Cloud Workload Protection

Cloud-native applications require purpose-built controls to gain visibility into compliance posture and maintain compliance for dynamic, ephemeral infrastructures. Prisma Cloud delivers real-time and historical views into compliance status for hosts, containers and serverless functions.

• Achieve compliance from a single solution.

  Centrally monitor compliance posture with a single dashboard that covers hosts, containers and serverless functions as well as Kubernetes and Istio®.

• Use 400+ customizable checks for cloud-native applications.

  Cover leading frameworks, including PCI DSS, HIPAA, GDPR and NIST SP 800-190, with prebuilt compliance templates.

• Leverage CIS Benchmarks.

  Implement or customize checks based on CIS Benchmarks, with approved coverage for the AWS®, Docker®, Kubernetes and Linux CIS Benchmarks.

• Ensure image trust.

  Use trusted images to ensure that application components only originate from authorized sources.

• Integrate compliance across the application lifecycle.

  Add compliance checks as part of the full application lifecycle to alert on or prevent misconfigurations in your applications from reaching production.

Cloud-native applications scale dynamically, requiring a modern automated approach to protection that prevents applications from unwanted activity and threats. With Prisma Cloud, ensure hosts, containers and serverless applications are secure — whether you’re running on public clouds, private clouds or on-premises.

• Unify protection with a single agent.

  Secure them all from a single solution. Prisma Cloud supports Linux and Windows® hosts, containers and Kubernetes, as well as emerging technologies like PaaS and serverless.

• Automate security without needless manual effort.

  Automate baseline policies across process, file system and network activity to achieve security at enterprise scale.

• Capture detailed forensics of every audit or security incident.

  Automatically and securely gather forensics details in a powerful timeline view to enable incident response. You can view data in Prisma Cloud or send it to other systems for deeper analysis.

• Prevent activity across any environment.

  Manage runtime policies all from a centralized console to ensure security is always present as part of every deployment.

• Enable your SOC teams with context-rich data.

  With mapping of incidents to the MITRE ATT&CK® framework, along with detailed forensics and rich metadata, eliminate the challenges for SOC teams in identifying and tracking threats for ephemeral cloud-native workloads.

Safely pull and run container images that possibly contain outdated, vulnerable packages and embedded malware from external repositories. With Image Analysis Sandbox, you can expose risks and identify suspicious dependencies buried deep in your software supply chain that would otherwise be missed by static analysis.

• Capture detailed runtime profile of the container.

  Dynamically scan images in a sandbox virtual machine by collecting processes, networking and filesystem events that occurred while the container was running in the sandbox. The events are displayed for an overview of the container behavior at runtime.

• Assess the risk of an image.

  Scan for suspicious and anomalous container behavior, such as malware, cryptominers, port scanning, modified binary or kernel module modification.

• Incorporate dynamic analysis into your workflow.

  Shift container security left by integrating the Image Analysis Sandbox into CI/CD workflows.

Cloud workloads and apps constantly evolve. Organizations need agile, integrated controls to ensure the entire stack is protected. Only Prisma Cloud offers the flexibility to use agentless and agent-based protections that suit your needs.

• Agentless scanning for easy visibility:

  Gain rapid visibility without deploying preventive or blocking capabilities. Agentless scanning provides quick assessments of risk, including known CVEs, misconfigurations and other security issues.

• Agent-based protection for runtime threats:

  A unified agent framework supports defense in depth to secure cloud-native apps. Agent-based protection provides deep forensic visibility and preventive policies to block and stop suspicious activity.

• Unified console and one policy engine for both approaches:

  Prisma Cloud is the industry's only solution to offer both agentless and agent-based security — all managed from a single location.