we have been working with a channel partner, and there have been a few challenges because they are also occupied with other proposals and tasks. The same partner also works with other competitor organizations. Overall, I would rate their support an eight out of ten.

Positive

In my previous organization, we were using the Skyhigh networks. Earlier, it was Sky network, and later on, McAfee acquired it and made it a CASB and cloud posture management product. We had a couple of challenges with it. So, we evaluated a lot of products and shortlisted Palo Alto Prisma Cloud. 

It is straightforward. They provide two options. You can configure it manually or just grant access. It can then easily sync up. They also provide the cloud formation templates to spin up in minutes. So, it is straightforward and very simple.

It is hard to measure cost savings at this time because it is quite a new investment for the organization. Cost savings will be there in terms of security and reducing the development time and error fixing time, but it will take some time to measure that.

Its price is reasonable as compared to other products. The main challenge is explaining the licensing model to customers. It isn't a problem related to Palo Alto. Commonly, people don't understand cloud licensing or security licensing. When they have fixed virtual machines, they know what they are going to be charged, but when it comes to cloud automation, it is hard for them to get clarity in case of high workloads or when they have enabled auto-scaling, etc. It would be helpful if Palo Alto can educate people on their licensing programs.

We evaluated multiple products after I came into this organization. We evaluated various CSPM and container security products, such as Aqua Security and Rapid7.

Nowadays, every vendor has come up with a cloud posture management tool. So, we carried out a couple of PoCs in specific customer accounts that had an almost similar type of infrastructure, and based on the outcome, we found Prisma Cloud to be better in terms of identification of miscontrols and security. The cost also played a major role. As compared to other products, it was reasonable. So, the feature set for fulfilling customer requirements and the cost were the two factors that played a major part.

The third factor was the flexibility to work with the vendor. In terms of partnership and support, we felt that being a Palo Alto product, Prisma Cloud would be better. Palo Alto has better service over here, and their channel partners are quite flexible to work with on initial customer demonstration and other things. We felt much more comfortable with Prisma Cloud in all these three aspects.

When it comes to its security automation capabilities, currently, not every customer prefers to automate. We have been trying to implement automation, and when the right access was given, we did a certain amount of automation to immediately block the firewall rules or revoke access when any privileged access has been given. We have been doing a little bit of automation, and it has been good. We are able to achieve our goals. Out of two customers in this company and eight customers in my previous company, only three customers preferred to do automation to a certain extent. The rest of them wanted the alerts to be sent to the incident response team of their SOC. They wanted their team to act upon them. They only allowed us to automate high severity ones or highly critical ones. For example, they only allowed us to automate things like immediately blocking access to specific ports or IPs, but we haven't tried the automation to a full extent.

It enables you to integrate security into your CI/CD pipeline and add touchpoints into existing DevOps processes. We implemented it for just one use case. Before that, we were using Qualys Container Security in the CI/CD pipeline. After switching to Prisma Cloud, I did not have an opportunity to evaluate it completely because I moved to another organization. In my previous organization, we had expertise in DevOps. We had a dedicated DevOps team with almost six years of experience in automating the entire deployment of servers infrastructure, as well as applications. It was pretty easy for them to implement or integrate any security tool into the CI/CD pipeline. In my current organization, we don't have an expert team, and we struggle a bit in implementing things because there are multiple CI/CD deployments from Jenkins to Amazon's native one and Git. So, we take support from Palo Alto to get things deployed during the PoCs. In my previous organization, it was also easier for us to implement because the training provided from the Palo Alto side was quite good, and we had a lot of training materials in the partner portal. We utilized them. We got in touch with the technical team, and we implemented things quite faster, but here, there is a bit of lag because we don't have expertise in DevOps for implementations or integrations.

It can provide risk clarity at runtime and across the entire pipeline, showing issues as they are discovered during the build phases. Shifting your security to the left cuts down the entire life cycle of application deployment, and it does help to fix the security issues at the beginning of the development life cycle itself. We have not seen a large amount of time being cut down. That's because, typically, teams deploy the code, and then initiate a security scan. By integrating these things into the early development cycle, the time can be cut down to three weeks from about one and half months.

