Wiz vs Orca Security vs Lacework vs Microsoft Defender for Cloud: CSPM Comparison for Multi-Cloud Teams (2026)

The architecture decision is the most consequential choice in a CSPM evaluation because it determines deployment speed, coverage completeness, runtime visibility, and operational overhead.

Wiz: Pure Agentless via Read-Only Cloud API

Wiz connects to cloud accounts using read-only IAM roles and does not install agents on any workload. In AWS, Wiz creates a cross-account role with a curated set of read-only permissions (ec2:Describe*, s3:GetBucketAcl, iam:Get*, and approximately 200 similar read-only API calls). It then uses out-of-band snapshot analysis: for each EC2 instance or VM, Wiz takes an EBS snapshot, mounts it in a Wiz-owned scanning account, reads the filesystem and installed packages, and deletes the snapshot. No code runs on your workload. The full environment scan of a 1,000-account AWS organization typically completes in 24 to 48 hours for the initial crawl, then updates incrementally as cloud API events fire. The limitation is that Wiz sees the disk snapshot state at scan time, not real-time process execution.

Orca Security: SideScanning -- the Same Agentless Approach

Orca invented the agentless snapshot scanning approach that Wiz later popularized. Orca's SideScanning connects via cloud provider APIs, takes snapshots of running workloads without touching them, and analyzes the filesystem outside the production environment. The key differentiator Orca claims is that SideScanning reads the actual runtime stack: installed packages, configuration files, running processes (from process tables captured in the snapshot), and environment variables. Like Wiz, Orca requires read-only cloud API access and mounts snapshots in an Orca-controlled account for analysis.

Lacework: Agent-First with Agentless Supplement

Lacework's architecture reflects its detection-first heritage. The Lacework agent (Polygraph Data Platform agent) installs on each workload and streams syscall telemetry, process events, network connections, and file integrity data in real time. This gives Lacework visibility into runtime behavior that neither Wiz nor Orca can see from snapshots: which processes are actually running, which network connections are active, and what a container did after it started. Lacework added agentless CSPM scanning in 2023 to cover cloud API-level misconfigurations where agent installation is impractical (managed services like RDS, S3, Lambda). In practice, most Lacework deployments use both: agentless for posture and agents for runtime detection.

Microsoft Defender for Cloud: Native Integration

Defender for Cloud connects natively to Azure subscriptions with zero additional IAM configuration because it runs inside the Azure management plane. For AWS and GCP, it uses the same cloud connector pattern as Wiz and Orca (read-only role via AWS Organizations or GCP Organization Policy). The agent story for Defender is complex: Azure Arc, the MMA (Microsoft Monitoring Agent), the AMA (Azure Monitoring Agent), and the Defender for Servers plan all interact in ways that vary by subscription configuration. For Azure-native environments, Defender for Cloud is the fastest to deploy with the deepest native integration. For multi-cloud environments without Azure as the primary cloud, the deployment experience is significantly more complex.

Architecture Fit by Scenario

Attack path analysis is the feature that separates CSPM from simple misconfiguration scanning. Any tool can report that an S3 bucket is public. The harder and more valuable capability is determining whether that public S3 bucket is the first hop in a path that reaches a database containing 10 million credit card numbers. This is the question practitioners are asking when they evaluate wiz dspm comparison or attack path depth.

Wiz Security Graph

Wiz's Security Graph is a property graph database that stores every cloud resource, its configuration attributes, its relationships to other resources (network reachability, IAM trust, tag association), its vulnerability state, and its data classification as nodes and edges. Attack paths in Wiz are graph traversal queries over this model. A path might look like: Public EC2 instance (exposed via security group) --> IMDSv1 enabled (credential theft possible via SSRF) --> Instance role has s3:GetObject on sensitive bucket --> Bucket contains files matching PII classifiers. Wiz surfaces these as toxic combinations: multi-factor findings where a single fix (like enabling IMDSv2 or restricting the security group) breaks the attack path. Wiz's Security Graph queries run continuously and new paths surface as new resources are added or existing resources change configuration.

Wiz acquired Gem Security in 2024 for cloud detection and response, adding runtime threat detection to the graph context. This means Wiz can now correlate a runtime alert (someone is running an unusual command inside a container) with the graph context (that container has a role with admin IAM permissions and network access to a production database).

Orca Security: Attack Path Visualization

Orca's attack path analysis builds on similar graph principles. Orca's differentiator is the asset risk score that aggregates finding severity, exploitability, network exposure, and business context (production vs dev tag, data sensitivity) into a single prioritization score. Orca's interface presents attack paths visually with each hop displayed as a step in the chain. Security teams can click into any node to see the specific control that needs to be fixed to break that path. Orca's alert grouping reduces alert volume by clustering related findings into single issues rather than producing hundreds of individual misconfiguration alerts.

