CSPM Tools 2026: Defender for Cloud vs Wiz vs Orca vs Prisma Cloud

Evidence Status

This refresh is evidence-locked to primary vendor documentation, CSA Cloud Controls Matrix material, and NIST publications reviewed on July 14, 2026. It removes unsupported market-share, pricing, onboarding-duration, maturity-ranking, and universal-winner claims from the previous version.

The article does not contain a hands-on benchmark. Vendor documentation is used only for documented capabilities and configuration requirements. Vendor claims about coverage, time to value, performance, and value are treated as vendor assertions, not independent proof. The practical selection framework is a Protego practitioner inference from the source set.

Primary sources used:

• Microsoft Learn: CSPM in Defender for Cloud
• Microsoft Learn: Enable Defender CSPM
• Microsoft Learn: Defender for Cloud overview
• Microsoft Learn: Defender for Cloud cost calculator
• Wiz evaluation FAQ
• Google announcement: Wiz acquisition completion
• Orca SideScanning overview
• Orca SideScanning technical brief
• Prisma Cloud runtime security architecture
• Prisma Cloud runtime security overview
• Prisma Cloud application security
• Prisma Cloud container runtime defense
• CSA CCM v4.1 introductory guidance
• CSA Cloud Controls Matrix
• NIST SP 800-190: Application Container Security Guide
• NIST SP 800-204C: Cloud-Native Applications

What This Comparison Does and Does Not Decide

The wrong way to buy CSPM is to ask which platform is best. That question turns a control problem into a brand argument.

The better question is: which platform can prove the outcomes your team needs, in your actual cloud estate, with permissions your IAM owners approve and remediation workflows your engineers will use?

This article compares four commonly evaluated platforms: Microsoft Defender for Cloud, Wiz, Orca Security, and Palo Alto Networks Prisma Cloud. It does not rank them as universal winners. It gives you a control-based evaluation model, a source-linked capability map, and a POC plan designed to disprove weak assumptions before procurement turns them into a multi-year contract.

CSPM, CNAPP, and the Outcomes to Measure

CSPM started as cloud configuration posture management: storage exposure, encryption settings, network reachability, identity settings, and compliance mappings. Modern buying discussions often use CNAPP to describe a wider stack that may include posture management, identity analysis, workload protection, runtime controls, code scanning, container security, and remediation workflow.

Those are not one problem. They are different operating outcomes:

CSA CCM v4.1 is useful because it provides a neutral control frame rather than a vendor checklist. Its control areas include identity and access management, logging and monitoring, threat and vulnerability management, change and configuration management, and audit and assurance. NIST SP 800-204C also separates infrastructure as code, policy as code, and observability as code in cloud-native environments. That distinction matters: a CSPM dashboard alone does not prove code prevention or runtime protection.

Methodology and Disclosure

This comparison uses vendor documentation for product architecture and configuration requirements, not for market leadership claims. It uses CSA CCM and NIST material for neutral evaluation criteria.

No live benchmark was run for this refresh. The article does not claim which product is fastest, cheapest, broadest, deepest, or most mature. It also does not include vendor pricing because the locked evidence does not provide current, region-specific, entitlement-specific quotes. For Defender for Cloud, Microsoft directs buyers to the official cost calculator for tenant-specific estimation.

There is one ownership change to account for during evaluation: Google announced on March 11, 2026 that it completed the acquisition of Wiz and stated that Wiz would retain its brand and support customers across cloud environments. That confirms the transaction and stated multi-cloud commitment. It does not prove future roadmap, support, data residency, or commercial terms.

Capability Map: Documented Product Architecture

Microsoft Defender for Cloud

Microsoft documents CSPM as a core Defender for Cloud capability with two CSPM plans: Foundational CSPM and the paid Defender CSPM plan. The Microsoft CSPM concept page identifies Foundational CSPM as free and Defender CSPM as paid. That supports describing the plan distinction, not a claim that Defender is cheaper or better than any competitor.

The Defender CSPM enablement documentation describes paid-plan capabilities including attack-path analysis, Cloud Security Explorer, regulatory compliance features, and agentless machine scanning. It also creates an important POC gate: Microsoft notes that agentless scanner activation may require Subscription Owner permissions. A lower-privileged user may enable the plan but not activate the scanner, which means expected vulnerability findings may not appear until the right authorization is in place.

For non-Azure environments, do not assume parity from a generic product label. Validate connector status, supported services, required permissions, and expected findings in the actual AWS or GCP scope. Microsoft says the built-in Microsoft Cloud Security Benchmark applies implementation guidance to Azure and other supported cloud providers, but that does not prove identical service-level coverage across providers.

For pricing, remove fixed figures from the evaluation deck. Use Microsoft's Defender for Cloud cost calculator and require a tenant-specific estimate tied to the plans, regions, and billable resources in scope.