I would rate this solution a seven out of ten.

We provide our customers with a secure cloud platform. The client uses this solution for their architecture and we check the reports once a month and provide them with guidance on how to improve their cloud operation.

Prisma Cloud by Palo Alto Networks provides a security span in multiple cloud and hybrid cloud environments. This is an important step to be able to have visibility of all the cloud environments.

The solution has helped me to take a preventative approach to cloud security. This technology is what is going to be used predominantly in the future. The newest standards are being used in this solution technology providing us with a preventive approach.

This solution benefits organizations because it uses the newest technology to provide a safe cloud environment.

We do not have a very complex environment but for our usage, the solution provides us visibility and control.

The solution provides us with a single tool that protects all our cloud resources without having to manage and reconcile security compliance reports.

The most valuable feature of Prisma Cloud by Palo Alto Networks is the CSPM, which we use the most. Additionally, the investigation and alerts are useful, and the creation of queries.

The solution is improved frequently, approximately twice a month.

Support is an area that needs improvement.

I have been using Prisma Cloud by Palo Alto Networks for approximately two years.

Prisma Cloud by Palo Alto Networks has been a stable solution.

We have approximately six engineers using this solution in my organization.

The scalability of Prisma Cloud by Palo Alto Networks is good. If we want to scale, we only need to purchase another license.

The technical support is not good at responding to questions compared to other companies. They can be slow to respond and not professional enough. There are times when we have a question and they give us a general answer that is not helpful.

The initial setup of Prisma Cloud by Palo Alto Networks is easy.

The solution has saved us money.

The pricing structure is easy to understand. Depending on the use case the pricing of the solution can be different. There are not any additional costs to the standard living fees.

I rate Prisma Cloud by Palo Alto Networks an eight out of ten.

Prisma protects our workloads and provides network security for our containers. Our infrastructure is mostly Azure-based and entirely on the cloud. We use the Prisma Compute and Prisma Network Security modules.

We have multiple security tools like Prisma, but not the same use cases. Prisma has its own unit use cases like image scanning, repository scanning, or container scanning. We have other tools as well, but they have different use cases.

We have about 15 users. Some are DevOps, infrastructure, and security engineers. There are also a few SOC analysts. I believe we'll expand usage in the coming years if everything goes well with other customers.

Before implementing Prisma Cloud, we didn't have any visibility into workspaces like Kubernetes and the underlying network of containers. Now, we have a better understanding of the resources interacting with Kubernetes and can identify vulnerabilities across the organization. In the past, we had limited information to take action on those resources, but now we can better understand the risks.

The solution has had a significant impact on our organization, especially our governance team. Once we get reports on non-compliant resources, we must take action before going live. We need to implement a risk-based approach to handle those non-compliant resources. Prisma offers a better understanding of whether the resources comply with regulations.

Prisma reduced runtime alerts by about 500 or something. We still get those because we're in the operational stage, but it's only a few. It has cut our average alert investigation times by about two days. Prisma probably saves us eight to ten hours total each week. 

I found the network queue sets useful. I also liked the Workload Protection Module, the vulnerability findings, and how the rule sets handle the vulnerabilities based on severity.

Prisma was easy to adopt in our CI/CD pipeline, but we only use it to scan the images for the last push in the CI. On the CD side, we use it for the assessment, like the pull and push. 

Prisma's notifications aren't up to industry standards. Also, Prisma is a bit harder to integrate than other tools. The deployment and onboarding are plug-and-play, but somewhat hard to handle in terms of integration with external operations tools. The product design isn't up to the current standard. I would recommend having higher standards in terms of integration with other tools, especially operationalized tools.

The product could better integrate business logs and runtime notifications from Enforcer and Network Security Module. I would recommend better visibility and integration for any violations.

I have been using Prisma for a year.

Prisma is stable.

We haven't used Prisma at scale. It hasn't grown since we deployed. We have four clusters but haven't added anything. We still keep the four clusters. We didn't add anything. In the coming months, we'll replicate this with other customers once we see that the solution is stable. 