Lacework: Anomaly Detection, Not Graph-Based Paths

Lacework's approach to attack correlation is fundamentally different. Rather than building a static graph of potential attack paths, Lacework uses behavioral baselines (its Polygraph behavioral analysis) to identify when actual runtime behavior deviates from normal patterns. If a workload that normally serves HTTP requests on port 443 suddenly makes outbound connections to a rare external IP on an unusual port, Lacework fires an alert. This is a detection-first model rather than a posture-first model. For attack path analysis in the CSPM sense (potential paths an attacker could take based on configuration), Lacework is less mature than Wiz or Orca. Lacework is stronger when the question is 'is something happening right now' rather than 'what could happen if an attacker got in.'

Microsoft Defender for Cloud: Recommendations and Secure Score

Defender for Cloud's attack path analysis (introduced as a public feature in 2023) models cloud attack paths using its cloud security graph. The feature identifies attack paths that target internet-exposed resources with exploitable vulnerabilities and high-privilege access to sensitive data. For Azure-native environments, Defender's attack path integration with Microsoft Sentinel for SIEM correlation is a genuine advantage: a Defender attack path finding can trigger a Sentinel analytic rule and automate a Logic App response playbook without additional integration work. For multi-cloud paths that span AWS and Azure resources, the attack path quality drops because the graph completeness in non-Azure clouds is lower.

The cloud security posture management scan job policy rule finding suppression exception data model is mature territory. What is newer and less standardized across vendors is how each platform handles data security posture management: discovering where sensitive data lives in cloud storage, classifying it, and connecting that data exposure context to the broader security posture graph.

Wiz DSPM: Acquired from Laminar Security

Wiz acquired Laminar Security in 2023 for approximately 175 million dollars, adding dedicated DSPM capabilities to the platform. Wiz DSPM discovers data stores across AWS S3, Azure Blob Storage, GCP Cloud Storage, Snowflake, RDS, Redshift, and BigQuery without requiring agents by using the same snapshot scanning approach used for workload analysis. The classification engine identifies sensitive data using pattern matching for PII (social security numbers, credit card numbers, passport numbers), PHI (ICD codes, medication names, patient identifiers), and financial data. Results feed back into the Security Graph: if a misconfigured EC2 instance has an attack path to an S3 bucket, and that bucket contains data classified as containing credit card numbers, the attack path severity increases automatically. DSPM findings appear in the same finding console as CSPM findings, with the same suppression and exception workflow.

For a wiz dspm comparison evaluation, the key question is scan depth versus sampling strategy. Wiz DSPM samples data stores (it does not read every object in every bucket) and applies statistical classification based on sampled content. This approach works well for large data lakes but may miss small sensitive files in otherwise unremarkable buckets.

Orca Security: Data Discovery and Sensitivity Scoring

Orca's data discovery is part of its core SideScanning output. When Orca scans a workload, it reads filesystem paths where databases are stored, configuration files with credentials, and any files accessible from cloud storage mounts. For cloud-native object storage (S3, Blob), Orca scans bucket contents using its cloud API connector. Orca classifies content against a library of patterns and assigns each data store a sensitivity label that feeds into the asset risk score. Orca's data discovery is deeply integrated with its attack path analysis: an Orca attack path that terminates at a data store will show the data sensitivity score of that store as part of the path's priority calculation.

Lacework: Data Classification via Agent Telemetry

Lacework's data classification relies on agent-side telemetry: when the Lacework agent observes a process reading from or writing to a file, it can classify that activity based on the file path, process name, and data patterns observed. This approach provides real-time data access monitoring (who touched what sensitive file at what time) but is not a scalable cloud storage classifier in the way Wiz DSPM or Orca's scanner are. Lacework partners with third-party DSPM vendors for full data classification capabilities. If DSPM is a primary evaluation criterion, Lacework is the weakest of the four platforms.

Microsoft Defender for Cloud: Sensitive Data Discovery (MDVM Integration)

Microsoft introduced Sensitive Data Discovery in Defender for Cloud via integration with Microsoft Purview's data classification engine. For Azure Blob Storage, Azure SQL, Azure Cosmos DB, and other Azure-native data services, the classification is strong because Purview already indexes these for Microsoft 365 compliance. For AWS S3, the integration requires the Defender CSPM plan (P2) and the AWS connector with S3 scanning permissions enabled. The Purview classification labels (Highly Confidential, Confidential, General) are consistent with what organizations using Microsoft Information Protection already have deployed, reducing the need for custom classifiers.

