Global Tool Radar

Evidence-led software shortlist

Best Cloud Security Posture Management (CSPM) Software

Compare 8 products that meet the research threshold. Ranking uses category-specific buying scores and keeps fit conditions, limitations, and evidence confidence visible.

Build a shortlist by buyer conditionSecurity & Privacy

Build a shortlist by buyer condition

Cloud Security Posture Management (CSPM) Software

Filter by fit first, then compare cost, capability depth, and buying constraints. Rank is a starting point, not the decision.

#1

Rapid7 InsightCloudSec

Rapid7 InsightCloudSec is a cloud security platform with agentless multicloud inventory, CSPM policy checks, compliance governance, attack paths, contextual risk scoring, no-code remediation bots, APIs, and optional adjacent CNAPP capabilities.

85Category score
Pricing
  • Paid · InsightCloudSec · $66000 USD · per subscription · per year · Direct 500 resource tier · billed annually · one-year commitment · minimum 251 average billable resources · Trailing-month average of 251-500 defined billable resources during each quarter
  • Paid · InsightCloudSec · $93000 USD · per subscription · per year · Direct 750 resource tier · billed annually · one-year commitment · minimum 501 average billable resources · Trailing-month average of 501-750 defined billable resources during each quarter
Best for
  • Enterprise
  • Mid-market
Strong fit for
  • Enterprises with AWS, Azure, GCP, OCI, Alibaba Cloud, sovereign partitions, and Kubernetes
  • Cloud governance programs needing custom policy, exceptions, audit exports, guardrails, and remediation Bots
Check before buying
  • Small estates that require a published direct tier below 251 billable resources
  • Buyers expecting a flat fee unaffected by quarterly resource reconciliation
#2

Wiz Cloud Security Platform

Wiz Cloud Security Platform delivers CSPM through Wiz Cloud, using agentless cloud API connections, the Wiz Security Graph, configuration rules, compliance frameworks, attack-path context, remediation workflows, and a broad integration ecosystem.

85Category score
Pricing
  • Some paid plan amounts are unverified — check official pricing
Best for
  • Enterprise
  • Mid-market
Strong fit for
  • Enterprises with complex AWS, Azure, GCP, OCI, Alibaba, Kubernetes and hybrid estates
  • Security teams that need graph-based posture prioritization using identity, exposure and data context
Check before buying
  • Small organizations seeking an inexpensive standalone CSPM
  • Buyers that require a full direct price sheet and plan feature matrix before sales engagement
#3

Microsoft Defender for Cloud

Microsoft Defender for Cloud provides free Foundational CSPM and paid Defender CSPM plans, combining multicloud inventory, secure score, policy assessment, compliance, a cloud security graph, attack paths, data and identity context, governance, and workflow automation.

80Category score
Pricing
  • Free plan available — see plan limits
  • Some paid plan amounts are unverified — check official pricing
Best for
  • Enterprise
  • Mid-market
  • Small business
Strong fit for
  • Azure-centered organizations wanting native policy, management-group, automation, and Microsoft security integration
  • Teams that want a free multicloud baseline before selectively enabling advanced paid CSPM
Check before buying
  • Buyers requiring one flat public paid price across every cloud resource type
  • Teams expecting Foundational CSPM to include graph, attack paths, security explorer, or advanced governance
#4

Tenable Cloud Security

Tenable Cloud Security is Tenable's current CNAPP domain for agentless cloud inventory, CSPM, compliance, identity-aware risk analysis, attack paths, remediation, and developer guardrails across AWS, Azure, GCP, OCI, and Kubernetes. It is sold through quote-based standalone or Tenable One Cloud Exposure routes using billable cloud-resource scope rather than a public monetary rate.

80Category score
Pricing
  • Custom quote required for some paid plans
Best for
  • Enterprise
  • Mid-market
Strong fit for
  • Mid-market and enterprise teams operating AWS, Azure, GCP, OCI, and Kubernetes
  • Organizations that want CSPM correlated with identity, vulnerability, data, and attack-path context
Check before buying
  • Buyers requiring a transparent self-service monetary rate and fixed allowance
  • Teams unable to inventory billable cloud-resource types before requesting a quote
#5

Qualys TotalCloud

Qualys TotalCloud delivers CSPM through the Qualys Enterprise TruRisk Platform, with connectors for AWS, Azure, GCP, and OCI, centralized inventory, continuous controls, compliance governance, attack-path context, remediation, and enterprise workflow integrations.

