CNAPP Comparison 2026: Wiz vs Palo Alto Prisma Cloud vs Orca Security vs Lacework vs Microsoft Defender for Cloud

Before CNAPP, cloud security required five or more separate products: a CSPM tool for misconfiguration scanning, a CWPP agent for runtime protection, a CIEM tool for identity entitlement analysis, a container scanning tool, and a vulnerability management platform. Each had its own console, its own data model, and its own alert queue. Security teams spent more time correlating findings across tools than acting on them.

CNAPP consolidates these into a single platform with a unified graph of cloud resources, identities, workloads, and their relationships. The defining capability is attack path analysis: instead of surfacing isolated misconfigurations or vulnerabilities, CNAPP shows the combination of conditions that creates an exploitable path to a critical asset -- for example, a public-facing EC2 instance with a critical vulnerability running with an overprivileged IAM role that has S3 full access. That attack path framing reduces alert volume by 60 to 80 percent compared to individual CSPM or CWPP findings while surfacing the risks that actually matter.

The primary architectural question in every CNAPP evaluation is agentless vs. agent-based scanning. Agentless platforms (Wiz, Orca) read cloud control plane APIs and take disk snapshots without deploying software to workloads, enabling rapid deployment across large cloud estates. Agent-based platforms (Prisma Cloud, Lacework) deploy lightweight agents to workloads for continuous runtime monitoring, providing richer telemetry at the cost of deployment complexity. Most mature platforms now support both modes; the question is which is the primary architecture.

Five criteria separate these platforms in real enterprise deployments. Evaluate against your specific cloud footprint and risk model.

Wiz is the fastest-growing cloud security vendor by revenue, built on an agentless architecture that connects to cloud environments via read-only API access and disk snapshot scanning without deploying any software to workloads. The platform reached $500 million ARR faster than any cloud security vendor in history and now has a $32 billion valuation (as of the rejected Google acquisition in 2024).

Wiz's security graph is the platform's defining capability. The graph ingests every cloud resource, identity, configuration, vulnerability, and network exposure and builds a relational model that enables attack path analysis at scale. The Wiz Issues system surfaces the specific combination of conditions that creates a toxic combination -- an exposed workload with a critical vulnerability running with excessive permissions -- prioritized by blast radius rather than individual severity.

The platform covers AWS, Azure, GCP, and OCI with strong parity across cloud providers, Kubernetes security, container registry scanning, IaC scanning, and DSPM (data security posture management). Wiz's developer experience is strong: the Wiz CLI and GitHub integration bring cloud security findings into the developer workflow without requiring security team involvement for every remediation.

Pricing: Wiz licenses on cloud resource count (billable entities per cloud provider). Enterprise contracts for mid-to-large environments typically land between $400,000 and $2 million per year.

Palo Alto Prisma Cloud is the most feature-complete CNAPP on the market, built through a series of acquisitions (Twistlock for container security, RedLock for CSPM, Bridgecrew for IaC scanning) integrated into a unified platform. Prisma Cloud is the choice for organizations that need runtime agent-based protection as a primary capability, compliance automation across regulated industries, and tight integration with the broader Palo Alto security stack.

The Defenders (Prisma Cloud's lightweight agents) run on every workload and container for continuous runtime telemetry -- detecting process anomalies, network behavior deviations, and file system changes that agentless platforms cannot see. This runtime telemetry is the platform's primary differentiator over Wiz and Orca: it surfaces active attack behavior, not just static misconfiguration and vulnerability risk.

Prisma Cloud also has the deepest compliance automation of any CNAPP: pre-built frameworks for PCI DSS, HIPAA, SOC 2, NIST 800-53, and CIS Benchmarks with automated evidence collection, which is a significant operational advantage for regulated industries.

Pricing: Prisma Cloud licenses per credit, where different resource types consume different credit quantities. Enterprise contracts are complex and typically require Palo Alto sales engagement to evaluate accurately. The all-in cost for a large multicloud environment often exceeds $2 million per year.

Orca Security's SideScanning technology is the platform's architectural signature: rather than deploying agents or making API calls to running workloads, Orca reads disk snapshots from cloud storage and reconstructs the full application and OS context without ever connecting to the workload itself. This approach gives Orca zero-performance-impact scanning across entire cloud estates and near-instant deployment.

Orca's strength is breadth: a single platform covers workload vulnerabilities, OS and package vulnerabilities, misconfigurations, sensitive data exposure (DSPM), identity risks, malware detection, and secret scanning across AWS, Azure, GCP, and Alibaba Cloud. The platform's detection coverage per deployment effort ratio is among the highest in the CNAPP category.

The tradeoff is runtime telemetry depth: SideScanning does not observe running process behavior. Orca detects malware, misconfiguration, and vulnerability exposure at scan time; it does not detect active lateral movement or process injection in real time. Organizations that need continuous runtime monitoring for active threat detection need to pair Orca with an EDR or CWPP agent.

Pricing: Orca licenses per asset (workload, database, container cluster). Mid-market deployments (500 to 2,000 assets) typically land between $150,000 and $500,000 per year.

Lacework's primary differentiator is behavioral anomaly detection powered by its Polygraph technology, which builds a behavioral baseline of every identity, workload, and network interaction in the cloud environment and surfaces deviations that represent active threats rather than static misconfiguration risk. This positions Lacework between pure CSPM platforms (which only find misconfigurations) and pure CWPP platforms (which only monitor running workloads) -- with a strong emphasis on detecting post-exploitation behavior.

The Polygraph data model correlates events across identities, processes, network connections, and file activity to reconstruct attack chains visible in cloud telemetry. Lacework detects credential abuse, unusual API call patterns, lateral movement via assumed roles, and data staging activity that traditional CSPM and vulnerability management tools miss.

Lacework covers AWS, Azure, and GCP with strong Kubernetes and container runtime support. The platform integrates with Jira, ServiceNow, Slack, and PagerDuty for SOC workflow. Following a funding round and strategic refocus in 2023, Lacework has concentrated on detection quality over feature breadth.

Pricing: Lacework licenses per account or per workload, depending on the deployment model. Typically positioned competitively with Orca for equivalent cloud estate coverage.

Microsoft Defender for Cloud is the default CNAPP for organizations running workloads in Azure, with meaningful AWS and GCP support added since 2022. Its core value proposition is not the richest feature set -- it is the zero-incremental-cost integration for organizations already paying for Microsoft Defender plans (P1 or P2) and the native connection to the Microsoft security stack (Sentinel, Defender for Endpoint, Entra ID, Purview).

Defender for Cloud's CSPM tier (Microsoft Cloud Security Benchmark alignment, compliance dashboards, and attack path analysis) is free for Azure workloads. The CWPP tier (Defender for Servers, Defender for Containers, Defender for Databases) adds runtime protection at per-resource pricing that is typically lower than standalone CNAPP vendors for equivalent Azure coverage.

For organizations with significant AWS or GCP footprints alongside Azure, Defender for Cloud's multicloud coverage is functional but thinner than Wiz, Orca, or Prisma Cloud. The AWS and GCP connectors cover the most critical findings but require more manual configuration for parity with Azure coverage depth.

Five evaluation dimensions separate these platforms. No vendor leads every category -- the decision depends on your cloud distribution, primary security requirement, and existing vendor relationships.

Stack anchor and primary security requirement determine the decision more reliably than feature comparison.