Aqua Platform

Reads cloud volume snapshots out-of-band to assess workloads for vulnerabilities, malware, exposed secrets and misconfigurations without installing agents or touching running instances, on a configurable scan schedule. Coverage of Windows threat detection and file integrity checks in agentless mode varies across products.

Correlates individual misconfigurations, CVEs and excessive entitlements into chained attack scenarios showing lateral movement paths from an exposed entry point to a target asset, visualized on the resource graph. Produces a prioritized list of attack paths rather than a flat CVE inventory. Products differ in whether they show only possible paths derived from posture data or also actual paths confirmed from runtime and log telemetry.

Exports compliance evidence pre-mapped to framework control requirements (SOC 2, ISO 27001, PCI DSS), in formats auditors can consume directly: not raw CSV exports requiring manual assembly.

Instruments workload behavior at the kernel level via eBPF without a traditional user-space agent. Provides syscall-level visibility into process execution, network connections, and file access in running containers and VMs.

Monitors running pod and container behavior against policy, detecting unexpected process execution, network connections, and privilege escalation at runtime rather than at image scan time.

Enforces a single policy definition across AWS, Azure, and GCP resource types, translating to provider-native configurations rather than requiring separate policy sets per cloud.

Delivers scan results inside developer IDEs and pipeline stages so developers receive findings before code merges, reducing the cost and cycle time of remediation.

Analyzes container images and dependencies for CVEs, malicious or compromised packages, and SBOM generation across the build pipeline.

Maps the effective access of human and machine identities to compute, storage and data resources across AWS, Azure and GCP as an access relationship graph, surfacing over-permissioned roles, unused permissions, cross-account trust and toxic combinations of administrator permissions, and remediating them toward least privilege, including automatic revocation of excessive roles.

Supports on-premises or air-gapped artifact and workload inspection under customer control, so regulated or sovereign data never leaves the customer boundary.

Continuously audits cloud and Kubernetes configuration across AWS, Azure, and GCP against security benchmarks, flagging misconfigurations and identity-permission gaps that create exploitable exposures.

Scans infrastructure-as-code templates (Terraform, CloudFormation, Kubernetes manifests and Helm charts) for misconfigurations, policy violations and embedded secrets before deployment, gates CI/CD pipelines on the resulting risk, and detects drift between the IaC definition and the deployed resource. Depth of productized pipeline integration and drift remediation varies across products.

Enriches cloud misconfigurations, vulnerable workloads, and runtime detections with threat intelligence on active exploitation, prioritizing exposures attackers use over theoretical severity alone.

Assesses the configuration of Kubernetes clusters and managed orchestrators (EKS, AKS, GKE, ECS, Fargate, OpenShift) against best-practice templates, surfacing cluster misconfigurations, weak RBAC, exposed control planes and configuration drift, and driving their remediation. Distinct from runtime workload monitoring: this is the posture of the orchestrator itself.

Continuously discovers and inventories cloud resources across accounts, subscriptions and projects so posture assessment runs against a current, complete picture of the environment rather than a stale or partial asset list, and groups resources into collections by custom tags and account scope for targeted policies and reports. Coverage of newer and less common resource types varies across products.

Maps detected misconfigurations to specific control requirements across CIS Benchmarks, NIST 800-53, SOC 2, PCI DSS, HIPAA, and ISO 27001 in a single assessment pass.

Applies the same posture policies and compliance benchmarks used against live cloud accounts to Terraform, CloudFormation, ARM templates and Pulumi configurations at pull-request or pipeline time, so a misconfiguration is caught before it appears in the deployed posture. Pipeline gating, secrets detection and drift remediation in IaC scripts are separate IaC security capabilities.

Audits cloud service configurations across AWS, Azure, and GCP against security best practices and benchmarks, flagging misconfigurations such as public storage, permissive network rules, and disabled logging. Coverage breadth and per-service depth vary significantly across products.

Aggregates posture findings and policy enforcement across multiple cloud accounts, subscriptions, and projects from a single control plane, critical for organizations with 10+ cloud accounts.

