Aqua CNAPP

Reads cloud volume snapshots out-of-band to assess workloads for vulnerabilities, secrets, and misconfigurations without agents or touching running instances.

Correlates individual misconfigurations and CVEs into chained attack scenarios showing lateral movement paths from exposed entry point to a target asset. Produces a prioritized list of attack paths rather than a flat CVE inventory.

Exports compliance evidence pre-mapped to framework control requirements (SOC 2, ISO 27001, PCI DSS), in formats auditors can consume directly: not raw CSV exports requiring manual assembly.

Instruments workload behavior at the kernel level via eBPF without a traditional user-space agent. Provides syscall-level visibility into process execution, network connections, and file access in running containers and VMs.

Monitors running pod and container behavior against policy, detecting unexpected process execution, network connections, and privilege escalation at runtime rather than at image scan time.

Enforces a single policy definition across AWS, Azure, and GCP resource types, translating to provider-native configurations rather than requiring separate policy sets per cloud.

Delivers scan results inside developer IDEs and pipeline stages so developers receive findings before code merges, reducing the cost and cycle time of remediation.

Analyzes container images and dependencies for CVEs, malicious or compromised packages, and SBOM generation across the build pipeline.

Analyzes IAM policies across AWS, Azure, and GCP to surface over-permissioned roles, unused permissions, and cross-account trust relationships that create lateral movement opportunities.

Supports on-premises or air-gapped artifact and workload inspection under customer control, so regulated or sovereign data never leaves the customer boundary.

Continuously audits cloud and Kubernetes configuration across AWS, Azure, and GCP against security benchmarks, flagging misconfigurations and identity-permission gaps that create exploitable exposures.

Scans infrastructure-as-code templates (Terraform, CloudFormation, Kubernetes manifests, and Helm charts) for misconfigurations and policy violations before deployment, so issues are caught in the pipeline rather than in production.

Enriches cloud misconfigurations, vulnerable workloads, and runtime detections with threat intelligence on active exploitation, prioritizing exposures attackers use over theoretical severity alone.

Continuously discovers and inventories cloud resources across accounts, subscriptions, and projects so posture assessment runs against a current, complete picture of the environment rather than a stale or partial asset list. Coverage of newer and less common resource types varies across products.

Maps detected misconfigurations to specific control requirements across CIS Benchmarks, NIST 800-53, SOC 2, PCI DSS, HIPAA, and ISO 27001 in a single assessment pass.

Evaluates Terraform, CloudFormation, ARM templates, and Pulumi configurations at PR or pipeline time, catching misconfigurations before deployment.

Audits cloud service configurations across AWS, Azure, and GCP against security best practices and benchmarks, flagging misconfigurations such as public storage, permissive network rules, and disabled logging. Coverage breadth and per-service depth vary significantly across products.

Aggregates posture findings and policy enforcement across multiple cloud accounts, subscriptions, and projects from a single control plane, critical for organizations with 10+ cloud accounts.