The Forrester Wave™: Cloud Workload Security, Q1 2024

Cloud Workload Security Vendor Product Comparisons 2024

Key features and pros and cons of top Cloud Workload Security products:

CrowdStrike - Leaders

Pros:

Strong agent-based CWP for Linux and Windows
Robust container runtime protection
Versatile and effective IaC scanning
Cloud detection and response capabilities ahead of competition
Easy to install CWP agent
Convincing CWS vision
Innovation potential ahead of competition
CWS revenue contribution from partner network ahead of others

Cons:

CIEM capabilities behind others evaluated
Largest number of workloads protected by agentless CWP lags others
CWS roadmap lags others evaluated
IaC scanning only meets some customer expectations

Palo Alto Networks - Leaders

Pros:

Comprehensive CSPM capabilities
Powerful admin identity and access management (IAC) including role-based access control
Broad and deep CSPM and configuration/compliance templates
Container runtime protection ahead of competition
Strong reporting and auditing
Detection and response capabilities ahead
Very strong CWS roadmap
Large CWS user community
Strong innovation potential as indicated by technical employee staffing

Cons:

Agent-based and agentless CWP only on par with others
CIEM capabilities behind competition
Largest number of workloads protected by agentless CWP behind others
CWS revenue contribution from partner network is behind
Tool sometimes lacks capability to mature and move into enterprise operations and workflows

Aqua Security - Contenders

Pros:

Outstanding container orchestration visibility and protection capabilities
Scale in terms of largest number of workloads protected by agentless CWP ahead of others
CSPM and admin user IAM capabilities on par
CWS revenue contribution from partner network greater than competition
Strong container protections extensively used by customers

Cons:

CIEM capabilities weak
Agent-based operating-system-level CWP weak
IaC scanning weak
CWS product vision behind other vendors
CWS roadmap behind other vendors
Agent-based CWP only meets customer expectations

Check Point Software Technologies - Strong Performers

Pros:

Strong CSPM capabilities across multiple clouds including broad coverage for Oracle and Alibaba Cloud platforms
Leading container orchestrator protections that are easy to use
CWS product vision shines
CWS revenue contribution of partner network ahead
CWS adoption acceleration strategy ahead
Easy to read dashboards

Cons:

Agentless CWP behind competition
Cloud detection and response capabilities weaker than others evaluated
CWS roadmap lags others
Does not maintain a CWS-specific user group
Cloud detection and response meets expectations but customers only starting to implement

Lacework - Contenders

Pros:

CWS admin IAM on par
Compliance configuration templates mapping to policies on par
Agent-based CWP on par
Container runtime and orchestrator protections on par
Ambitious CWS product roadmap ahead of competition
Innovation potential on par
Short deployment times (less than five days)
Painless deployment (performed by three to four practitioners)

Cons:

CIEM capabilities fall behind
Reporting and auditing fall behind
Scale of deployment as indicated by largest number of workloads protected by agentless CWP behind
CWS vision lags
Size of CWS user group lags
CWS revenue contribution from partner network lags
Pricing flexibility and transparency lag
Customers not yet using container orchestration protections

Microsoft - Strong Performers

Pros:

Strong administrative user identity and access management based on core Entra IAM offering
Versatile IaC scanning
Detection and response (risky user detection) ahead
Reporting and auditing ahead
CWS user community ahead of others
Innovation potential as indicated by technical employee staffing distinguishes the vendor
CWS adoption acceleration strategy distinguishes the vendor
Good tool to have in Microsoft Azure environment
Ability to include other cloud environments is a plus

Cons:

Non-Azure CSPM behind
Agentless CWP behind
Container orchestrator protections behind
Partner network's CWS vision behind
CWS revenue contribution behind
Ongoing changes in Defender for Cloud make it difficult to determine which agents to use
Lacks OCI support

Orca Security - Strong Performers

Pros:

Powerful administrator IAM ahead of competition
IaC scanning powerful and ahead of competition
Largest number of workloads protected by agentless CWP ahead
CWS roadmap ahead of competition
CWS revenue contribution from partner network ahead
Vendor willing to work with customers on product improvements

Cons:

Agent-based CWP behind
Container runtime and orchestrator protections behind
Innovation potential as indicated by technical employee staffing behind others
Size of CWS user group behind others
Some recent customer hesitation in procuring the solution
Solution currently lacks container runtime protections