Prisma's support was helpful. I rate them nine out of ten. 

Positive

We've never had another solution for this specific use case. This is the first. 

Some modules are straightforward to deploy, but others are a bit complex. End-to-end deployment of the modules and the whole network took approximately four months.

The Prisma team helped us in this deployment. The team helped us learn while implementing it. 

We've seen a return by reducing risks from cyberattacks and compliance issues. 

I recommend knowing the number of licenses you need for your operations and your expected workloads before signing a license agreement. There are no hidden costs as far as I know.

We looked at some solutions to improve security posture and risk management. Prisma was the product that had the capabilities we need in our price range.

I rate Prisma Cloud seven out of ten. Before you implement Prisma or any other solution, you need to ensure you have all the tools you need in place and know if it will fit into your current environment.

There are three pieces to our use case. For the container piece, which used to be Twistlock, we use static scan to scan our artifact repositories and we use that data to remediate issues and provide it back to developers. We also do runtime monitoring on our orchestrators, which are primarily Kubernetes, but some DC/OS as well. Right now, it's all on-premises, although we'll be moving that to the cloud in the future. 

And we use what used to be RedLock, before it was incorporated into the solution.

Prisma Cloud has definitely enabled us to integrate security into our CI/CD pipeline and add touchpoints into existing DevOps processes for container. In the container those touchpoints are pretty seamless. We've been able to implement security control gates and automate notifications back to teams of vulnerabilities in the container orchestrator. It all works pretty smoothly, but it required a fair amount of work on our part to make that happen. But we did not run into limitations of the tool. It enabled us pretty well. The one part where we have a little bit of a gap that most of those are at deployment time. We haven't shifted all those controls back to the team level at build time yet. And we haven't really tackled the cloud space in the same way yet. 

I'm not sure we have SecOps in the container space exactly in the same way we do in other DevOps. We shifted a lot of the security responsibility into the development teams and into the Ops teams themselves. There's less of a separation. But overall, the solution has increased collaboration because of data visibility.

It also does pretty well at providing risk clarity at runtime, and across the entire pipeline, showing issues as they are discovered during the build phases. It does a good job in terms of the speed of detection, and you can look at it in terms of CVSS score or an arbitrary term for severity level. Our developers are able to correct the issues.

We are clearly better off in that we have visibility, where there was a gap before. We know where our container vulnerabilities and misconfigurations are, and even on the cloud side, where cloud misconfigurations are happening. That visibility is a huge benefit. 

The other part is actually using that data to reduce risk and that's happened really well on the container side. On the cloud side, there's still room to grow, but that's not an issue with Prisma Cloud itself. These tools are only a part of the equation. It takes a lot of organizational work and culture and prioritization to address the output of these tools, and that takes time.

The ability to monitor the artifact repository is one of the most valuable features because we have a disparate set of development processes, but everything tends to land in a common set of artifact repositories. The solution gives us a single point where we can apply security control for monitoring. That's really helpful.

Another valuable feature is the ability to do continuous monitoring at runtime. We can feed that data back to developers so they can get intelligence on what's actually deployed, and at what level, versus just what's in the artifact repository, because those are different.

In the security space, most security solutions typically do either development-side security, or they do runtime operational security, but not both. One of the relatively unique characteristics of this solution in the marketplace—and it may be that more and more of the container security solutions do both sides—is that this particular solution actually spans both. We try to leverage that.

And for the development side, we utilize both the vulnerability results from the static vulnerability scanning as well as the certain amount of configuration compliance information that you can gather from the static pre-deployment scans. We use both of those and we pay attention to both sides of that. Because this solution can be implemented both on the development side and on the runtime operational side, we look at the same types of insights on the operational runtime side to keep up with new threats and vulnerabilities. We feed that information back to developers as well, so they can proactively keep up.

