Wiz alternatives and competitors

I use it for our cloud security posture. Initially, the idea was to increase visibility because we had zero visibility into our cloud environment.

Orca provides agentless data collection directly from your cloud configuration and from the workload runtime block storage. They call it SideScanning. What it does is it copies the image of the assets and then the solution does all its analysis on the side. It just records the image and then looks at it. It sees everything that is installed on the image, like type of data, packages, applications, and the audit log. It can even see into ODD and other activity logs that are not collected by default by DevOps. It provides you with great visibility into each asset, including containers, storage devices such as RDS, CCS, and EC2, and S3—all the basic and major components in cloud environments. And that's true not only for AWS, but for all three cloud providers.

This agentless approach means there is zero performance impact. That's the whole idea. The only thing it does is copy the image and then it does the scan which is a read-only operation. It doesn't use the computing resources. That makes it very lightweight.

The agentless collection of data enables Orca to see assets within their environmental and business contexts and prioritize truly critical security issues. It sees things very clearly and you get a notification, alerts to Slack or whatever system you are using. We have also exported the alerts to our Splunk environment, to cross-reference them with other systems as well. It provides great focus on the right and the most important topics that we should attend to first.

In terms of consolidating vendors, Orca solved a few issues for us. Because we came across it very early in the process of picking tools for our cloud environment, we saved a lot of money by not having to pick multiple different tools to cover different aspects of cloud security. We had good timing when we picked Orca, rather than various tools to do the same job. If you have multiple scanners and you install Orca, you can remove the other ones. That's great and will save you money and a lot of working hours. A lot of the work we did previously was done manually. Now, we get good visibility and it saves manpower as well.

We didn't have anything, and Orca solved three or four different problems in a single tool. If I had had to buy three different tools, obviously it would cost more, but I can't estimate how much the difference would have been. What I can say is that Orca has saved us at least half of a SecOps FTE, at least in the beginning when I didn't have a team and did most of the work and the monitoring myself. It has saved me a lot of time, because I needed a lot of DevOps resources to help me before we had Orca. When I installed Orca, I became very independent. That was really a great feeling.

Orca gives you great visibility into your assets. It shows you the issues and the things that you need to attend to first, by prioritizing things. You can see a lot of information that is not always visible, even to DevOps, to help you know about the machines and their status. It's very easy to see everything in a single dashboard. That makes it a very useful tool.

The fact that it prioritizes vulnerabilities and findings, and doesn't present you with hundreds of unuseful findings, is important. They focus the information and make you concentrate on the high-priority items. This is something that differentiates it from the others.

They also now have the ability to filter findings based on best practices, like CIS, PCI, and even GDPR. That means you can filter your environment based on a specific filter, and that helped us when doing our PCI audit. We were able to show the auditors what our environment looks like from a PCI perspective. That's another great feature that it offers.

It's also very easy to use, very intuitive, and very detailed.

Another new feature shows you outliers and abnormalities for IAMs and access. It focuses on users with too many permissions and provides you with recommendations on what to do as a result.

There is a feature that searches for secrets on your infra and what can be done with those secrets.

You can also do very complex search queries to find assets that you think may be relevant. For example, searching for Log4g references in the infrastructure was very easy.

I also like the fact that the solution includes the most potentially painful parts, out-of-the-box, like malware and secrets scans, IAM, attack vectors, and benchmarks against CIS and other best practices. That full suite is something that every security professional needs. It solves the issue of having to run multiple tools, such as a vulnerability scanner, a secrets scanner, and a role management/permission/authorization tool that searches for abnormalities. I think it's a no-brainer, given that it runs everything, and you don't need to pick and choose anything. Everything comes out-of-the-box and is very easy to use, plug-and-play, and you get an instant view of things on the dashboard.

The main drawback in an agentless approach is that if the solution detects a virus or malware in the environment, we need to manually remove it. But from my experience with other production environments, it's not straightforward to install agents in the hope they will automatically remediate viruses, even from production environments. If you make mistakes, you can cause huge damage to your environment and, when it comes to production, there is zero tolerance for errors. And realistically, you can't use the most important feature of an agent, which is the remediation, because remediating on production is not something that is easy to do.

Orca's agentless approach makes more sense. Even if you have an agent, it takes resources. In addition, you need to deploy, maintain, and update an agent, which amounts to a lot of unnecessary work. And lastly, while it's true that an agent sees more when compared with an agentless solution, the gap is very small.

In the end, to make sure that we progress and that our security level is increasing, we need to take action. Orca is only a detection tool. It shows you the problems, but you need to make sure that the problems are fixed. It's a fair trade-off because production is a different environment. It's not like endpoint security where the cost of ruining an endpoint is worth the risk. You would rather kill an endpoint than risk being infected with malware. But this is not the same approach for data center or cloud security.

Ultimately, the ability to auto-remediate is something that I would like to see.

I've been using Orca Security for two years or so.

It's very available. We have never faced issues with the platform not functioning or not responding. It's a very stable tool that works and runs as expected.

We haven't noticed any scalability issues because we haven't had any performance issues with the tool. It's always up and running and we consume it as a service.

