European Cloud Security Platforms (CNAPP)

A cloud security platform reads the configuration of every account you run and, in many products, the behaviour of the workloads inside them. That makes the vendor a privileged observer of your infrastructure, so its contracting entity and where findings are processed deserve the same scrutiny as the cloud provider itself. The tools below contract through companies in Israel, Belgium, Germany and other eligible jurisdictions, and range from agentless posture scanners to runtime sensors.

How we rank these tools — 4-step process
  1. 1
    European ownership, verified

    The company is headquartered and incorporated in the EU, EEA, the UK, Switzerland or Israel, and processes customer data in Europe or Israel. A US parent company disqualifies a tool from this page regardless of where its servers are.

  2. 2
    Category fit and hands-on review

    What the tool actually does, who it suits, and where it falls short — checked against the vendor’s own documentation, changelog and pricing page rather than its marketing copy.

  3. 3
    Compliance and pricing check

    GDPR posture, hosting location and the prices quoted on this page are verified against the vendor’s public pricing before publication, and re-checked when we revisit the category.

  4. 4
    Position on this page

    Placement on this page can be paid, and that can affect the order tools appear in. It never buys a listing: a tool that fails the checks above is not here at any price, and payment does not change the shortcomings we write about. A vendor can ask us to correct a factual error — not to remove a criticism.

Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. Vendors can pay for more visibility, higher up on the review pages; it never affects whether a tool is listed. Editorial policy

10 European Cloud Security Platforms (CNAPP)

Aikido Security

Ghent platform that joins code, container and cloud posture checks

Belgium
Cloud misconfiguration checks Free plan for 2 users Code-to-cloud scope
Learn more Visit website

ARMO

Runtime-driven Kubernetes and cloud security built on Kubescape

Israel
Kubescape open source core eBPF runtime sensor On-prem option
Learn more Visit website

Sweet Security

Runtime-first CNAPP that reasons from live workload behaviour

Israel
Runtime CNAPP Attack path validation AI agent security
Learn more Visit website

Orca Security

Agentless SideScanning CNAPP from Tel Aviv across six clouds

Israel
Agentless SideScanning CSPM and CIEM Six cloud providers
Learn more Visit website

Aqua Security

Agent-based runtime enforcement for containers, serverless and VMs

Israel
Runtime enforcement Air-gapped operation Mainframe coverage
Learn more Visit website

Oligo Security

Application runtime security that shows what loaded libraries do

Israel
eBPF runtime sensor Reachability filtering AI workload checks
Learn more Visit website

Check Point Cloud Security

CNAPP, web application firewall and cloud gateways in one portfolio

Israel
CNAPP Cloud WAF Cloud network gateways
Learn more Visit website

SUSE Security

Open source Kubernetes container security from the SUSE Rancher family

Germany
Open source Network segmentation Container runtime protection
Learn more Visit website

Skyhawk Security

Adversary simulation that tests alerts from your existing cloud tools

Israel
Digital twin testing Agentless Alert validation
Learn more Visit website

Cycode

Application security posture management that starts at code and pipelines

Israel
ASPM Supply chain security AI-assisted fixes
Learn more Visit website
Editor Sebastiaan Smits

Published Last reviewed How we review

Key takeaways

  • Aikido Security of Ghent, Belgium is the only tool in this list contracting through an EU company, and its free plan covers two users.
  • ARMO builds its commercial platform on Kubescape, a CNCF incubating project, and offers an on-premises mode for Kubernetes clusters.
  • Orca Security lists six cloud providers, from Amazon Web Services to Tencent Cloud, and scans workloads through APIs without agents.
  • SUSE Security deploys inside your own clusters, so its scan data does not have to leave your infrastructure.
  • Skyhawk Security and Cycode are not full CNAPPs: Skyhawk validates alerts from other tools and Cycode secures repositories and pipelines.

European cloud security platforms (CNAPP) scan cloud accounts, containers and running workloads for misconfigurations, vulnerabilities and attacks under a contract with a company outside the United States, which matters because the vendor holds read access to your whole infrastructure.

