Independent Research · Unvarnished Reviews
This report synthesizes vendor pricing pages, published pricing announcements, independent SaaS-pricing research, verified customer and practitioner reviews, and independent analyst and regulatory coverage. Pricing data reflects sources current as of July 2026. Research Notes available on request at [email protected].
Unvarnished Reviews Research
Cloud-Native Application Protection Platform (CNAPP) — the category covering cloud security posture management, workload protection, identity entitlement management, and increasingly AI security posture — has consolidated hard and fast. This report covers the three most-compared platforms: Wiz, Orca Security, and Prisma Cloud (now Cortex Cloud). All three are strong technically. None of the three publish list prices. And the two biggest developments shaping this market in 2026 are not features — they're a rename and an acquisition, and both change what you're actually buying relative to what older research told you.
Wiz built its reputation as the cloud-agnostic challenger — a security layer that worked identically across every major cloud, precisely because it wasn't owned by any of them. Its technical differentiator, the Security Graph, correlates misconfigurations, identities, vulnerabilities, and network exposure into attack-path analysis that shows exploitability rather than isolated alerts. Cloud coverage is the widest of the three platforms here: AWS, Azure, GCP, OCI, Alibaba Cloud, VMware vSphere, Kubernetes, and OpenShift. Reported customer penetration is substantial — figures cited across sources range from "roughly 40–50% of the Fortune 100" to "trusted by half the Fortune 100"; we treat this as a directional figure rather than an audited count, since neither Wiz nor any independent body publishes a verified customer census.
The defining 2026 event: Google announced its intent to acquire Wiz for $32 billion, all-cash, in March 2025 — the largest acquisition in Google's history and the largest pure cybersecurity M&A transaction on record. U.S. antitrust review (DOJ) granted early termination — effectively clearing the deal — on October 24, 2025, and the acquisition formally closed March 11, 2026. A coalition of European civil-society organizations filed third-party observations with EU regulators urging a Phase II investigation, citing market-concentration concerns specific to a hyperscaler acquiring a multi-cloud security control layer; we found no indication a Phase II review was opened as of this writing.
The substantive question for buyers isn't whether the deal is legal — regulators have cleared it in the jurisdictions that have ruled — it's whether "multi-cloud neutral" survives inside Google's ownership. Independent analysis is split but converges on caution: One CNAPP research firm notes existing Wiz customers "report continuity in the near term," but calls Google's long-term multi-cloud strategy "a procurement question worth raising." A competing vendor's CFO — whose framing should be read as a competitor's argument, not a neutral finding — warned that "Wiz customers operating in other clouds are suddenly at risk of becoming second-class citizens, facing higher costs and slower innovation." Trend Micro's independent research raises a more concrete version of the same concern: The realistic risk isn't Wiz abandoning AWS or Azure support outright, but a "GCP-first" prioritization pattern in where new features and integrations land first.
Pricing is not published. Reported figures put annual contracts starting around $100,000 for smaller deployments, scaling into the millions for large enterprise estates, priced against cloud spend or workload count.
Orca takes a similar agentless approach to Wiz — reading workload data at the block-storage level via what Orca calls "SideScanning," without deploying agents into workloads. Independent technical analysis describes the two platforms as genuinely comparable on core agentless capability; the gap is not technology, it's market position — Wiz's larger ecosystem of SOAR integrations, ITSM connectors, and reference architectures compounds over time in a way that raw feature parity doesn't offset.
Orca's native multi-cloud coverage is narrower than Wiz's: AWS, Azure, and GCP, without Wiz's additional OCI, Alibaba, VMware, and OpenShift support. Where Orca has a genuine edge regulated buyers should weigh: FedRAMP Moderate authorization since February 2025 — a credential Wiz does not carry in the sources we reviewed — plus a positioning independent researchers describe as the preferred alternative for organizations in healthcare, financial services, or any sector with data-residency requirements who want DSPM capability without committing to a Google-owned platform's roadmap.
Pricing, also unpublished: Third-party reporting puts the range at roughly $30,000 to $200,000 per year depending on deployment scale — the widest low end of the three platforms, and independent analysis specifically flags Orca as more accessible than Wiz for mid-market organizations where Wiz's pricing and deployment minimums are a poor fit.
This is not a rebrand rumor — it's Palo Alto Networks' own February 13, 2025 announcement: Prisma Cloud was merged with Cortex CDR (Cloud Detection and Response) to form Cortex Cloud, unifying CNAPP capability with real-time detection and response on Palo Alto's broader Cortex platform. The company's stated rationale: Cloud security teams and SOC teams had operated in separate silos with limited shared visibility, and unifying them under one platform closes that gap. Cortex Cloud is also natively available within Cortex XSIAM — the SIEM/SOAR platform Unvarnished has separately reviewed in our Palo Alto Cortex XSIAM vs. Microsoft Sentinel vs. Splunk report — meaning organizations already on XSIAM get a materially different adoption path than organizations evaluating Cortex Cloud standalone.