We have more than 10 Amazon accounts with tens of thousands of assets, including containers, which are a huge piece of the resource pool.

The team is fully supportive and we get everything we need. They're very responsive to our needs and feature requests. We benefit very much from the team and from the tool. They're doing a great job.

Positive

At first, we used an open-source solution and we did periodic scans on the cloud environment, but we were quite blind. Later, when I met the Orca team, they were in a very early stage and I decided to onboard them. The fact that we were blind was the main motivation for installing Orca. Now, the scanning happens constantly.

We now see everything, the whole cloud environment, including a small GCP implementation that we have. We have better coverage than our DevOps because DevOps doesn't have access to some of our subsidiaries, for example. We deployed Orca very quickly after buying some new companies and it gave us an edge over the DevOps team, because we saw way more compared to what they see.

It was super easy to connect the solution to all accounts, which is something that is not always so easy when you're taking it from a DevOps perspective. You do this from the dashboard. The fact that it is very easy to deploy is something that makes it stand out. Getting the coverage is very easy and it's super lightweight.

Deploying Orca for a single account takes a matter of minutes, if you have the right permissions or are an admin on the AWS environment. You just go to the console, copy-paste the ARN from AWS and put it in the Orca environment, and run a scan. The solution then does everything else in the background and starts the scanning process. It then takes a few more minutes, depending on the size of the environment. If it's a very large environment, it can take up to half an hour or so to show all the different assets. But from then on, that's it. Most of the work is done in the background.

The licensing is per-VM, but it really depends on the type of the environment. They offer large discounts if they see a customer as a potential strategic partner. Orca is very competitive when compared to the alternatives and is not the most expensive in the market, that's for sure.

At the time we looked at Orca, there weren't any competitors. I did meet with Palo Alto Prisma and Dome9, which were the main two alternatives to Orca then.

Now, there are other players. The main competitor is Wiz, which offers a very good suite. Lightspin offers the same type of solution, as does Aqua. You might include Ermatic if you count permissions/roles/IAM monitoring. Datadog also offers an agent-based system.

The main difference among these solutions is that there are two types of CSPMs. The first is agentless, such as Orca, Wiz, and Lightspin. The other vendors are agent-based, including Prisma Cloud, Dome9, Datadog, and, possibly Aqua. There are, of course, vulnerability scanners, like Qualys or Tenable, that are not based on agents, but they're limited to vulnerability scanning and are not full competitors.

The main advantage of Orca is that it is agentless, but still has great visibility into the assets and the cloud environment.

The second differentiator is the ability of Orca to prioritize and show you what you need to act upon. It doesn't bombard you with a lot of alerts that are meaningless and just create a lot of noise.

Another advantage is that Orca is very easy to deploy and very lightweight, compared to competitors, especially Wiz.

Orca was the first. I remember, as a design partner, at first there was something of a learning curve, especially for scanning S3 buckets. That can require a lot of resources and may result in an increase in billing. That is something that takes time to do properly. Orca has the advantage of being the first, and they bring a lot of field expertise and experience to avoid pitfalls and problems for newcomers to this market.

It's also a huge advantage that Orca is a SaaS offering. I don't like on-prem solutions. They require a lot of overhead and resources and you need to manage them. We work mostly with SaaS vendors.

Do a trial of Orca and check it against the current solution you have in place. You can assess how lightweight it is and the depth of insights that you get into the environment. Look at the new angles of visibility it will give you. It's very easy and you will see the differences instantly.

It's a great solution. It has solved so many problems for us. Before starting with Orca, I was blind. Think about someone who was blind and now they can see. It's a new world.

I'm using the main module of Prisma Cloud, which manages security at scale in cloud environments.

Prisma Cloud offers a very interactive UI that lets you work more effectively, faster, and more efficiently. It can also be used as a dashboard for querying the cloud provider since it integrates with most of the APIs of the cloud service providers. It's a very unique tool in the sense that it lets you centralize the security control of all your cloud providers.

The first aspect that is important is the fact that Prisma Cloud is cloud-agnostic. It's actually available for the five top cloud providers: AWS, GCP, Azure, Oracle, and Alibaba Cloud. 

The second aspect is the fact that we can write our own rules to try to detect misconfigurations in those environments.

And Prisma Cloud is a single tool that protects cloud resources and applications without having to manage and reconcile disparate security and compliance reports. That's the main purpose of the CSPM module of Prisma Cloud: You can manage every cloud platform, every cloud account, from a single place, which is the Prisma Cloud dashboard. It gives you a very high overview of every asset, a full site inventory. And you can see the context as well as the severity of the errors that have been raised on each service and asset that has been deployed in the cloud.

In my experience, Prisma Cloud is a valuable asset for enterprises that tend to have a lot of cloud-native applications and that wish to secure, and take control of the security posture of these applications. One of the most important considerations is that Prisma Cloud is a product from Palo Alto Networks, a company that invests heavily in cyber security. There are a lot of features that have come out over time. In the beginning, Prisma Cloud was known for its CSPM capabilities, but today, Prisma Cloud is doing a lot of things that are very beneficial for cloud-native applications.