We have multiple public clouds and multiple internal clouds. Some of it is OpenStack-based and some of it is more traditional VM-based. Prisma Cloud provides security spanning across these environments, in terms of the static analysis. When we're looking at the artifact repository, the solutions we're using Prisma Cloud to scan and secure will deploy to both public cloud and internal cloud. Moving into 2021, we'll start to do more runtime monitoring in public cloud, particularly in AWS. We're starting to see more EKS deployment and that's going to be a future focus area for us. It's extremely important to us that Prisma Cloud provides security across these environments. If Prisma didn't do that, that would be a deal-breaker, if there were a competitor that did. 

Public cloud is strategically very important to our company, as it probably is for many companies now, so we have to have security solutions in that space. That's why we say the security there is extremely important. We have regulatory compliance requirements. We have some contractual obligations where we have to provide certain security practices. We would do that anyway because they are security best practices, but there are multiple drivers.

Applying some of their controls outside of the traditional container space, for example, as we're doing hybrid cloud or container development, is helpful. Those things get their tentacles out to other areas of the infrastructure. An example would be that we look at vulnerabilities and dependencies as we develop software, and we use Prisma Cloud to do that for containers. We use other tools outside of the container space. They're starting to move into that other space so we can point Prisma Cloud at something like a GitHub and do that same scanning outside of the container context. That gives us the ability to treat security control with one solution.

When it comes to protecting the full cloud-native stack, it has the right breadth. They're covering all the topics I would care about, like container, cloud configuration, and serverless. There's one gap. There could be a better set of features around identity management—native AWS—IAM roles, and service account management. The depth in each of those areas varies a little bit. While they may have the breadth, I think there's still work to do in  flushing out each of those feature sets.

My understanding of Palo Alto's offerings is that they have a solution that is IAM-focused. It's called Prisma Access. We have not looked at it, but I believe it's a separately-licensed offering that handles those IAM cases. I don't know whether they intend to include any IAM-type of functionality in the Prisma Cloud feature set or whether they will just say, "Go purchase this separate solution and then use them next to each other."

Also, I don't think their SaaS offering is adoptable by large enterprises like ours, in every case. There are some limitations on having multiple consoles and on our ability to configure that SaaS offering. We would like to go SaaS, but it's not something we can do today.

We have some capability to do network functions inside of Prisma Cloud. Being able to integrate that into the non-cloud pieces of the Palo Alto stack would be beneficial.

The solution's security automation capabilities are mixed. We've done some API development and it's good that they have APIs, that's beneficial. But there is still a little disconnect between some of the legacy Twistlock APIs versus some of the RedLock APIs. In some cases the API functionality is not fully flushed out. 

An example of that is that we were looking at integrating Prisma Cloud scans into our GitHub. The goal was to scan GitHub repositories for CloudFormation and Terraform templates and send those to Prisma Cloud to assess for vulnerabilities and configuration. The APIs are a little bit on the beta-quality side. It sounds like newer versions that some of that is handled, but I think there's some room to grow. 

Also, our team did run into some discrepancies between what's available, API-wise, that you have to use SaaS to get to, versus the on-premise version. There isn't necessarily feature parity there, and that can be confusing.

We've been using Prisma Cloud by Palo Alto for about two-and-a-half years.

The stability has been excellent. The solution simply runs. It very seldom breaks and, typically, when it does, it's easy to troubleshoot and get back on track.

The scalability has been good for our use cases.

When we first adopted it, a single console could cover 1,000 hosts that were running container workloads. That was more than enough for us, and to date it has been more than enough for us, because we have multiple network environments that need to stay separated, from a connectivity standpoint. We've needed to put up multiple consoles, one to serve each of those network environments. Within each of those network environments, we have not needed to scale up to 1,000 yet.

There's wide adoption across our organizations, but at the same time there is tremendous room to grow with those organizations. Many organizations are using it somewhat, but we are probably at 20 to 25 percent of where we need to be.

It's safe to say we have several hundred people working with the solution, but it's not 1,000 yet. They are primarily developers. There are some operational folks who use it as well. To me, that speaks to the ease of deployment and administration of this solution. You really don't need a large operational group to deploy. When it comes to security, incident response, and the continuous monitoring aspects that a continual security team does, I don't have insight because I don't work in that area of the company, but I see that as expanding down the road. It's another area of growth for us.