European cloud security platforms (CNAPP) compared

PositionToolEstablishedEntry priceBest for
#1 Aikido Security Belgium Free plan for two users; paid tiers on the vendor pricing page Small developer teams that want code, container and cloud checks from one Belgian vendor
#2 ARMO Israel Quote based on vCPUs and cloud resources Kubernetes-heavy teams that want runtime context behind every finding
#3 Sweet Security Israel Pricing on request Cloud teams that want runtime evidence behind each posture finding
#4 Orca Security Israel Pricing on request Security teams with several cloud providers that want inventory and risk ranking before deploying sensors
#5 Aqua Security Israel See website (no prices published) Enterprises that need to block activity inline, including in air-gapped environments
#6 Oligo Security Israel Pricing on request Teams drowning in open source CVEs that need to know which ones execute
#7 Check Point Cloud Security Israel Pricing on request; free trial offered Organisations already running Check Point firewalls that want one vendor across network and cloud
#8 SUSE Security Germany Subscription, see website Teams on Kubernetes or Rancher who want to operate their own container security
#9 Skyhawk Security Israel Pricing on request; 30-day free trial Lean teams that already have scanners and need to know which alerts are real
#10 Cycode Israel Pricing on request Teams that need code-side risk context to feed their cloud security work

Every European cloud security platforms (CNAPP) tool reviewed

#1 Aikido Security

Ghent, Belgium Founded 2022 Free plan for two users; paid tiers on the vendor pricing page Free plan, no credit card

Best for: Small developer teams that want code, container and cloud checks from one Belgian vendor

  • Operating company. Aikido Security BV
  • Jurisdiction. EU (Belgium)
  • Where the data sits. Belgian company; offices also in the United States and the United Kingdom
  • Source code. Closed source
  • Replaces. Wiz cloud misconfiguration checks, Snyk

Aikido Security is a Ghent platform operated by Aikido Security BV and founded in 2022. Cloud misconfiguration checks sit next to scanning of dependencies, secrets, source code, containers and infrastructure as code, so a developer team gets one findings list instead of separate tools for each layer.

It is the only product in this list contracting through an EU company, and its free plan for two users allows a trial without a sales call. Paid prices are not restated here because the currency was unclear on the pricing page. The site footer shows offices in the United States and the United Kingdom as well, and a posture-only buyer should check how deep the cloud module goes.

What Aikido Security does well

  • Contracts through a Belgian company
  • Free plan for two users
  • Code, dependencies, containers and cloud in one product
  • Founded 2022, based in Ghent
  • Suited to small developer teams

Where Aikido Security falls short

  • Cloud posture is one module among many
  • Runtime sensors not listed on the pages we read
  • Offices in the US and UK as well
  • Paid prices not restated here

Standout feature. It is the only tool in this list that combines an EU contracting entity with a free plan.

Visit Aikido Security

#2 ARMO

Israel, Israel Quote based on vCPUs and cloud resources Demo on request

Best for: Kubernetes-heavy teams that want runtime context behind every finding

  • Operating company. Cyber Armor Ltd (ARMO)
  • Jurisdiction. Israel (outside the EU/EEA)
  • Where the data sits. SaaS, or on-premises for Kubernetes
  • Source code. Closed source
  • Replaces. Wiz, Prisma Cloud, Sysdig

ARMO sells the commercial platform around Kubescape, which its site describes as a CNCF incubating project with more than 11,000 GitHub stars. A team can run the free scanner first and later move to a managed console that adds runtime detection, cloud posture checks and a view of which vulnerable code is loaded.

The company behind the site is Cyber Armor Ltd, registered in Israel according to its privacy policy. Quotes depend on vCPUs and cloud resources, and an on-premises mode for Kubernetes is offered for setups that need full data control. The claim that reachability filtering cuts CVE work by over 90 percent comes from ARMO and was not tested.

What ARMO does well

  • Kubescape core is open source and in the CNCF incubator
  • Ranks CVEs by what is reachable at runtime
  • eBPF sensor with automated response
  • On-premises mode for Kubernetes
  • Free route in through the scanner

Where ARMO falls short

  • Price depends on a quote
  • Strongest on Kubernetes, weaker on plain VMs
  • Needs a sensor in each cluster
  • Fewer integrations than the large suites

Standout feature. It is the only commercial platform here that grows out of a free CNCF scanner.

Read the full ARMO review Visit ARMO

#3 Sweet Security

Israel, Israel Pricing on request Demo on request

Best for: Cloud teams that want runtime evidence behind each posture finding

  • Operating company. Sweet Security Ltd.
  • Jurisdiction. Israel (outside the EU/EEA)
  • Where the data sits. United States, EU and Israel (per privacy policy)
  • Source code. Closed source
  • Replaces. Wiz, Orca, Lacework

Sweet Security Ltd. calls its product a runtime CNAPP: the platform watches live behaviour in cloud workloads and uses it to decide which posture and vulnerability findings deserve attention. One console combines cloud detection and response, CSPM, identity threat detection, API security and vulnerability management.