Every CSPM platform ships with compliance framework coverage out of the box. The differentiation is not in the list of frameworks but in how the platform manages the finding lifecycle: how suppression works, how exceptions are created and audited, how custom policies are written and tested, and how compliance posture is reported to stakeholders who are not in the security console.

Built-in Framework Coverage Across All Four Platforms

All four platforms cover the frameworks most commonly required in enterprise environments: CIS Benchmarks (AWS Foundations v1.4 and v2.0, Azure Foundations v2.0, GCP Foundations v2.0, Kubernetes v1.7), SOC 2 Type II control mapping, PCI DSS v4.0, NIST CSF 2.0, NIST SP 800-53 Rev 5, ISO 27001:2022, HIPAA Security Rule, and FedRAMP Moderate. Defender for Cloud adds Microsoft Cloud Security Benchmark (MCSB) as its default standard, which maps to NIST SP 800-53 and CIS benchmarks simultaneously.

Finding Suppression and Exception Workflows

The cloud security posture management scan job policy rule finding suppression exception data model varies significantly across platforms. In Wiz, findings are organized by Issue (the actual misconfiguration instance on a specific resource), Control (the policy that generated it), and Project (the organizational grouping for cloud accounts). Exceptions in Wiz are created at three levels: resource level (suppress this specific S3 bucket's public access finding because it is an intentional public static site), resource type level (suppress all publicly accessible EC2 findings in the dev-sandbox project), or global control level (disable this control entirely). Each exception requires an expiration date and justification text. Wiz logs all exceptions with the user identity, timestamp, and justification for audit trail purposes.

Orca uses a similar hierarchy: Alert (the specific finding), Alert Rule (the policy), and Exception. Orca's exceptions can be scoped by tag (suppress findings on resources tagged env:dev), by cloud account, or by asset type. Orca alerts on exceptions that are approaching expiration, which reduces the problem of suppression rules that never get reviewed.

Lacework's compliance finding management uses Policy (the compliance check), Violation (the finding), and Exception (the suppression). Lacework's custom policy authoring uses its own SQL-like query language (LQL, the Lacework Query Language) which is more accessible for practitioners who are comfortable with SQL-style syntax. Writing a custom LQL policy to check whether all S3 buckets in a given account have a specific tag requires approximately 10 to 15 lines of LQL rather than the YAML-heavy policy-as-code approach used by some tools.

Defender for Cloud organizes findings as Recommendations (individual checks), with Governance Rules to assign owners and set remediation due dates. The Governance feature is genuinely useful for large organizations: a finding can be assigned to a specific team with an SLA deadline, and Defender tracks whether the finding was remediated within the agreed window. Exception handling in Defender uses Exemptions at the subscription, resource group, or resource level, with justification categories (waiver, mitigated) and expiration timestamps.

Custom Policy Authoring

Wiz: Custom controls use a graph-based query language (Wiz Query Language) that traverses the Security Graph. Writing a custom policy to detect EC2 instances with a specific combination of security group rule and IMDSv1 enabled requires traversing the graph from the EC2 node to its security group relationships. The learning curve is steeper than SQL but the expressiveness for multi-resource conditions is significantly higher.

Orca: Custom alert rules are configured in the UI with filter conditions and threshold values. For complex multi-resource conditions, Orca's custom rule interface is more limited than Wiz's graph traversal approach.

Lacework: LQL (Lacework Query Language) is the most SQL-like custom policy option. SELECT * FROM LW_HE_EVENTS WHERE EVENT_TYPE = 'CreateBucket' AND not json_extract_scalar(EVENT:requestParameters, '$.bucketPolicy') IS NOT NULL covers the logic for detecting S3 buckets created without a bucket policy in a single readable query.

CSPM pricing is one of the least transparent areas in enterprise security buying. Vendors rarely publish list prices, and the actual cost depends heavily on cloud spend volume, workload count, and which modules are included. Here is what practitioners report from actual procurement conversations.

Wiz: Percentage of Cloud Spend

Wiz prices based on a percentage of annual cloud spend across all connected cloud accounts. The published starting range is approximately 1 to 3 percent of annual cloud spend, with the percentage declining as cloud spend increases. For an organization with 5 million dollars in annual AWS spend, Wiz pricing typically falls in the 75,000 to 150,000 dollar range annually for the core CNAPP platform including CSPM, vulnerability management, and IaC scanning. DSPM (the Laminar acquisition) is a separate add-on module priced separately, typically adding 20 to 40 percent to the base cost. Defender for Containers is included in base Wiz. The Wiz CDR (Cloud Detection and Response) module is an additional charge. Wiz's pricing makes it more expensive as your cloud spend grows, which is the opposite of the discount structure most enterprise software buyers expect.