The practical migration risk multiple independent sources flag: If you collected vendor comparisons, analyst quotes, or your own team's research under the name "Prisma Cloud" before mid-2025, confirm with Palo Alto Networks that the product, packaging, and pricing you're evaluating is the current Cortex Cloud generation — not the predecessor the market still frequently searches for by its old name.
Of the three platforms, independent analysis consistently describes Cortex Cloud as the most feature-comprehensive and the most operationally complex to implement — a hybrid model combining agentless scanning with optional agents ("Defenders") for deeper runtime and Kubernetes protection, born originally from Palo Alto's Twistlock and RedLock acquisitions. Licensing is credit-based: Reported figures put the Business edition at $9,000 per 100 credits and the Enterprise edition at $18,000 per 100 credits — figures that tell you the unit price but not how many credits a typical deployment consumes monthly, which is itself an opacity finding worth pressing a sales team on directly before you sign.
All three vendors withhold list pricing, which is more universal than most categories we've reviewed — even the VMware and Nutanix comparison in our virtualization report had one vendor (Broadcom) publishing a list rate. Here, none do. What we can responsibly show is the reported range per platform, not a single blended total, since none of the underlying units (workload count, cloud spend percentage, credit consumption) convert cleanly between vendors:
| Platform | Reported Annual Range | Pricing Basis | List Price Published? |
|---|---|---|---|
| Wiz | ~$100,000 to $1M+ | Cloud spend or workload count | No |
| Orca Security | ~$30,000–$200,000 | Deployment scale | No |
| Prisma Cloud / Cortex Cloud | Business: $9,000/100 credits; Enterprise: $18,000/100 credits | Credit consumption | Partial — unit price published, consumption rate is not |
Orca's lower entry point is the clearest differentiator in this table for smaller organizations; Wiz and Cortex Cloud both assume enterprise-scale budgets from the outset.
Choose Wiz if: You run a genuinely heterogeneous multi-cloud estate — including OCI, Alibaba Cloud, VMware, or OpenShift, where Wiz's coverage is uniquely broad — and you want the widest integration ecosystem. Before signing or renewing, get Google's multi-cloud neutrality commitment in writing, specifically addressing feature-parity timelines across AWS and Azure, not just a verbal assurance from your account team.
Choose Orca if: You need FedRAMP Moderate authorization, operate under data-residency requirements, are mid-market and found Wiz's pricing or minimums a poor fit, or simply want to avoid adding another hyperscaler dependency to your security stack while a technically comparable independent option exists.
Choose Cortex Cloud if: You're already invested in Cortex XSIAM or the broader Palo Alto platform and want single-vendor consolidation of cloud security and SOC operations. Confirm explicitly that any pricing, feature comparison, or analyst research you're relying on reflects the current Cortex Cloud generation, not the Prisma Cloud predecessor — and budget for the steepest operational complexity of the three platforms here.
Everyone: Ask all three vendors for a reference customer at your approximate cloud spend and workload count, and request their actual reported cost — not a sales estimate. With none of the three publishing list prices, a real comparable invoice is the only way to negotiate from an informed position rather than a vendor's opening quote.
Two forces reshaped this category in the same eighteen-month window: A rename that quietly obsoleted a huge share of existing buyer research, and an acquisition that turns "vendor-neutral multi-cloud security" from a settled feature into an open question the buyer has to interrogate directly. Neither development makes any of the three platforms worse at the technical job of securing a cloud estate — by most independent accounts, Wiz, Orca, and Cortex Cloud are all credible, capable platforms. What's changed is what you have to ask before you buy: Not just "does it work," but "what does this company become in three years, and does that still fit what I needed when I started evaluating it." Price the rename risk and the ownership risk explicitly. The technology was never the hard part of this decision.
Wiz platform capability, cloud coverage, and Security Graph description: reintech.io, appsecsanta.com, and guptadeepak.com, cross-referenced. Fortune 100 customer penetration figures: Reported inconsistently across sources (guptadeepak.com; imfounder.com) — presented as directional, not audited. Google-Wiz acquisition timeline (announced March 2025, DOJ early termination October 24, 2025, closed March 11, 2026, $32B all-cash): SecurityWeek, wire coverage, and the Cloud Security Alliance's research note, cross-referenced against Google's own confirmation. EU civil-society Phase II request: Third-party observations filing, a primary advocacy document, not a regulatory ruling. Competitor commentary (Sysdig CFO quote): SecurityWeek — explicitly flagged in-text as a competitor's characterization. Independent risk analysis: guptadeepak.com and Trend Micro research, respectively. Orca Security capability, FedRAMP authorization date, and positioning: appsecsanta.com and decryptiondigest.com, cross-referenced. Prisma Cloud → Cortex Cloud merger: Palo Alto Networks' own February 13, 2025 press release (primary source), corroborated by Dell'Oro Group and SiliconANGLE independent coverage. Cortex Cloud credit pricing: weavai.app, a third-party pricing analysis — not a Palo Alto Networks published rate card; treated as reported, not official. Pricing ranges for Wiz and Orca: reintech.io and cybersecurityessential.com, respectively — both third-party estimates, not vendor-published rates. If you believe a finding is inaccurate, contact [email protected] with documentation.