An AI security module traces what autonomous agents do and can enforce guardrails inline, which the site puts at under 100 ms. The privacy policy says data may be stored in the United States, the EU and Israel. The legal pages we read date from September 2024, customer quotes on the site describe attack paths that earlier penetration tests missed, and no prices are shown.

What Sweet Security does well

  • Live behaviour decides which findings matter
  • AI agent tracing and cloud detection in one console
  • Legal pages name an Israeli company
  • API and identity threat detection included
  • Customers are quoted by name on the site

Where Sweet Security falls short

  • No price on the website
  • Workload sensors have to be rolled out
  • Legal pages were last dated 2024
  • Accuracy claims are the vendor's own

Standout feature. It traces the actions of AI agents running on your cloud workloads.

Read the full Sweet Security review Visit Sweet Security

#4 Orca Security

Tel Aviv, Israel Pricing on request Demo on request

Best for: Security teams with several cloud providers that want inventory and risk ranking before deploying sensors

  • Operating company. Orca Security Ltd.
  • Jurisdiction. Israel (outside the EU/EEA)
  • Where the data sits. Region choice listed: USA, Europe, Australia, US-Gov
  • Source code. Closed source
  • Replaces. Wiz, Prisma Cloud, Lacework

Orca Security Ltd. of Tel Aviv scans cloud workloads through provider APIs with a method it calls SideScanning, so no agent is needed to get a first inventory. The platform includes CSPM, CIEM, vulnerability management, container and API security, and an optional runtime sensor for live process data.

The integration list names Amazon Web Services, Microsoft Azure, Google Cloud, Oracle Cloud, Alibaba Cloud and Tencent Cloud. The login selector offers USA, Europe, Australia and US-Gov, and the site shows SOC 2 Type II and ISO 27017, 27018 and 27701 badges. The pricing page returned not found, and tenant data location should be confirmed in the order form.

What Orca Security does well

  • First inventory without deploying agents
  • Six cloud providers on the integration list
  • Terms name Orca Security Ltd. in Tel Aviv
  • Posture, identities and vulnerabilities in one data model
  • Optional runtime sensor

Where Orca Security falls short

  • Prices are not shown
  • API snapshots miss live behaviour without the sensor
  • A small team may use a fraction of the product
  • Tenant region needs written confirmation

Standout feature. It supports six cloud providers, including Alibaba Cloud and Tencent Cloud.

Read the full Orca Security review Visit Orca Security

#5 Aqua Security

Ramat Gan, Israel Founded 2015 See website (no prices published) Demo on request

Best for: Enterprises that need to block activity inline, including in air-gapped environments

  • Operating company. Aqua Security Software Ltd.
  • Jurisdiction. Israel (outside the EU/EEA)
  • Where the data sits. Not stated on public pages
  • Source code. Closed source
  • Replaces. Wiz, Prisma Cloud, Sysdig

Aqua Security builds its product on the argument that seeing a threat is not the same as stopping it. An agent applies policy where the code runs and can contain a workload before a patch exists. The site says the company was founded in 2015 and lists Boston and Ramat Gan as its headquarters.

Listed environments include Kubernetes, OpenShift, Docker, VMware Tanzu, the three large clouds and IBM Z mainframes, and enforcement still works when a network is disconnected. Beyond runtime there is code scanning, supply chain checks, posture management and GenAI application security. The privacy policy names Aqua Security Software Ltd. and a UK entity, while the terms refer to affiliates.

What Aqua Security does well

  • Blocks activity at the workload
  • Operates without a connection to the cloud
  • Covers mainframes and VMware as well
  • Spans code scanning through to runtime
  • Israeli company named in the privacy policy

Where Aqua Security falls short

  • Signing entity may be an affiliate
  • Prices are not published
  • Agents have to be deployed and maintained
  • Large platform with a steep learning curve

Standout feature. It is the one tool here that lists IBM Z mainframes among its environments.

Read the full Aqua Security review Visit Aqua Security

#6 Oligo Security

Israel, Israel Pricing on request Demo on request

Best for: Teams drowning in open source CVEs that need to know which ones execute

  • Operating company. Oligo Cyber Security Ltd.
  • Jurisdiction. Israel (outside the EU/EEA)
  • Where the data sits. Not stated on public pages
  • Source code. Closed source
  • Replaces. Wiz runtime features, Sysdig

Oligo Security Ltd. works inside application runtime. Its eBPF sensor separates a vulnerable library that merely sits on disk from one loaded into execution memory, then scores the finding by environment and reachability. The vendor says this removes up to 95 percent of the noise, a figure we did not check.