Wiz

Wiz describes its platform as agentless-first and says it supports CSPM, CIEM, DSPM, CWPP, and IaC scanning. It also says its agentless workflow uses read-only snapshot scans for workload vulnerability and configuration assessment. Those statements support describing the operating model, not a guarantee of complete discovery or a fixed deployment timeline.

Wiz describes its Security Graph as a model that correlates misconfigurations, vulnerabilities, identities, network exposure, secrets, and data to identify contextual attack paths. Treat that as a prioritization model to test. In a POC, the question is not whether the graph exists. The question is whether it identifies the high-risk paths your team already cares about, suppresses noise without hiding relevant exposure, and produces outputs engineers can act on.

The previous version of this article said Wiz could not provide behavioral runtime protection because it was agentless. That is no longer a defensible statement from the locked evidence. Wiz documents an optional eBPF-based runtime sensor for supported Linux and Kubernetes environments. The accurate operating-model distinction is agentless-first, not agentless-only. Validate supported workloads, detection modes, enforcement modes, and ownership for any runtime component.

Orca Security

Orca describes SideScanning as an agentless approach that uses cloud-level, read-oriented access to reconstruct a workload filesystem for analysis without an endpoint agent. Orca's technical brief describes onboarding through an IAM role with read-oriented permissions and optional remediation resources.

That architecture can reduce endpoint-agent deployment work, but it does not remove the need for a cloud IAM review. Read-oriented access can still expose metadata, snapshots, data classifications, or workload contents depending on configuration and scope. Review the requested role, trust relationship, scope boundaries, data accessed, expiration or review process, and removal procedure.

Do not assume a universal rescan cycle. The locked evidence does not support a fixed default scan latency claim. Measure discovery and rescan behavior after a controlled configuration change in your environment. Review optional remediation permissions separately from read-oriented onboarding permissions.

Prisma Cloud

Palo Alto Networks documents edition and module distinctions that should be explicit in any comparison. Prisma Cloud Enterprise Edition includes CSPM and CWPP. Prisma Cloud Compute Edition is CWPP-only and self-hosted.

Prisma Cloud documentation describes both agentless workload inspection and agent-managed runtime protection. Runtime protection involves deploying and managing Defenders for applicable workloads. The application-security documentation covers IaC, SCA, secret scanning, CI/CD security, and container-image scanning. Runtime documentation describes host, container, and serverless runtime-defense capabilities, with policy modes including alert and prevention.

That supports a concrete evaluation plan: test CSPM separately from Compute/runtime functions. For runtime, document Defender deployment, supported workload types, policy learning and tuning, alert behavior, prevention behavior, rollback, and operational ownership. Do not treat the word CNAPP as proof that every module is licensed, configured, tuned, and producing usable evidence.

Buyer Scorecard

Use this scorecard during a scoped vendor evaluation. Fill it with evidence, not impressions.

A compliance dashboard is not proof of compliance. CSA CCM helps organize control areas and implementation guidance. Your organization still needs evidence that controls are implemented, operating, owned, reviewed, and retained.

Run a POC That Can Disprove Your Assumptions

Define success criteria before vendor access. At minimum, test discovery coverage, least-privilege integration, priority accuracy, finding ownership, time to validate remediation, exportability, and alert-volume handling.

Build a small approved non-production test set:

• One public-storage exposure.
• One over-permissive identity.
• One vulnerable workload.
• One Kubernetes or container configuration issue.
• One IaC misconfiguration in a pull request.

Then run product-specific checks.

For Defender CSPM:

• Enable the intended plan only in a pilot subscription first.
• Verify connector status for non-Azure environments.
• Confirm which user can activate agentless scanning.
• Document which findings appear only after scanner activation.
• Compare foundational CSPM results with paid Defender CSPM results.

For Wiz:

• Review cloud-connector permissions with IAM owners.
• Verify inventory coverage against the known test set.
• Test Security Graph context against the controlled high-risk scenario.
• Validate optional runtime-sensor scope for supported Linux or Kubernetes workloads.
• Run developer workflow output against a real pull request.

For Orca:

• Review the requested IAM role and trust relationship.
• Separate read-oriented permissions from optional remediation permissions.
• Confirm inventory coverage against the known test set.
• Measure rescan behavior after a controlled configuration change.
• Record any missing assets, duplicate findings, or evidence-export gaps.

For Prisma Cloud:

• Test CSPM separately from Compute/runtime functions.
• Document Defender deployment requirements.
• Test policy learning and tuning before prevention.
• Run alert-only and prevent-mode behavior as separate tests.
• Verify IaC, SCA, secrets, CI/CD, and container-image workflows only if those modules are in the intended entitlement.

Assign a remediation owner for every test finding. Do not score a platform solely on detection volume. Record false positives, duplicate findings, missing assets, findings without a viable owner, and export gaps. These are buying risks, not POC annoyances.

Configuration Review Examples

Use these as review checklists, not copy-paste production policy.

