Coming October 25: PeerSpot Awards will be announced! Learn more
Buyer's Guide
Container Security
August 2022
Get our free report covering Palo Alto Networks, Aqua Security, Snyk, and other competitors of Qualys Container Security. Updated: August 2022.
632,611 professionals have used our research since 2012.

Read reviews of Qualys Container Security alternatives and competitors

TejasJain - PeerSpot reviewer
Sr. Cloud Security Architect at a computer software company with 10,001+ employees
Real User
Top 10
Provides a single pane of glass for all our cloud resources to control all these different functionalities from various menus
Pros and Cons
  • "Prisma Cloud helped us with compliance. Most of my deployments have been greenfield, so I don't have a benchmark to compare how the security posture has improved. I've always used this from day zero of the configuration. However, I can say that the compliance checks for PCI, DSS, HIPAA, etc., made my life simpler. I don't need to look at each of these standards and compare the rules I have in place."
  • "A better correlation between the multiple products Prisma Cloud contains would be crucial. It would reduce the time spent looking at reports and enable you to get all the actionable insights across products. I think that Palo Alto is working on it, but they need to work faster because it doesn't make sense to have all these products in a single pane of glass without any correlation between them."

What is our primary use case?

We use Prisma Cloud primarily for clients with a multi-cloud environment who require all these posture checks to be done uniformly from a single pane of glass to ensure they are in compliance. They have regulatory policies that require integration with the SIEM to generate alerts and reports. That's the primary use case for a CSPM solution. For cloud workload protection, we need vulnerability management, runtime defense, as well as image, container,  and registry scanning.

In terms of modules, we started with Redlock, the cloud security posture management component, and followed with Twistlock for cloud workload protection. Lately, I've been using Aporeto for identity-based micro-segmentation and BridgeCrew for cloud security.

Identity-based micro-segmentation allows you to create microparameters across workloads on the cloud and on-premises. You can enforce a pure wireless model through whitelisting flows in various workloads. Cloud security is primarily for core security, including SaaS and PaaS tools for scanning container images and core infrastructure. We have Terraforms, which we need to scan if we forget to remove any passwords or if there is some consideration drift between what you've configured in the IaC and what has materialized into the cloud infrastructure. 

I don't think we have had more than four or five admins for any project. We provide read-only access to the monitoring guys and custom authentication authorization privileges to a couple of users. The number of authorized users varies from plan to plan. Lots of people don't need to have access to the solution. 

How has it helped my organization?

Prisma Cloud helped us with compliance. Most of my deployments have been greenfield, so I don't have a benchmark to compare how the security posture has improved. I've always used this from day zero of the configuration. However, I can say that the compliance checks for PCI, DSS, HIPAA, etc., made my life simpler. I don't need to look at each of these standards and compare the rules I have in place.

It also enabled us to adopt a preventative approach to security. It gives us an option to monitor and remediate, so I don't think there is any challenge. If we see something going wrong, the solution offers a way to implement preventative controls. 

You can incorporate Prisma into DevSecOps and put it into any of the pipelines, like Jenkins and Azure DevOps. I don't think there are any challenges. You have all the ready-made plugins on these CI/CD tools, so you don't need to do or write a custom script plugin or anything. It's already available. It takes care of your end-to-end security from build to deployment and runs.

The cloud workload protection module Twistlock has ready-made plugins. Still, I don't think there was a plunging for identity-based micro-segmentation sites in the past, so we had to build a pipeline manually, I think they released a plugin for IBMS, but I never worked on it.

Prisma provides a single pane of glass for all our cloud resources to control all these different functionalities from various menus. It also helps us assess risk at runtime and throughout the whole pipeline. I have never compared Prisma with other tools, like Qualys or Tenable, so I cannot say which gives better results regarding runtime. However, I get a lot of actionable insights and suggestions from the tool about the next steps to follow.

The solution provides excellent security coverage of multi-cloud and hybrid environments. Without it, I would need to create a manual playbook for each cloud. There is a lot to maintain for each cloud, and you can't monitor from a single pane of glass. That's an administrative nightmare because you can't pull compatible reports. If I identify some compliance issues on AWS, I don't have a similar set of parameters to compare those for Google Cloud or Microsoft Azure. I definitely need this for a multi-cloud environment. 

I can get a relatively good amount of end-to-end security within the cloud. All these pieces fit together to address all my cloud needs. Of course, I don't think any vendors target security within the microservices, analytics, or data warehouse. I'm unsure because I haven't done it, but I don't think anything is missing.

It gives developers the tools they need to correct issues so they do not have to write their own scripts. Sometimes, I need an administrator to work with these developers, so it's not fully automated. Maybe I didn't find the best way to do it. Perhaps I need to find a linter or something, but there were many instances where I needed to involve someone to work with the developer. I don't think we are doing everything from the developer's end. 

Prisma also substantially reduced alert investigation times because we previously did everything by hand. We used to scan it manually, so it depended on the periodicity of scans. Earlier, we used to run scans for a couple of customers about every 15 days, and then we did the remediation. Now, all these scans run every minute or 15 minutes, so it's faster.  

What is most valuable?

Prisma's identity-based micro-segmentation is better than all its competitors. I've already evaluated Guardicore and Illumio, but Prisma stands out for the ease of configuring rules and how seamlessly it works with your cloud workloads and container environments. I used it for Kubernetes as well as K3s. I prefer Prisma's identity-based micro-segmentation. I can't think of any competitors doing this as well as Prisma Cloud.