80Category score
Pricing
  • Paid · Total Cloud package 16 · $5400 USD · per package of 16 hosts · per year · AWS public 16-host 12-month contract · one-year commitment · AWS Marketplace customer able to subscribe to the SaaS listing and accept the vendor EULA
Best for
  • Enterprise
  • Mid-market
  • Small business
Strong fit for
  • Mid-market and enterprise teams operating multiple AWS, Azure, GCP, or OCI accounts
  • Organizations that need custom cloud controls, compliance reports, and auditable policy exceptions
Check before buying
  • Buyers that require Kubernetes posture to be part of the CSPM allocation rather than a distinct KCS module
  • Teams that need CWPP, CDR, CIEM, DSPM, SSPM, AI-SPM, or broad code security assumed from a CSPM purchase
#6

AWS Security Hub

AWS Security Hub is a unified cloud security service whose Essentials plan combines Security Hub CSPM, Amazon Inspector vulnerability management, security-focused inventory, contextual exposure analytics, and response workflows under resource-unit pricing.

79Category score
Pricing
  • Paid · Essentials plan · $3.75 USD · per resource unit · per month · usage based
Best for
  • Enterprise
  • Mid-market
  • Small business
Strong fit for
  • AWS organizations that need native CSPM, vulnerability correlation, and risk prioritization across many accounts and Regions
  • Security teams that want attack-path and exposure context from AWS-native posture and vulnerability signals
Check before buying
  • Google Cloud-first or evenly distributed three-cloud estates requiring one native control plane
  • Organizations seeking a complete GRC, audit evidence, and certification management platform
#7

Sysdig Secure

Sysdig Secure delivers CSPM inside its broader CNAPP through agentless cloud connections, Kubernetes posture checks, dynamic inventory, graph search, custom posture controls, compliance governance, IaC remediation, and CSPM APIs.

78Category score
Pricing
  • Custom quote required for some paid plans
Best for
  • Enterprise
  • Mid-market
Strong fit for
  • Mid-market and enterprise teams operating multicloud and Kubernetes estates
  • Security teams that want graph-based resource and identity context for posture findings
Check before buying
  • Buyers requiring public numeric CSPM pricing before sales engagement
  • Teams seeking a clearly packaged low-cost standalone CSPM edition
#8

Lacework FortiCNAPP

Lacework FortiCNAPP is Fortinet's SaaS CNAPP whose cloud-security tiers all include CSPM and KSPM resource discovery, configuration management, custom policies, compliance reporting, and secrets detection, with advanced risk, attack-path, CIEM, workload, DSPM, and code-security capabilities gated or separately licensed.

76Category score
Pricing
  • Some paid plan amounts are unverified — check official pricing
Best for
  • Enterprise
  • Mid-market
Strong fit for
  • Mid-market and enterprise AWS, Azure, Google Cloud, OCI, and Kubernetes estates
  • Teams that want CSPM policy and compliance with behavior-based cloud context
Check before buying
  • Small estates requiring a low public direct per-vCPU price
  • Buyers requiring documented sovereign-cloud coverage

How this list is produced

How this list is produced

A product is included only when it is published, has a complete fact package, supported fit and non-fit conclusions, stored dimension rationales, and no blocking commercial conflict.

  1. Confirm that every product belongs to the same purchasable software category.
  2. Use official evidence for pricing, capabilities, limits, and commercial scope.
  3. Rank with the stored category dimensions and buyer-facing rationales.
  4. Keep unknowns and purchase checks visible; model output is not evidence by itself.

Frequently asked questions

Frequently asked questions

Is the highest-scoring product right for every buyer?

No. Scores use a shared Cloud Security Posture Management (CSPM) Software framework, while the right choice still depends on team size, budget, ecosystem, security requirements, and required capabilities.

Does this list change when products change?

Pages change when newly verified research is published. Check each product’s evidence date; prices are not live.

Are these scores user ratings?

No. They are editorial buying scores built from structured facts and category dimensions. Third-party user ratings are shown separately with their sources.

This page compares published products in Cloud Security Posture Management (CSPM) Software. Scores are editorial fit assessments for this buying category, not user ratings or a claim that one product is universally superior.

This is public-evidence buying research, not an account-based hands-on test. Interface quality, implementation effort, support response, and negotiated terms still require buyer verification.