Their technical support has been very good. Everyone that I've been involved with has been very responsive and helpful. They have remained engaged to drive resolution of issues that we have found.

We did not have a previous solution.

Standing up an instance is quite simple, for an enterprise solution. It has been excellent in that regard.

It's hard to gauge how long our deployment took. We have multiple consoles and multiple network contexts, and a couple of those have different sets of rules and different operational groups to work with. It took us several months across all those network environments that we needed to cover, but that's not counting the actual amount of time it took to execute steps to install a console and deploy it. The actual steps to deploy a console and the Defenders is a very small amount of time. That's the easiest part.

Our implementation strategy for Prisma Cloud was that we wanted to provide visibility across the SDLC: static scan, post-build, as things go to the artifact repository. Our goal was to provide runtime monitoring at our development, test, and production platforms.

We did it ourselves.

I don't know a better way to do it, but their licensing is a little confusing. That's due to the breadth of different types of technologies they are trying to cover. The way you license depends on where you're securing. When they were Twistlock it was a simple licensing scheme and you could tell what you were doing. Now that they've changed that scheme with Palo Alto, it is quite confusing. It's very difficult to predict what your costs are going to be as you try to expand coverage.

At the time we looked at our incumbent vendors and others that were container-specific. We were trying to avoid a new vendor relationship, if possible. We looked at Rapid7 and Tenable. Both were starting to get into the container space at the time. They weren't there yet. We did our evaluation and they were more along the lines of a future thought process than an implementable solution.

We looked at Twistlock, which was a start-up at the time, and Aqua because they were in the space, and we looked at a couple of cloud solutions, but they were in cloud and working their way to container. We did the same exercise with Evident.io and RedLock, before they were purchased by Palo Alto. They were the only vendors that covered our requirements. In the case of Twistlock, their contributions in the NIST 800-190 standards, around container security, helped influence our decision a little bit, as did the completeness of their vision and implementation, versus their competitors.

My advice would be not to look at it like you're implementing a tool. Look at it like you're changing your processes. You need to plan for the impact of the data for the various teams across Dev and Security and Ops. Think very holistically, because a lot of this cloud container stuff spans many teams. If you only look at it as "I'm going to plug a tool in and I'm going to get some benefit," I think you'll fail.

Prisma Cloud covers both cloud and container, or could cover either/or, depending on your needs. But in both of those cases, there's often confusion about who owns what, especially as you're creating new teams with the transition to DevOps and DevSecOps. Successful implementation has a lot to do with working out lines of ownership in these various areas and changing processes and even the mindset of people. You have to make strides there to really maximize the effectiveness of the solution.

The solution provides Cloud Security Posture Management in a single pane of glass if you're using the SaaS solution, but we do not. Our use case does not make it feasible for us to use the SaaS solution. But with the Prisma Cloud features and compute features in the self-hosted deployment, you have to go to multiple panes to see all the information.

When it comes to the solution helping us take a preventative approach to cloud security, it's a seven or eight out of 10. The detective side is a little higher. We are using the detective controls extensively. We're getting the visibility and seeing those things. There is a lot of hesitance to use preventative controls here, both on the development side—the continuous integration stuff—and particularly in the runtime, continuous monitoring protection, because you are just generally afraid. This mirrors years and years ago when intrusion prevention first came out at the network level. A lot of people wanted to do detection, but it took quite a few years for enterprises to get the courage to start actively blocking. We're in that same growth period with container security.

When it comes to securing the entire cloud-native development lifecycle, across build, deploy, and run, it covers things pretty well. When I think about it in terms of build, there are integrations with IDEs and development tools and GitHub, etc. Deploy is a little shakier to me. I know we have Jenkins integration. And run is good. In terms of continuous monitoring, it feels build and run are a little stronger than deploy. If we could see better integration with other tools, that might help. If I'm doing that deploy via Terraform or Spinnaker, I don't know how all that plays with the Jenkins integrations and some of the other integrations that Palo Alto has produced.