We integrated this solution as a part of DevSecOps, so we have a dedicated pipeline for cloud workload protection. That works brilliantly. You don't need to log in to the control unless you want to do some management or full reports. I can bake in all these functionalities within the pipeline, and I can do the same for IBMS. 

As part of application security or whatever my developers are working on, I can have them bake all the configurations they need to do, like listening and patching remediation. I think it's relatively automatic, but I would consider it to be more of a DevSecOps functionality.

What needs improvement?

Prisma is the result of multiple Palo Alto acquisitions, like CWPP, Twistlock, and Aporeto. Though they are part of a single pane of glass, there is no correlation between the solutions. I don't see vulnerability scans done for tools that have been micro-segmented. 

A better correlation between the multiple products Prisma Cloud contains would be crucial. It would reduce the time spent looking at reports and enable you to get all the actionable insights across products. I think that Palo Alto is working on it, but they need to work faster because it doesn't make sense to have all these products in a single pane of glass without any correlation between them. 

At some point, things get a bit unwieldy when working with complex environments, but I don't think that challenge is unique to Prisma Cloud. It's an issue for any solution deployed in massive and complex environments. Let's say you have an enterprise with 30,000 workloads in the cloud, so it's unwieldy to have it configured for a single instance of Prisma Cloud. In that case, it would be better to segregate it across multiple tenants.

In the future, I'd like to see Palo Alto create a single consolidated agent software for workload production and identity-based micro-segmentation. Currently, I need to install two agents for the same platform to get two different functionalities. The second is maybe ease of licensing. That would also be helpful.

For how long have I used the solution?

I have been using Prisma Cloud for nearly three and a half years.

What do I think about the stability of the solution?

I never faced any challenges because of internal hardware issues or the agent. Because I've always worked on the cloud-managed version, we have never faced any problems with the functionality. We did have a couple of hangups with the user and administrator onboarding and privileges, but I don't think that affects the functionality of the overall product.

What do I think about the scalability of the solution?

The product itself is scalable, but it can become unwieldy from the administrative side of things. I can push Prisma Cloud out for 10,000 workloads, but the reporting and management would be a bit difficult. I prefer to have it segmented across multiple tenants, but it's somewhat complicated. 

How are customer service and support?

I rate Palo Alto support a nine out of ten. My company is a CPSP partner with premium support, so I can't speak to the typical support experience. Even if we don't raise a ticket, we have an internal account manager to take care of all this. 

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

Redlock was the original company doing CSPM, so I got into Prisma Cloud because they acquired Redlock. I previously used  Qualys and Tenable for vulnerability management. I thought putting the CSPM and cloud workload protection pieces of Prisma Cloud under one roof would simplify my life.

Also, all these are cloud-managed and take care of the end-to-end requirements for cloud workloads. Qualys and Tenable have all these vulnerability management capabilities, but they might lack some native remediation capabilities. It's not that the other products are falling short, but I need that consolidated single pane of glass for cloud security. 

How was the initial setup?

Setting up Prisma Cloud is straightforward. You get an activation email and deploy a couple of scripts. I work for a consulting firm that is a CPSP partner. All I needed to do is email Palo Alto with a bill of material describing our environment and the components, and then we get the activation email. After that, I followed the self-service enrollment steps, and it's running. Depending on your environment, you need to install all these applications. It's a seamless onboarding experience.

The total deployment time varies depending on the client because some of them have restrictions. One mid-sized company with around 700 workloads took less than three weeks. However, we needed to do a step-by-step approach for some, moving from the on-premises environment to the cloud and from dev to production. Those deployments took a couple of months.

Usually, the deployment requires no more than two or three people, but it depends on the approach. One should be enough if it's a batch approach. I've been doing this alone for a lot of my clients. In some situations, if you may need some help troubleshooting an app that isn't working, or the client may need someone with specialized expertise. It also depends on the client's size. At most, you'll need a half-dozen.

What was our ROI?

It's a costly solution, so we spend a lot on the licenses. At the same time, we can perform compliance checks, external audits, etc., faster because we have all the right pieces in place. That definitely helped, but I've never calculated the total cost of ownership or return on investment.

What's my experience with pricing, setup cost, and licensing?

Prisma Cloud Enterprise is a costly solution. You need a license for all the components. At the same time, you have everything under one roof, so I think it's still justified. 

What other advice do I have?

I rate Prisma Cloud an eight out of ten. I deduct a couple of points because I would still like to see all the products in the platform correlated. They should also do away with the need to install multiple agents for various functionalities or burn it all down into a single agent that takes care of it.

My advice is to start early if you are moving from on-premises to a hybrid or cloud environment. Implement Prisma Cloud as soon as possible, especially for greenfield deployments. This isn't a problem with Prisma Access, but it's usually a challenge. You need time to customize your rules and tailor them to your setup. 

The second recommendation I have is for Prisma Cloud Compute, the cloud workload protection piece. It's available in self-managed and cloud versions. You should opt for the cloud-managed version because you can get two single-cloud platforms. 

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate
Buyer's Guide
Container Security
August 2022
Get our free report covering Palo Alto Networks, Aqua Security, Snyk, and other competitors of Qualys Container Security. Updated: August 2022.
632,611 professionals have used our research since 2012.