Independent Research · Unvarnished Reviews
Unvarnished Reviews Research
Cloud-Native Application Protection Platform (CNAPP), the category covering cloud security posture management, workload protection, identity entitlement management, and increasingly AI security posture, is among the fastest-growing segments of the broader cloud security market. Independent market research puts the CNAPP segment at $10.9 billion in 2025, growing to $28 billion by 2030, a 20.8% compound annual growth rate, among the highest of any cybersecurity sub-category tracked.
That growth is driven by consolidation, not just new spending. Gartner found the average enterprise ran ten separate cloud security tools in 2022; by 2026, 80% of enterprises are expected to have compressed that down to three or fewer vendors. CNAPP platforms are the consolidation vehicle, which is why market-share position matters more here than in a fragmented category: losing this evaluation often means losing the account for adjacent tools too.
Wiz enters this comparison as the mindshare leader. Independent Gartner Peer Insights data puts Wiz's CNAPP mindshare at roughly 20%, ahead of both Orca and Prisma Cloud, and Wiz reached $500 million in annual recurring revenue faster than any cloud security vendor in history. Its customer base, reported at 4,500+ organizations including a large share of the Fortune 100, is the largest of the three platforms in this comparison by most independent counts, though exact Fortune 100 penetration figures vary by source (40% to over 50%, depending on when the count was taken).
This report covers the three most-compared platforms: Wiz, Orca Security, and Prisma Cloud (now Cortex Cloud). All three are strong technically, and none of the three publish list prices. But market position alone doesn't settle this comparison: The two biggest developments shaping this market in 2026 are not features, they're a rename and an acquisition, and both change what you're buying relative to what older research told you.
| Platform | G2 Rating | Reviews (G2) | Primary Market Segment |
|---|---|---|---|
| Wiz | 4.7 / 5 | ~795-840 | Enterprise (54.4% of reviews) |
| Orca Security | 4.6 / 5 | ~227-271 | Mid-Market (50.2% of reviews) |
| Cortex Cloud (formerly Prisma Cloud) | 4.1 / 5 | ~111-112 | Enterprise (38.5% of reviews) |
Wiz leads on both rating and review volume by a wide margin. Cortex Cloud's review base is the thinnest of the three, consistent with the platform's early-2026 rename; some review volume from the Prisma Cloud era may not carry over to the Cortex Cloud listing.
Wiz built its reputation as the cloud-agnostic challenger, a security layer that worked identically across every major cloud, precisely because it wasn't owned by any of them. Its technical differentiator, the Security Graph, correlates misconfigurations, identities, vulnerabilities, and network exposure into attack-path analysis that shows exploitability rather than isolated alerts. Cloud coverage is the widest of the three platforms here: AWS, Azure, GCP, OCI, Alibaba Cloud, VMware vSphere, Kubernetes, and OpenShift. Reported customer penetration is substantial: Figures cited across sources range from "roughly 40 to 50% of the Fortune 100" to "trusted by half the Fortune 100"; we treat this as a directional figure rather than an audited count, since neither Wiz nor any independent body publishes a verified customer census.
The defining 2026 event: Google announced its intent to acquire Wiz for $32 billion, all-cash, in March 2025, the largest acquisition in Google's history and the largest pure cybersecurity M&A transaction on record. U.S. antitrust review (DOJ) granted early termination, effectively clearing the deal, on October 24, 2025, and the acquisition formally closed March 11, 2026. A coalition of European civil-society organizations filed third-party observations with EU regulators urging a Phase II investigation, citing market-concentration concerns specific to a hyperscaler acquiring a multi-cloud security control layer; we found no report that a Phase II review had been opened in the sources reviewed.
The substantive question for buyers isn't whether the deal is legal, regulators have cleared it in the jurisdictions that have ruled, it's whether "multi-cloud neutral" survives inside Google's ownership. Independent analysis is split but converges on caution: One CNAPP research firm notes existing Wiz customers "report continuity in the near term," but calls Google's long-term multi-cloud strategy "a procurement question worth raising." A competing vendor's CFO, whose framing should be read as a competitor's argument, not a neutral finding, warned that "Wiz customers operating in other clouds are suddenly at risk of becoming second-class citizens, facing higher costs and slower innovation." Trend Micro's independent research raises a more concrete version of the same concern: The realistic risk isn't Wiz abandoning AWS or Azure support outright, but a "GCP-first" prioritization pattern in where new features and integrations land first.