Overall, it feels like a pretty good breadth of integrations, as far as what they claim. They certainly support some things that we don't use here at build and deploy and runtime. But a lot of what they rely on, in terms of deploy, is API-driven, so it's not an easy-to-configure, built-in integration. It's more like, "We have an API, and if you want to write custom software to use that API, you can." They claim support in that way, but it's not at the same level as just configuring a couple of items and then you can scan a registry.

In the container space, we have absolutely seen benefit from the solution for securing the cloud-native development lifecycle. At the same time, it has required some development on our part to get the integration. Some of that is because we predated some of the integrations they offer. But in the container space, there has definitely been a huge impact. The impact has been less so in cloud configuration, because there are so many competing offerings that can do that with Terraform and Azure Security Center and Amazon native tools. I don't feel like we've made quite the same inroads there.

In terms of it providing a single tool to protect all of our cloud resources and applications, I don't think it does. Maybe that's because of our implementation, but it just doesn't operate at every level. I don't think we'd ever go down that path. We have on-premise tools that have been here a long time. We've built processes around reporting. Vulnerability scanning is an example. We run Nessus on-premise, and we wouldn't displace Nessus with, say, a Twistlock Defender to do host-level scanning in the cloud, because we'd have a disparate tool set for cloud versus on-premise for no reason. I don't ever see Prisma Cloud being the single solution for all these security features, even if they can support them.

It's important that it integrate with other tools. We talked earlier about a single dashboard. A lot of those dashboards are aggregating data from other tools. One thing that has been important to us is feeding data to Splunk. We have a SIEM solution. So I would always envision Prisma Cloud as being a participant in an ecosystem.

In summary, I actually hate most security products because they're very siloed and you have mixed-vendor experiences. I don't think they take a big-picture view. I've been really pleasantly surprised with how Prisma Cloud is, over time, covering more and more of the topics I care about, and listening to customer feedback and growing the product in the right directions. For the most part, it does what they say it will do. The vendor support has also been good. I would definitely give the vendor an eight out of 10 because they've been great in understanding and providing solutions in the space, and because of the reliability and the responsiveness. They've been very open to our input as customers. They take it very seriously and we've taken advantage of that and developed a good relationship with them.

When it comes to the solution itself, I would give the compute solution an eight. But I don't think I would give the Prisma Cloud piece an eight. So overall, I would rate the solution as a seven because the compute is stronger than the other piece, what used to be RedLock.

I would also emphasize that what I think is a strong roadmap for the product and that Palo Alto is really interested in customer feedback. They do seem to incorporate it. That may be our unique experience because our use cases just happen to align with what Palo wants to do, but I think they're heading in the right direction.

Early on in a solution's life cycle or problem space, it's more important to have that responsiveness than it is even to have the fullest of solutions. The fact that we came across this vendor, one that not only mostly covered what we needed when we were first looking for it three years ago, but that has also been as responsive as they have to grow the solution, has been really positive.

Primarily, we are attempting to secure our public cloud security posture through compliance and vulnerability scanning.

Overall, the solution is effective for helping us take a preventative approach to cloud security. We have managed to remediate thousands of high impact misconfigurations or vulnerabilities that have been detected by the tool.

It is how we are securing access to these public facing resources, i.e., how we are locking down S3 buckets, RDP to EC2 instances, or other administrative access that might otherwise allow easy compromise. The value to the business is simply just securing these cloud assets in alignment with security policies and best practices that we have defined.

The comprehensiveness of the solution is good for securing the entire cloud-native development lifecycle, across build, deploy, and run. We are exclusively an Azure DevOps shop. Thus, we are well-aligned with the capabilities that Prisma offers. Its ability to participate in and integrate with the DevOps lifecycle has been very good for us.

Prisma Cloud has enabled us to integrate security into our CI/CD pipeline and add touchpoints into existing DevOps processes. We are integrated in a handful of CI/CD pipelines at the moment. These touchpoints are fairly seamless in our DevOps processes. We are performing the scan and failing builds automatically without developer involvement, but we use the Visual Studio plugin. Therefore, developers can self-service scan their work prior to the build process. It is both seamless and on-demand for the people who choose to use it.