Audits configuration, compliance and entitlements on cloud platforms beyond AWS, Azure and Google Cloud, including Alibaba Cloud, Oracle Cloud Infrastructure, Tencent Cloud, IBM Cloud and OpenStack, using the same policy set applied to the hyperscalers. Which secondary platforms are supported, and at what check depth, varies significantly across products.

Chains misconfigurations, exposed network paths, vulnerable assets and excessive entitlements into possible attack paths from internet-facing entry points to sensitive resources, visualized on the cloud resource graph, so posture findings are prioritized by exploitability rather than severity alone. Built from configuration and identity posture data rather than runtime telemetry.

Monitors AWS Lambda, Google Cloud Functions, and Azure Functions for behavioral anomalies, insecure configurations, and runtime threats during execution.

Monitors process execution, network connections and file system activity in running workloads through a kernel agent, eBPF sensor or sidecar container to detect behavioral anomalies and known attack patterns, including runtime privilege escalation, container escape attempts and unusual outbound network activity. This is the agent-based workload protection archetype; kernel-based versus non-kernel detection methods and Windows versus Linux coverage vary across products.

Scans container image layers for OS package CVEs and application dependency vulnerabilities at build time, registry push, or pre-deployment, before execution.

Enforces pod security standards, network policies and RBAC controls across Kubernetes clusters, blocks non-compliant or unscanned images at admission control, and detects policy drift on managed orchestrators (EKS, AKS, GKE, ECS, Fargate) using best-practice configuration templates.

Detects in-memory exploitation techniques (shellcode injection, heap spraying, ROP chains), in running workloads without relying on file-based signatures.

Captures a continuous record of workload events (process, network, file, syscall) for forensic investigation of incidents in running workloads.

Mitigates workload vulnerabilities in runtime through virtual patching, workload isolation and segmentation, and management of running services and processes.

Blocks the underlying attack technique (for example malicious syscalls or insecure deserialization paths) inside running workloads, so one rule mitigates entire CWE classes of CVEs, including undiscovered ones, without downtime or code patches.

Determines which vulnerable libraries and functions are actually loaded and executed in running workloads, with call stacks and root cause analysis, to prioritize exploitable vulnerabilities over theoretical ones.

Assesses virtual machines, containers and serverless functions for vulnerabilities, malware, exposed secrets and misconfigurations by reading disk snapshots and cloud provider APIs, without deploying an agent, on a configurable scan frequency. Covers workloads where an agent cannot be installed, at the cost of point-in-time rather than real-time visibility. Malware detection, file integrity monitoring and Windows threat coverage in agentless mode vary across products.

Detects and remediates malware and ransomware on running virtual machines and container hosts across Windows and Linux, combining file scanning with behavioral indicators such as mass encryption, with the option of automated quarantine or process termination. Distinct from memory protection: this covers malicious files and payloads rather than in-memory exploitation techniques.

Verification of build integrity and artifact provenance through signing, attestation, and change attribution.

Assessment and policy enforcement of CI/CD pipeline configuration, access, and integrity.

Risk context for open-source dependencies including reachability, exploitability, and upgrade impact.

Deep analysis of binaries and packages to detect tampering, malware, and hidden threats beyond manifest-based scanning.

Assessment of developer and machine identity access and permissions across source control and pipelines.

Compiles vendor, third-party and open-source maintainer reputation to flag risk from unmaintained, deprecated or abandoned software.

Governs third-party software consumption to apply consistent software supply chain security policy.

Live visibility into code, components, pipelines, and developer activity across the software development lifecycle.

Detection of exposed secrets and credentials in build artifacts and software packages, with prioritized remediation that distinguishes active credentials from stale ones.

Automatically discovers AI models, LLM API connections, ML pipelines, and AI-enabled SaaS applications in use across the organization, including those deployed without IT authorization.

Discovers AI model and inference endpoints and flags public exposure, weak authentication, default credentials, or excessive permissions as posture misconfigurations.

Monitors AI-agent behavior at runtime to detect anomalous or malicious actions and policy violations.