Pricing is not published. Reported figures put annual contracts starting around $100,000 for smaller deployments, scaling into the millions for large enterprise estates, priced against cloud spend or workload count.
Orca takes a similar agentless approach to Wiz, reading workload data at the block-storage level via what Orca calls "SideScanning," without deploying agents into workloads. Independent technical analysis describes the two platforms as comparable on core agentless capability; the gap is not technology, it's market position: Wiz's larger ecosystem of SOAR integrations, ITSM connectors, and reference architectures compounds over time in a way that raw feature parity doesn't offset.
Orca's native multi-cloud coverage is narrower than Wiz's: AWS, Azure, and GCP, without Wiz's additional OCI, Alibaba, VMware, and OpenShift support. Where Orca has a real edge regulated buyers should weigh: FedRAMP Moderate authorization since February 2025, a credential Wiz does not carry in the sources we reviewed, plus a positioning independent researchers describe as the preferred alternative for organizations in healthcare, financial services, or any sector with data-residency requirements who want DSPM capability without committing to a Google-owned platform's roadmap.
Pricing, also unpublished: Third-party reporting puts the range at roughly $30,000 to $200,000 per year depending on deployment scale, the widest low end of the three platforms, and independent analysis flags Orca as more accessible than Wiz for mid-market organizations where Wiz's pricing and deployment minimums are a poor fit.
This is not a rebrand rumor, it's Palo Alto Networks' February 13, 2025 announcement: Prisma Cloud was merged with Cortex CDR (Cloud Detection and Response) to form Cortex Cloud, unifying CNAPP capability with real-time detection and response on Palo Alto's broader Cortex platform. The company's stated rationale: Cloud security teams and SOC teams had operated in separate silos with limited shared visibility, and unifying them under one platform closes that gap. Cortex Cloud is also natively available within Cortex XSIAM, the SIEM/SOAR platform Unvarnished has separately reviewed in our Palo Alto Cortex XSIAM vs. Microsoft Sentinel vs. Splunk report, meaning organizations already on XSIAM get a materially different adoption path than organizations evaluating Cortex Cloud standalone.
The practical migration risk multiple independent sources flag: If you collected vendor comparisons, analyst quotes, or your team's research under the name "Prisma Cloud" before mid-2025, confirm with Palo Alto Networks that the product, packaging, and pricing you're evaluating is the current Cortex Cloud generation, not the predecessor the market still frequently searches for by its old name.
Of the three platforms, independent analysis describes Cortex Cloud as the most feature-comprehensive and the most operationally complex to implement, a hybrid model combining agentless scanning with optional agents ("Defenders") for deeper runtime and Kubernetes protection, born originally from Palo Alto's Twistlock and RedLock acquisitions. Licensing is credit-based: Reported figures put the Business edition at $9,000 per 100 credits and the Enterprise edition at $18,000 per 100 credits, figures that tell you the unit price but not how many credits a typical deployment consumes monthly, which is itself an opacity finding worth pressing a sales team on before you sign.
It has the widest cloud coverage, including AWS, Azure, GCP, OCI, Alibaba Cloud, VMware vSphere, Kubernetes and OpenShift, and its Security Graph turns misconfigurations, identities and exposure into attack-path analysis.
It leads on rating and review volume at 4.7 out of 5, and has the widest partner and integration ecosystem.
Google closed its $32 billion acquisition on March 11, 2026, so whether multi-cloud neutrality survives is an open question, with a risk of GCP-first feature prioritization.
Pricing is unpublished, with contracts starting around $100,000 for smaller deployments.
It takes a comparable agentless approach to Wiz and holds FedRAMP Moderate authorization since February 2025, a credential Wiz does not carry in the sources reviewed.