There are a couple of things that can be enhanced. The first is the coverage that Prisma offers. Today, there are hundreds of built-in policies for AWS and Azure, but GCP and Oracle are not covered as much as AWS. There is a lot of work to do on that part. There is, obviously, a tiny bit of favoritism towards AWS because it has the most market share. It's logical, but the other cloud providers are not as well covered as AWS.

The second issue is the alerting process. Today, it does monitor the resources—and I'm only speaking on the CSPM side of things. Prisma Cloud scans the environment and checks if there are misconfigurations, but it lacks context. There is a real lack when it comes to taking into consideration how the application was designed. For example, you can have an application that is deployed with an open S3 bucket, which is one of the most basic services in AWS. Prisma will tell you that there is a high-severity alert because, with that bucket, there is a possibility of having your data extracted. But sometimes, the data inside those buckets is actually public. So, the process lacks some intelligence.

I've been using Prisma Cloud by Palo Alto Networks for 10 months.

I'm using the SaaS version which is running on Palo Alto's infrastructure, so I've never encountered instability. 

There is some patching behind Prisma Cloud when Palo Alto delivers new features so there are some "patch intervals," but most of the time, Palo Alto does notify you when something like that is coming up. It will say, "Hi. This Friday, the application will be unavailable from 6:00 PM to 7:00 PM." But it is not very disturbing at all.

Because I'm using the SaaS version, there is no issue with scalability. It all depends on the credits and the amount of money that you have put into the tool. Aside from that, you can use it to onboard any cloud account no matter how many resources are in it.

I have contacted their tech support many times, and they are pretty quick. They are very invested and proficient. I get answers within a day or two, at most.

Sometimes, when an issue becomes pretty complicated, it can span a week because it is transferred to different people.

Positive

I did not use another solution before Palo Alto.

We have definitely seen ROI in that using Prisma Cloud is an eye-opener regarding cloud security. In general, Prisma Cloud helped us see a lot of blind spots that we left when designing applications. There were a lot of security misconfigurations that we wouldn't have been able to spot without Prisma. The return on value is in the securing of the applications that we are deploying, as well as through a better understanding of the types of issues in the type of environment.

The cost is run by credits. You can allocate them as you wish, so there are no issues there. I believe the credits, licensing, et cetera, are based on the size of the enterprise that is buying the product.

There are no additional costs beyond the standard fees.

Wiz was one of the tools we looked at. I was not the only one who made the choice, but we went with Prisma because of its capabilities as well as the support. We are investing a lot in Palo Alto Networks, meaning we use a lot of their products, so we know the enterprise itself. We know the quality of their catalog of services.

My advice is to take your time before going the CSPM route. Look at your environments and inventory everything in it. There is, obviously, no shadow IT in the cloud. It's very easy to get an inventory of the resources you are running on. Get an overview and see if having a powerful CSPM at your side is really a need. There are a lot of open-source solutions that can do the job for smaller environments.

From what I understand, Palo Alto is trying to push Prisma Cloud to become more than a simple CSP tool, since it offers the ability to cover the global environment of cloud applications, such as doing scanning and infrastructure-as-code, and managing IAM, rather than doing it directly in the cloud provider. They are trying to centralize things.

It can also be used to manage containerized applications. It can do runtime security in container-based managed services of cloud providers, such as EKS (Elastic Kubernetes Service) which is a service managed by AWS. You can rely on Prisma to put an agent in such environments to monitor and supervise the security. You can also use it to scan the container images that are stored in repositories, whether they are on-premises or in the cloud. I've heard that Palo Alto is doing a lot of things like this, but as of today, I'm only using the CSPM part.

And in terms of security automation capabilities, I've used Checkov, which is the tool they are using for scanning specialized code like Terraform. In its origins, Checkov is an open-source tool and I've been using it with my clients by deploying it in CI/CD chains to scan, automatically, the code that is pushed inside repos and deployed in the cloud. But I have never used the Chekhov that is built into Prisma Cloud.

Similarly, I know Prisma offers the possibility of auto-remediation, but I have not enabled this option. It could be a bit dangerous because there is the context and a lot of things to take into consideration before blocking something, before deployment or after deployment. So, I have not used its preventive actions.

The solution provides visibility into complex or distributed cloud environments, but I can think of a couple of scenarios where clients might not think the same. It supports the top five clouds, but if you are using another cloud provider, you won't be able to use Prisma Cloud for that instance. You would be able to use the Compute module, but it would be very hard to use the CSPM capabilities on such a cloud provider since their APIs are not working with Prisma. But if you are using the most commonly used clouds, Prisma Cloud is a very valuable asset.

Prisma Cloud is a very powerful tool and it can be used in various scenarios, but it doesn't cover everything. You might choose a cloud provider that is not supported or prioritized by Prisma. If you are using Oracle Cloud or Alibaba, you might want to get another solution, maybe one that comes with better policies and a better investment in those technologies.

Aside from that, Prisma Cloud is a good solution if you are using a mainstream cloud provider. Prisma Cloud can help enhance your security posture. Because it's a Palo Alto product, you can be sure that there is a lot of maintenance behind it. The product will be able to keep up with the market. They will keep the features coming and it will continue to be a better product over time.