The sensor also watches system calls and outbound connections, can name the pod and code path under attack, and can block unauthorised egress. A runtime AI module inspects model files and dependencies in memory and lists frameworks such as LangChain and Hugging Face. There is no cloud account posture module, and the terms and privacy policy both name Oligo Cyber Security Ltd.

What Oligo Security does well

  • Filters CVEs by whether the code executes
  • Detects and blocks through eBPF
  • Covers AI frameworks loaded in memory
  • Reports detail at process level
  • Both legal pages name the same company

Where Oligo Security falls short

  • Does not scan cloud account settings
  • Prices are not published
  • Sensors needed in the cluster
  • Noise statistics come from the vendor

Standout feature. It decides whether a CVE matters by looking at what sits in process memory.

Read the full Oligo Security review Visit Oligo Security

#7 Check Point Cloud Security

Israel, Israel Pricing on request; free trial offered Demo on request

Best for: Organisations already running Check Point firewalls that want one vendor across network and cloud

  • Operating company. Check Point Software Technologies Ltd.
  • Jurisdiction. Israel (outside the EU/EEA)
  • Where the data sits. Not stated on public pages
  • Source code. Closed source
  • Replaces. Wiz, Prisma Cloud, Fortinet cloud security

Check Point Cloud Security, listed under the CloudGuard name in its URL, comes from Check Point Software Technologies Ltd. The portfolio combines a CNAPP with an AI-based web application and API firewall and cloud network security gateways that can run in your own cloud account on AWS, Azure or Google Cloud.

Because the gateways inspect traffic, the product can block as well as report. The same page announces a partnership with Wiz that links cloud network security to Wiz's CNAPP, so the CNAPP content of your order needs a close read. A free trial is offered, prices are on request, and the block-rate and ROI figures are cited by Check Point from third-party tests.

What Check Point Cloud Security does well

  • Gateways and web application firewall alongside the CNAPP
  • Same vendor as the network firewall
  • Free trial available
  • Wide partner and support network
  • Parent company in Israel

Where Check Point Cloud Security falls short

  • Prices are not published
  • Larger contract and console than a specialist
  • Page also announces a Wiz partnership
  • Regional contracting entity not named in legal pages

Standout feature. It is the only tool here that sells inline traffic gateways next to the CNAPP.

Read the full Check Point Cloud Security review Visit Check Point Cloud Security

#8 SUSE Security

Nuremberg, Germany Subscription, see website Demo on request

Best for: Teams on Kubernetes or Rancher who want to operate their own container security

  • Operating company. SUSE (SUSE Software Solutions Germany GmbH named for privacy)
  • Jurisdiction. EU (Germany)
  • Where the data sits. Your own infrastructure
  • Source code. Closed source
  • Replaces. Wiz container security, Prisma Cloud, Aqua

SUSE Security is part of the SUSE Rancher family and is described by SUSE as an open source, zero trust container security platform. It scans for vulnerabilities through build, test and deployment, enforces admission control, runs Kubernetes CIS Benchmark and Docker Bench checks and segments traffic between pods at layer 7.

It deploys into your own clusters and integrates with Rancher, Red Hat OpenShift and the three large clouds, so scan data can stay in your infrastructure. Reports cover PCI DSS, HIPAA and GDPR. The SUSE legal page names SUSE Software Solutions Germany GmbH in Nuremberg as privacy contact, the licence was not checked, and the product page shows no cloud account posture module.

What SUSE Security does well

  • Open source according to SUSE
  • Runs in your own clusters
  • Segments traffic between pods at layer 7
  • Reports for PCI DSS, HIPAA and GDPR
  • Privacy contact in Nuremberg, Germany

Where SUSE Security falls short

  • Does not check cloud account settings
  • Subscriptions without published prices
  • Your own staff operate it
  • Limited to containers

Standout feature. It is the only German-linked option here, and it runs entirely inside your clusters.

Read the full SUSE Security review Visit SUSE Security

#9 Skyhawk Security

Israel, Israel Pricing on request; 30-day free trial Demo on request

Best for: Lean teams that already have scanners and need to know which alerts are real

  • Operating company. Skyhawk Security (CNP) Ltd.
  • Jurisdiction. Israel (outside the EU/EEA)
  • Where the data sits. Not stated on public pages
  • Source code. Closed source
  • Replaces. Complements Wiz, Orca and CNAPP alert queues

Skyhawk Security does not replace a scanner. According to its home page it imports findings from a CNAPP, SIEM or vulnerability tool and runs adversary simulations against an AI-generated replica of production, then pushes down findings that cannot be chained into an attack. The product is agentless and the simulations do not touch live systems.