It is described as more accessible for mid-market organizations, with a quoted range of roughly $30,000 to $200,000 a year.
Native coverage is narrower, covering AWS, Azure and GCP without OCI, Alibaba Cloud, VMware or OpenShift.
Its integration and consulting bench is narrower than Wiz's, and it does not publish small-deployment tiers.
It is described as the most feature-comprehensive of the three, with a hybrid model combining agentless scanning and optional agents for runtime and Kubernetes protection.
It has the deepest compliance-framework and DevSecOps integration coverage, and fits organizations already on Palo Alto Cortex XSIAM.
It is the most operationally complex, with a steeper learning curve and a 4 to 8 week staged agent rollout at enterprise scale.
The February 2025 rename to Cortex Cloud can invalidate older research, credit-based licensing does not convert to a workload count, and it has the lowest rating at 4.1 out of 5.
Pricing re-checked October 2026. These vendors sell by quote only (Orca prices by cloud workload), so the figures below are third-party and practitioner estimates, not published list prices.
Wiz and Orca both price per cloud workload, a unit that converts cleanly between the two at matched scope, unlike Cortex Cloud's credit-consumption model, which does not. This is a real, apples-to-apples comparison for these two platforms; Cortex Cloud is shown separately below rather than forced into the same table.
| Platform | Annual Range (5,000 Workloads) | Multi-Year Discount | 3-Year Total (Discounted) |
|---|---|---|---|
| Orca Security | $200,000-$400,000 | 15%-30% | $465,000-$930,000 |
| Wiz | $250,000-$500,000 | 20%-35% | $543,750-$1,087,500 |
Orca's quotes run roughly 15%-30% below Wiz for comparable scope, per independent market data, though anonymized transaction platforms note the two can land closer depending on which feature modules are enabled. At the smaller end of the market, roughly 100 workloads, Wiz's tiered marketplace pricing gives a cleaner baseline: Essential starts around $24,000/year, Advanced around $38,000/year, with the Code add-on bringing a fuller deployment to roughly $58,500/year. Orca does not publish comparable small-deployment tiers, all Orca quotes are custom regardless of size.
Cortex Cloud's credit-consumption model is shown separately since it doesn't convert to a workload-count comparison: Business tier runs $9,000 per 100 credits, Enterprise $18,000 per 100 credits, with actual cost depending entirely on consumption patterns Palo Alto does not publish a conversion rate for. Treat any workload-based estimate for Cortex Cloud as unverified until confirmed with Palo Alto.
Pricing tells only part of the story with CNAPP platforms; the agentless-versus-agent-based architectural split shows up in how long deployment takes and what ongoing administrative burden a security team inherits.
| Dimension | Wiz | Orca Security | Prisma Cloud (Cortex Cloud) |
|---|---|---|---|
| Implementation | Agentless, API-only; read-only cloud access grants full coverage with findings appearing within hours, independently cited as among the fastest time-to-value in the category | Agentless (SideScanning); comparable onboarding speed to Wiz, hours rather than days, since both read storage snapshots rather than deploying software | Hybrid model; agentless CSPM deploys quickly, but the Compute Edition's agent-based runtime module requires staged rollout across a workload fleet, independently documented at 4-8 weeks for full coverage at enterprise scale |
| Admin dependency | Minimal for core posture management; no agent lifecycle to maintain since nothing is installed on workloads | Minimal, same agentless advantage as Wiz; no agent fleet to patch or troubleshoot | Real, ongoing agent management overhead once Compute Edition is licensed, one industry comparison named Prisma Cloud's operational complexity as the steepest of the major CNAPP platforms |
| Learning curve | Attack-path graph model is a different mental model from traditional alert lists; independent write-ups note a ramp-up period for security teams used to siloed CSPM/CWPP tools | Comparable learning curve to Wiz for core posture management; SideScanning's read-only model is conceptually simpler to explain to a team than an agent-based alternative | Steepest of the three per independent comparisons, the credit-based licensing model, module selection (CSPM, CWPP, DSPM, CIEM sold separately), and agent configuration compound into a more involved onboarding process |
| Ecosystem and integration maturity | Widest partner and integration ecosystem in the category; independent analysis attributes this to Wiz's market-leader position, not just its technology | Narrower consulting and integration bench than Wiz, a documented byproduct of Wiz's mindshare advantage rather than a technical gap in Orca's product itself | Deepest compliance-framework and DevSecOps integration coverage of the three, reflecting its longer market history and Palo Alto's existing enterprise security footprint |
The practical takeaway: An organization that wants runtime protection on Kubernetes workloads is choosing agent-based complexity deliberately, not accidentally, since that depth is unavailable from Wiz or Orca without a separate tool. An organization that wants the fastest possible time-to-value and is comfortable with agentless coverage limits gets a simpler operational picture from either Wiz or Orca, with the choice between those two coming down to ecosystem maturity rather than implementation difficulty.