Orca Security: Per-Asset Pricing

Orca's pricing is based on the number of cloud assets (compute instances, cloud functions, containers, and cloud data stores) connected to the platform. Orca publishes a starting price of approximately 500 to 2,500 dollars per asset per year depending on volume tier and module selection. For a 500-asset environment with mixed EC2, RDS, Lambda, and EKS nodes, Orca pricing typically comes in at 150,000 to 300,000 dollars annually for the full platform including DSPM. Orca's per-asset model is more predictable than Wiz's percentage-of-spend model because asset count grows more slowly than cloud spend in infrastructure-heavy environments. The disadvantage is that asset count can grow quickly in Kubernetes-heavy environments with ephemeral workloads.

Lacework: Consumption-Based with Credit Model

Lacework moved to a consumption-based credit model in 2023. Organizations purchase a pool of credits, and consumption is based on the number of resources scanned per day and the data ingestion volume from agents. The credit model is intended to let organizations scale coverage up and down without renegotiating contracts. Reported annual costs for mid-market deployments (200 to 500 workloads) range from 100,000 to 250,000 dollars. The consumption model can lead to cost surprises if agent deployments expand faster than planned: each new workload with a Lacework agent running continuously consumes credits daily.

Microsoft Defender for Cloud: P1 and P2 Per-Resource Pricing

Defender for Cloud has the most granular and published pricing structure of the four platforms. Defender CSPM (the free tier, CSPM Foundational) provides basic recommendations at no cost for Azure subscriptions. Defender CSPM (paid, sometimes called DCSPM or P2 capabilities) is priced at approximately 0.018 dollars per billable resource per hour (roughly 13 dollars per resource per month). Defender for Servers Plan 1 is approximately 5 dollars per server per month; Plan 2 is approximately 15 dollars per server per month and includes vulnerability assessment via Microsoft Defender Vulnerability Management. AWS and GCP resources connected via cloud connectors are billed at lower rates than Azure resources. For an organization with 500 Azure VMs, the cost for full Defender CSPM plus Defender for Servers P2 is approximately 10,000 to 12,000 dollars per month. Defender's pricing transparency is an advantage in procurement: you can estimate costs precisely before signing.

Pricing Summary

After evaluating architecture, attack path depth, DSPM, compliance workflows, and pricing, the decision usually comes down to organizational profile. Here is a decision matrix for the most common profiles practitioners encounter.

Microsoft 365 and Azure-First Organizations

If your primary cloud is Azure and your security team is already operating Microsoft Sentinel, Defender XDR, and Purview, Defender for Cloud is the default choice. The integration depth is real: Defender for Cloud findings flow into Sentinel automatically, Purview data classification labels appear natively in CSPM findings, and the identity plane via Entra ID connects to CIEM capabilities without additional connectors. The pricing transparency and existing enterprise agreement terms often make Defender the most cost-effective option for Azure-heavy organizations. The limitation is multi-cloud coverage quality: AWS and GCP coverage in Defender is functional but not as deep as Wiz or Orca for non-Azure-native services.

AWS-Native Multi-Account Organizations

For organizations primarily on AWS with 50 or more accounts in an AWS Organization, Wiz has become the dominant choice in this segment. The CloudFormation StackSet deployment for cross-account role creation works well with AWS Organizations, the Security Graph handles the IAM relationship complexity that is common in large AWS environments, and the attack path analysis for IAM privilege escalation paths (the most common critical finding category in AWS) is the most mature of the four platforms. Orca is a competitive alternative with a lower entry-level price point for smaller AWS environments.

Multi-Cloud (AWS plus Azure plus GCP) Enterprise

For true multi-cloud environments with significant workloads on two or three providers, Wiz or Orca are the strongest options because both were built as multi-cloud platforms from the start. Wiz has better enterprise support depth and a larger integration ecosystem. Orca competes on total cost of ownership for mid-market organizations and has a more approachable pricing model for organizations that want per-asset predictability.

Startups and Growth-Stage Companies

Lacework was historically the go-to for startup cloud security due to its consumption model and developer-friendly positioning. Wiz has aggressively targeted startups through its startup program (discounted rates for early-stage companies under a revenue threshold). For startups under 10 million dollars in cloud spend, Wiz's startup program pricing is often more competitive than Lacework's credit model. Orca offers a similar startup tier.

Organizations with Strong Runtime Detection Requirements

If the primary requirement is detecting active threats in cloud workloads rather than auditing configuration posture, Lacework is the strongest option because its agent provides syscall-level runtime visibility that no agentless scanner can replicate. The combination of Lacework for runtime detection and a secondary CSPM tool for compliance posture is a pattern some mature organizations adopt. Wiz CDR (with the Gem Security acquisition) is the strongest agentless alternative for organizations that need runtime detection without agents.

Decision Matrix