The site claims it can turn more than 500,000 alerts into a handful of actionable threats, which are vendor figures. The terms name Skyhawk Security (CNP) Ltd., the privacy policy lists a radware.com address for the data protection contact, and the relation to Radware is not stated. A 30-day free trial is offered, and governing law varies by region in the terms.

What Skyhawk Security does well

  • Ranks alerts by exploitability
  • No agent to install
  • Simulations run in a copy, not in production
  • 30-day free trial
  • Reads findings from the tools you own

Where Skyhawk Security falls short

  • Cannot scan or sense workloads on its own
  • Prices are not published
  • Reduction figures come from the vendor
  • Adds another SaaS platform to trust

Standout feature. It tests alerts from your existing scanners in a digital twin of production.

Read the full Skyhawk Security review Visit Skyhawk Security

#10 Cycode

Israel, Israel Pricing on request Demo on request

Best for: Teams that need code-side risk context to feed their cloud security work

  • Operating company. Cycode Ltd.
  • Jurisdiction. Israel (outside the EU/EEA)
  • Where the data sits. Not stated on public pages
  • Source code. Closed source
  • Replaces. Complements Wiz code scanning, Snyk

Cycode Ltd. is an application security posture platform that starts at repositories and pipelines. It lists SAST, software composition analysis, secrets detection, infrastructure as code, container and CI/CD security, with a context graph linking results to code owners and reachability. The website terms name Cycode Ltd.

AI agents analyse exploitability and open pull requests with fixes, and the product governs AI coding tools and MCP servers. Faster fix times and fewer false positives are vendor results. The public pages show no cloud account scanning or runtime sensor, so Cycode covers the code half of a code-to-cloud workflow. Prices are not published, and rankings quoted on the home page were not checked.

What Cycode does well

  • Scans code, packages, secrets and pipelines
  • Maps findings to owners through a graph
  • Agents propose fixes as pull requests
  • Applies governance to AI coding tools
  • Terms name an Israeli company

Where Cycode falls short

  • No cloud account scanning on public pages
  • Prices are not published
  • Analyst rankings are the vendor's own marketing
  • Each repository system needs an integration

Standout feature. It governs AI coding assistants and MCP servers as part of application security.

Read the full Cycode review Visit Cycode

How do I choose a cloud security platform when I am leaving Wiz?

Start with the signal you trust. Orca Security reads workloads through cloud APIs and is the nearest match to the way Wiz works. ARMO, Sweet Security and Oligo Security begin with a sensor on the workload and rank findings by what actually runs. Aqua Security adds blocking on top of detection. Which family you pick decides how much deployment work lands on your platform team.

Then check the scope. Oligo has no cloud account misconfiguration module, SUSE Security stays inside containers, Skyhawk depends on findings from other tools and Cycode covers code. Aikido Security and Orca are the ones with a posture view across accounts. Write down which Wiz modules you use today and strike the tools that miss two or more.

Which of these tools publish a price?

None publishes a complete price list. ARMO says its quote depends on vCPUs and cloud resources, Aqua lists no prices on its site, and Orca, Sweet Security, Oligo, Check Point and Cycode say pricing is on request. Skyhawk and Check Point offer a free trial, 30 days in Skyhawk's case. SUSE Security sells a subscription with the price on request.

Aikido has a free plan for two users, and ARMO lets you start with the open source Kubescape scanner before you buy anything. For anything else, ask for the pricing basis in writing (per vCPU, per workload, per cloud account) so that the quote scales with your estate the way you expect.

Does a European or Israeli vendor solve the jurisdiction problem?

Only in part. Aikido Security BV is a Belgian company, and SUSE names SUSE Software Solutions Germany GmbH as its privacy contact. The other eight tools contract through Israeli companies, such as Cyber Armor Ltd for ARMO and Orca Security Ltd. Israel is accepted on this site, but it is outside the EU and EEA, so a strict sovereignty policy may rule these out.

Where findings are processed is a second question. Sweet Security says visitor data is stored in the United States, the European Union and Israel, and Orca's login selector offers USA, Europe, Australia and US-Gov. Several vendors state no data location on their public pages. Ask for the tenant region and for the entity that signs your agreement before a trial begins.

