The agentless and agent-based hybrid in Prisma Cloud 5.0

Palo Alto Networks integrates Prisma Cloud into Cortex Cloud to merge cloud security with detection and response. This evolution combines Prisma Cloud capabilities with Cortex CDR and XSIAM. The platform uses agentless scanning to monitor hosts and containers for vulnerabilities by scanning root volumes of snapshots. This capability works for AWS, Google Cloud, Azure, and Oracle Cloud Infrastructure. I see the product as a way to avoid the constant overhead of managing agents on every ephemeral workload. The system uses a unified agent framework, the Defender, to provide runtime protection and deep forensic visibility. This agent works for Linux and Windows hosts, containers, and Kubernetes. The integration of Bridgecrew provides scanning for Infrastructure as Code templates like Terraform and CloudFormation. To improve security for container images, the tool uses an Image Analysis Sandbox, which uses machine learning to inspect processes, file systems, and network activity and device logs in an isolated environment before deployment.

The platform’s use of agentless scanning via cloud provider APIs and disk snapshots allows teams to gain quick visibility into their security posture without the immediate need to deploy agents. This covers both active and dormant virtual machines in the public cloud. Because the platform was assembled through multiple acquisitions, security teams investigating an incident or tracing a risk across layers must often navigate between different dashboards and manually reconcile signals that do not share a common data model. Rapid Risk Discovery improves the architecture to reduce alert times. This allows customers to address issues faster and save costs from excessive API calls and cloud audit log investigation. Users can also leverage Identity-Based Microsegmentation, which uses pre-defined rules and application profiling to automate least-privilege access for cloud native applications. This includes net effective permissions analysis for Microsoft Azure environments.

Wiz and the architectural divide

Wiz maintains a different approach after Google acquired the company for 32 billion dollars in March 2026. Wiz builds its security graph from a single architectural starting point using agentless, graph-based scanning. Palo Alto Networks builds its platform by acquiring distinct technologies. This makes the experience feel more fragmented than a cohesive product. I find the need to switch between different consoles for posture, compute, and runtime management and protection to be a significant operational burden. You should pay attention to whether a platform integrates modules at the data layer or just at the UI layer. While Wiz provides fast time to value via APIs, Palo Alto Networks provides a vendor-neutral stance because it lacks a hyperscaler infrastructure business. Google committed to maintaining Wiz’s multi-cloud support for AWS and Azure as a condition of antitrust approval. Wiz and Orca now use eBPF sensors to add real-time detection and active blocking. Palo Alto Networks uses its Defender agent, which includes a runC shim to intercept container creation and check it against policy. Does the merger of Prisma Cloud into Cortex Cloud actually solve the fragmentation problem for long-term users?

Operational reality and costs

Users rely on the platform for Cloud Security Posture Management and workload protection. Many teams use the tool to check for vulnerabilities and maintain compliance with standards like GDPR or PCI DSS. Users in the financial services and telecom sectors use Prisma Cloud to protect workloads like serverless functions and containers. The platform provides a centralized view to prioritize risks across public and private clouds. However, many users find the detective side of the tool stronger than the preventative side. Some organizations rate the preventative capabilities as a seven or eight out of 10 and hesitate to use them in runtime to avoid application disruption. One user noted that the platform covers both cloud and container, but there is often confusion about who owns what during the transition to DevSecOps.

Pricing follows a cloud credit model.

Users often find that integrating with tools like Splunk requires custom work. One user had to create custom scripts and Lambda functions to ensure events formatted correctly for their SIEM. Additionally, users note that the platform covers build and run stages well, but the deploy stage feels shakier. The deployment process is difficult because much of the integration relies on API-driven workflows rather than simple configuration. The Adoption Advisor dashboard helps users see which platform capabilities they have activated and provides guidance for using unused features.