The integration of security into our CI/CD pipeline has affected collaboration and trust between our DevOps and SecOps teams has improved, though there is some diplomacy that has to occur there. The way that it's improved: We approached vulnerability management and cloud security posture with these teams historically by presenting them a list of findings, like a laundry list of things they need to go fix. These teams aren't staffed for moving backwards and fixing old problems, so we established a process for working with them that starts with securing net new development. We can do that without much of an ask, in terms of their time, by having these integrations into their CI/CD pipeline along with self-service scanning tools. So, we have the capability of securing new development while they are completing the lengthy task of reviewing and remediating existing deployments.

The solution provides risk clarity at runtime and across the entire pipeline, showing issues as they are discovered during the build phases. We are applying the same secure configuration baseline scans in the pipeline that we're doing for the deployed assets. Most of the time, our developers can correct these issues.

The Twistlock vulnerability scanning tool is its most valuable feature. It provides us insight into security vulnerabilities, running inside both on-premise and public cloud-based container platforms. It is filling a gap that we have with traditional vulnerability scanning tools, where we don't have the ability to scan inside containers.

Prisma Cloud provides security spanning multi- and hybrid-cloud environments. This is of critical importance to us because we have workloads in multiple cloud providers as well as having them on-premise.

The solution provides the following in a single pane of glass:

• Cloud Security Posture Management
• Cloud Workload Protection
• Cloud Network Security
• Cloud Infrastructure Entitlement Management.

These are all critical and challenges that we have faced. We have been unable to find solutions using native tools from cloud providers. We use AWS and Azure in production along with GCP in testing.

Prisma Cloud provides us with a single tool to protect all our cloud resources and applications, without having to manage and reconcile disparate security and compliance reports. The Redlock portion of the tool and reporting are better. There are still some gaps in terms of our ability to trend over time periods. However, in terms of point-in-time snapshot reporting, the tool is very good. What we have done is automated the process of compiling these trendline reports on a weekly basis to capture those metrics, then take them offline so we can build our own dashboarding to fill in the tool's gaps.

We are using the solution’s new Prisma Cloud 2.0 Cloud Security Posture Management features. These features give our security teams alerts, with context, to know exactly what are the most critical situations. This is critical because we have insight into new assets that are deployed out of spec, but have otherwise not been enabled for auto remediation. The challenge there has been that we deploy these policies, and if someone's not sitting there watching the console, then they might miss these misconfigurations where time is of the essence. The learning and context are important in order to prioritize how quickly we need to triage these findings.

The new Prisma Cloud 2.0 features provide our security teams with all the data that they need to pinpoint the root cause and prevent the issue from recurring. It is less data requirement gathering that has to happen in the middle of an incident or remediation. If the alerts themselves have all the context you need to address those, then it's just less legwork required to find the problem and fix the misconfiguration.

The alignment of Twistlock Defender agents with image repositories needs improvement. These deployed agents have no way of differentiating between on-premise and cloud-based image repositories. If I deploy a Defender agent to secure an on-premise Kubernetes cluster, that agent also tries to scan my ECR image repositories on AWS. So, we have limited options for aligning those Defenders with the repositories that we want them to scan. It is scanning everything rather than giving us the ability to be real granular in choosing which agents can scan which repositories. This is our biggest pain point.

There are little UI complexities that we work around through the API or exporting.

I have been using it for about nine months.

In general, the stability is very good. As a SaaS tool, we have high expectations for how it performs, and we did have some growing pains in that regard around the console upgrade in October. 

The work that we have ongoing maintenance-wise is from a policy perspective. We have custom policies that we deploy above and beyond the CIS Benchmark policies deployed with the tool. As we deploy new services, start to use new tools, and as the cloud vendors roll out new services, there is policy work which goes along with that. However, the bulk of the work is still in meeting with business units who are responsible for deploying these applications and keeping them on track with their remediation activities.