Every finding below is independently documented and material enough to influence a purchasing decision.
Wiz
|
Orca Security
|
Cortex Cloud
|
Choose Wiz if: You run a truly heterogeneous multi-cloud estate, including OCI, Alibaba Cloud, VMware, or OpenShift, where Wiz's coverage is uniquely broad, and you want the widest integration ecosystem. Before signing or renewing, get Google's multi-cloud neutrality commitment in writing, addressing feature-parity timelines across AWS and Azure, not just a verbal assurance from your account team.
Choose Orca if: You need FedRAMP Moderate authorization, operate under data-residency requirements, are mid-market and found Wiz's pricing or minimums a poor fit, or simply want to avoid adding another hyperscaler dependency to your security stack while a technically comparable independent option exists.
Choose Cortex Cloud if: You're already invested in Cortex XSIAM or the broader Palo Alto platform and want single-vendor consolidation of cloud security and SOC operations. Confirm explicitly that any pricing, feature comparison, or analyst research you're relying on reflects the current Cortex Cloud generation, not the Prisma Cloud predecessor, and budget for the steepest operational complexity of the three platforms here.
Everyone: Ask all three vendors for a reference customer at your approximate cloud spend and workload count, and request their actual reported cost, not a sales estimate. With none of the three publishing list prices, a real comparable invoice is the only way to negotiate from an informed position rather than a vendor's opening quote.
Design decides what you are buying. Wiz is an agentless platform with the widest cloud coverage and ecosystem, now owned by Google. Orca Security is an agentless independent with FedRAMP Moderate authorization. Cortex Cloud is Palo Alto's hybrid platform combining posture management with detection and response.
Audience decides which one fits. Wiz fits heterogeneous multi-cloud estates, Orca fits mid-market, regulated and data-residency-sensitive buyers, and Cortex Cloud fits Palo Alto and XSIAM customers consolidating cloud security and SOC operations.
Price depends on the plan and the unit. For 5,000 workloads over three years with discounts, Orca models at $465,000 to $930,000 and Wiz at $543,750 to $1,087,500. Cortex Cloud is credit-based, at $9,000 or $18,000 per 100 credits, and cannot be converted to a workload estimate without a vendor quote.
Choose by situation:
Two forces reshaped this category in the same eighteen-month window: A rename that quietly obsoleted a huge share of existing buyer research, and an acquisition that turns "vendor-neutral multi-cloud security" from a settled feature into an open question the buyer has to interrogate directly. Neither development makes any of the three platforms worse at the technical job of securing a cloud estate: By most independent accounts, Wiz, Orca, and Cortex Cloud are all credible, capable platforms. What's changed is what you have to ask before you buy: Not just "does it work," but "what does this company become in three years, and does that still fit what I needed when I started evaluating it." Price the rename risk and the ownership risk explicitly. The technology was never the hard part of this decision.
Free trials and test-drives. Wiz offers a 14-day free trial with unlimited access that links your code, cloud and AI environments. Orca offers a 30-day cloud security assessment through its AWS Marketplace listing with no obligation or upfront fees. Palo Alto Networks sells Cortex Cloud, the successor to Prisma Cloud, through a demo request. Run any trial against a production-like account, not a test account, because agentless findings depend on what the account contains.