Do I need agents, or can I stay agentless?

Orca Security and Skyhawk Security work without agents on your workloads. Orca scans snapshots through cloud APIs and sells a separate runtime sensor, while Skyhawk simulates attacks in a replica of your environment. ARMO, Sweet Security, Oligo and Aqua put a sensor or agent on the node, and SUSE Security runs inside the cluster.

Agentless rollout is faster and touches fewer teams, but it only sees what the API shows. Sensors see process behaviour and can block, at the cost of kernel compatibility checks and maintenance. A common pattern is to start agentless for inventory and add a sensor on the clusters that carry the most risk.

When should I not switch away from Wiz?

If you rely on one console that spans many accounts and clouds, and the main complaint is the contract rather than the product, a switch may cost more than it returns. Not one of the tools here is a drop-in copy. Oligo, SUSE Security, Skyhawk and Cycode each cover a slice, and Check Point's own page announces a partnership with Wiz.

Timing matters as well. Policies, exceptions and ticket integrations do not migrate on their own, so a switch in the middle of an audit period is risky. If the driver is only price transparency, ask Wiz for a quote against ARMO's or Orca's first and keep the comparison in the file.

How do these tools fit with code scanning and the rest of the stack?

Cycode starts from repositories and pipelines, and Aikido scans dependencies, secrets, source code and infrastructure as code before it reaches the cloud. Both give a build-time view that a cloud-only tool lacks. Cycode does not market cloud account checks, so pair it with Orca, ARMO or Sweet Security.

On the runtime side, Oligo and ARMO emphasise Kubernetes and containers, while Aqua reaches VMs, serverless functions and IBM Z mainframes. Skyhawk consumes findings from your existing CNAPP, SIEM or scanner. Map each tool to the layer it covers (code, account, workload, alert) and avoid buying two for the same layer.

How we selected and ranked these 10 tools

Every tool on this page is in the European Purpose directory, which means the operating company is established in Europe and we have verified that from the company register or the vendor's own legal notice rather than from a marketing page. Tools headquartered outside Europe are not eligible, however good they are.

  1. Feature verification (weight: 40%). We check each capability against the vendor's own documentation and product pages, and record what the tool does rather than what the category is assumed to include.
  2. Ease of adoption (weight: 30%). Integrations, published API access, trial availability and how much configuration stands between signing and a usable result.
  3. Value and transparency (weight: 30%). Published pricing counts in a vendor's favour; quote-only pricing is recorded as quote-only rather than estimated. We weigh what a buyer gets for the entry price, not the headline feature count.
  4. Editorial review. Every page is researched and drafted with AI assistance, and the compliance and pricing claims are checked against the vendor's documentation before it is published under the founder's editorial responsibility. The three weights above decide the order; a position is a ranking against the other European tools in this category, not an absolute score.

Vendor-reported outcomes — ROI figures, margin uplift, time saved — are labelled as vendor claims wherever they appear on this page. We have not audited them, and neither has anyone else who quotes them. Read our full editorial process for how pages are re-verified.

Frequently asked questions

It depends on the criterion. Aikido Security is the Belgian option with a free plan for two users. Orca Security is closest to Wiz in agentless scope across six cloud providers. ARMO and Sweet Security rank findings by runtime evidence, SUSE Security runs inside your own clusters and Aqua Security enforces policy even in air-gapped environments.

Aqua Security states that its agent enforcement works in disconnected and air-gapped environments, and SUSE Security deploys inside your own clusters. ARMO offers an on-premises mode for Kubernetes. Orca, Skyhawk and Sweet Security are SaaS products and need connectivity to the vendor platform.

Not in the legal sense. Israel is outside the EU and EEA, and eight of the ten tools reviewed here contract through Israeli companies. This site accepts Israel for eligibility, but a buyer with an EU-only rule should look at Aikido Security in Belgium and at SUSE Security, whose privacy contact is in Germany.

Yes, in three places. Aikido Security has a free plan for two users, ARMO builds on the open source Kubescape scanner, and Skyhawk Security offers a 30-day free trial. Check Point Cloud Security also offers a free trial. Treat the vendor figures shown during a trial, such as noise reduction percentages, as claims to test in your own environment.

Aikido Security is the one most clearly built for it, with dependency, secret, source code, container and cloud checks in one product. Aqua Security spans code scanning to runtime, and Cycode covers the code side only. Most other tools here focus on accounts or workloads, so a code scanner usually has to be added.

Go deeper on cloud security platforms (CNAPP)

Compare with the US incumbents