The scalability is very good. The notable exception is on the Lambda function side. We have had some challenges with its ability to scale up and scan all versions of deployed functions in a timely fashion. Otherwise, in the container space and public cloud space on the RedLock side, it has been very good in terms of scaling up to meet our demands.

25 people use this solution. Seven of those would be people on the cloud SecOps team, and the balance of them would be a mix of developers, DevOps engineers, and incident response.

There are dozens more pipelines for us to integrate with. The bulk of the growth will be organic to new app teams, who are in different business units in the enterprise.

The technical support is pretty good. In most instances, they are responsive. They meet their SLAs. They are eager to engage with R&D or their engineering teams when necessary to escalate issues. 

Prisma Cloud provides the visibility and control that we need, regardless of how complex or distributed our cloud environments become. Our security and compliance postures are significantly improved through the implementation of this tooling, mostly because we had poorly supported open source tooling acting in this capacity previously. We were using the Scout2, because it was free, which was not nearly as fully featured or capable.

I have led this team since the beginning. The initial setup was harder when we did it than it is now. We had to go through individual AWS accounts, configuring IAM permissions and things like that, on an account by account basis. Whereas now, that happens automatically through AWS Organizations integration. While the setup was good then, it is better now.

It took us three months to have all the resources onboarded.

Our implementation strategy varied because there are so many elements of the tooling. We started with RedLock and the public cloud compliance pieces, starting with the sandbox accounts and validating the results and things of that nature. We then moved out to the larger Cloud COE as a whole and started onboarding production accounts. After that, we started meeting with the COE and app teams to socialize the findings and explain the remediation steps and go through all of that.

We broke the Twistlock stuff into a separate project phase. The deployment approach there was similar to the implementation strategy. We started with the sandbox teams and public facing apps, socializing the findings, then going through the vulnerability structure and compliance structure with them. Once we had established a rapport with them and they understood the goals of the program, then we started pushing for integration into the CI/CD pipelines, etc.

We have seen ROI. I feel like it is a good value. I am not going to say for sure that we couldn't have leveraged the same results from one of the competing platforms, but you don't need to prevent many security incidents to realize the value of an investment like this. We have identified and secured many misconfigurations and remediated a lot of vulnerabilities that I feel like we have gotten our value out of the tool.

Prisma Cloud has reduced our runtime alerts by 25 percent through the nature of developers being able to fix their own code by shifting the responsibility of identifying misconfigurations and vulnerabilities. Fewer runtime alerts are making it to runtime because they are fixing security or compliance issues earlier in the process.

Our alert investigation time is much better and has been reduced by 75 percent.

The pricing and licensing are expensive compared to the other offerings that we considered.

We also looked at Aqua Security and Rapid7 DivvyCloud. Capabilities-wise, these commercial solutions have similar offerings. The two primary differentiators with Palo Alto were:

1. It was by far the most mature solution. They had acquired that maturity through getting the most baked startups, then rebranding and rolling them under the Prisma banner. So, they were the most mature platform at the time. 
2. There was an element of wanting to have that single pane of glass management. They had a SaaS solution that we felt would scale to our large cloud environment. 

Have a clear plan for how you will structure your policies, then decide right from the get-go if you will augment the delivered policies with your custom ones to minimize the amount of rework that you need to do. Likewise, make sure that the ticketing application that you are planning to integrate with, if you're going to track remediation activities, is one that is supported. If not, have a plan for getting that integration going quickly.

Biggest lesson learnt: Do better planning for that third-party and downstream integration that you will be doing with your ticketing platform. Right out of the gate, our options were rather limited for integration and ticketing. It seemed to be geared around incident handling or incident response more than compliance management or vulnerability response.

The solution is comprehensive for protecting the full cloud native stack. It covers nearly all of our use cases. The gaps present are more a function of API visibility that we get from Azure, for example. As they roll out or make generally available new services, there is a lag time in the tool's ability to ingest those services. However, I think that is more a function of the cloud platforms than Prisma Cloud.

This solution is a strong eight out of 10.