Least-Privilege Cloud Onboarding

For each vendor connector, document:

Read-only does not mean risk-free. It means the permission set should be reviewed as a read-oriented integration rather than as a blind trust grant.

Defender CSPM Pilot

Start in one pilot subscription. Enable the intended Defender CSPM plan. Confirm the agentless scanner is activated by a Subscription Owner where required. Record which findings appear before and after scanner activation. If AWS or GCP is in scope, validate connector status and service coverage in the actual provider accounts selected for the POC.

Runtime Protection Pilot

Start in alert-only mode for a controlled workload. Capture expected behavior, tune policy, rehearse rollback, and only then decide whether prevention is appropriate. This matters for any platform where a runtime component can block processes or activity.

IaC Workflow Pilot

Scan one deliberately misconfigured non-production template in the pull-request path. Confirm that the developer receives an actionable result, the security team can suppress with expiry and rationale, and remediation can be verified after deployment.

Exception Process

Require an expiration date, compensating control, risk owner, and revalidation trigger for every accepted finding. A mute-forever workflow is not an exception process.

Failure Modes Buyers Should Plan For

Cloud API visibility and workload/runtime visibility are different. Do not represent either as universal coverage.

Risk graphs prioritize based on vendor-specific models. They can help triage, but they do not replace asset classification, business context, or human review.

Read-oriented integrations still create a security-review obligation because they may access metadata, snapshots, logs, data classifications, or workload contents.

Runtime prevention can cause operational impact if policies are not tuned. Treat discovery, alerting, and blocking as separate tests.

Compliance mappings help organize evidence. They do not automatically demonstrate legal, regulatory, or certification compliance.

CNAPP modules and commercial packaging change. Tie the comparison to documented capabilities and the buyer's signed entitlement, not to a generic product label.

Affiliate economics should not determine the recommendation. This comparison has no evidenced affiliate fit among the compared vendors, so it should remain neutral and avoid product CTAs unless a relevant, disclosed, approved relationship exists later.

Selection Patterns, Not Winners

If your organization is Azure-centric, start by validating Defender for Cloud's foundational and paid Defender CSPM plans in a pilot subscription. Confirm non-Azure connector needs if AWS or GCP is in scope. Confirm Subscription Owner requirements for agentless scanner activation.

If your organization is meaningfully multi-cloud, test asset parity and prioritization across the actual providers, accounts, projects, and clusters you operate. Do not accept a generic multi-cloud label as proof of service-level coverage.

If runtime enforcement is a requirement, test sensor or Defender deployment, policy learning, alert-only behavior, prevention behavior, and rollback. Agentless-first and agentless-only are materially different operating models.

If code-to-cloud workflow is a requirement, test a real pull request, not a demo repository. The result should be actionable for developers, suppressible with a documented rationale, and verifiable after deployment.

If your team is lean, favor the platform whose findings have clear owners and a maintainable workflow after the POC. A smaller set of owned, verified findings is more valuable than a larger dashboard nobody works.

Related Protego Reading

• Defender for Cloud feature guide
• Azure Policy vs. Defender for Cloud
• AKS container security
• Terraform scanner comparison
• Cloud security fundamentals

Source Notes and Update Policy

This article should be refreshed when a vendor materially changes CSPM, runtime, code-security, connector, pricing, packaging, ownership, or entitlement documentation. Date-stamp vendor documentation in future reviews. Remove stale commercial claims unless they are tied to a dated quote, calculator output, or other reviewable source.

Do not add market-share numbers, pricing ranges, onboarding-duration estimates, maturity rankings, or universal winner labels unless new evidence supplies methodology, date, scope, and source.

Frequently Asked Questions

Which CSPM tool is best in 2026?

There is no evidence-locked universal winner in this comparison. Choose through a scoped evaluation that tests inventory coverage, permissions, prioritization, prevention workflow, runtime requirements, remediation ownership, exportability, and commercial predictability in your own environment.

Is Defender for Cloud free?

Microsoft documents Foundational CSPM as free and Defender CSPM as a paid plan. The paid plan includes capabilities such as attack-path analysis and agentless machine scanning. Use Microsoft's cost calculator and a tenant-specific estimate for pricing decisions.

Is Wiz only agentless?

No. Wiz describes itself as agentless-first and documents an optional eBPF-based runtime sensor for supported Linux and Kubernetes environments. Validate runtime coverage, detection modes, and enforcement behavior in a POC.

Does Orca require endpoint agents?

Orca describes SideScanning as an agentless approach using cloud-level, read-oriented access to reconstruct a workload filesystem for analysis. That does not remove the need to review connector permissions, data access, rescan behavior, and optional remediation permissions.

How should Prisma Cloud be evaluated?

Evaluate Prisma Cloud CSPM separately from Compute/runtime functions. Palo Alto Networks documents agentless workload inspection and agent-managed runtime protection. Runtime protection involves deployed Defenders, policy tuning, and separate alert and prevention tests.