Qualys - Contenders

Pros:

Outstanding agent-based CWP especially vulnerability and malware detection
Reporting and auditing ahead
Scale as measured by largest number of workloads protected by agentless CWP ahead
CWS roadmap ahead of others
Oversized CWS user group
Agent-based CWP functionality used across entire IT infrastructure for vulnerability scanning

Cons:

Mapping configuration compliance templates to policies weak
CIEM capabilities weak
Agentless CWP weak
Container orchestration protection weak
Detection and response (especially risky user detection) weak
CWS product vision lags
Innovation potential as indicated by technical employee staffing lags
CWS revenue contribution from partner network lags
Pricing flexibility and transparency lag
Agentless capabilities not used as much by customers

Rapid7 - Contenders

Pros:

Admin user IAM on par
CSPM on par
CIEM on par
Configuration templates breadth and depth on par
Agent-based CWP on par
Agentless CWP on par
Detection and response to risky users in cloud environments on par
Reporting and auditing on par
Size of CWS user group larger than competitors
Cloud detection and response somewhat above customer expectations

Cons:

Container runtime and orchestrator protections weak
IaC scanning weak
CWS vision lags
CWS revenue contribution from partner network lags
Agent-based CWP significantly below customer expectations

Sysdig - Contenders

Pros:

Very powerful CIEM capabilities providing identity context around configuration artifacts and cloud resource access
Container orchestrator protections ahead of competition
CSPM on par
CWS vision on par
Innovation potential on par
Pricing flexibility and transparency on par
Container orchestrator protection extensively used and meets customer expectations

Cons:

CWS admin IAM falls behind
Agent-based CWP (especially vulnerability scans and file integrity monitoring) falls behind
IaC scanning (much less productized than competitors) falls behind
CWS roadmap lags
CWS revenue contribution from partner network lags
CWS adoption acceleration strategy lags
Some customers do not or are only starting to use agentless CWP

Tenable - Contenders

Pros:

Great templates for satisfying regulatory compliance mandates
Extensive CIEM capabilities ahead of competition
Container orchestration protection functional and on par
IaC scanning functional and on par
Size of CWS user community ahead of competition
CWS revenue contribution from partner network ahead
CWS roadmap on par
Solution primarily used for posture monitoring and managing identity risk

Cons:

Administrative user IAM lags
Agentless CWP lags
Container runtime protection lags
Reporting and auditing lag
CWS vision behind others evaluated
Innovation potential as indicated by technical employee staffing behind
Customers not using solution for container runtime protection

Trend Micro - Strong Performers

Pros:

Agent-based and agentless CWP ahead of competition
Risk detection and response ahead of competition
Innovation potential as indicated by technical employee staffing ahead
CWS revenue contribution from partner network ahead
CWS adoption acceleration strategy ahead
Solution 'saved customers more than once'

Cons:

Admin user management lags
CSPM lags
CIEM lags
Container orchestrator protection lags
IaC scanning lags
Size of CWS user group behind
Customers not yet using agentless CWP

Wiz - Strong Performers

Pros:

Leading agentless CWP
Leading deployment scale as measured by largest number of workloads protected by agentless CWP
Compliance template mapping to policies ahead
CIEM ahead
Agent-based CWP ahead
Container orchestrator protections ahead
CWS revenue contribution from partner network on par
CWS adoption acceleration strategy on par
Agentless CWP significantly above customer expectations

Cons:

Admin user IAM behind
Reporting and auditing behind
CWS roadmap behind
Innovation potential as indicated by technical employee staffing behind
Agent-based CWP adoption is nascent
Container protections not used by all customers

FAQs

Q: Which vendors are Leaders in 2024?

A: CrowdStrike, Palo Alto Networks

Q: What does "Leader" mean in Forrester Wave terms?

A: Leaders in the Forrester Wave evaluation are vendors that offer the strongest current product offerings combined with the most robust strategies for the market. They demonstrate thought leadership, have strong customer adoption, show innovation potential, and execute well on their product roadmaps. In this Cloud Workload Security evaluation, Leaders excel across key capabilities including CSPM, CWP (both agent-based and agentless), CIEM, container protection, IaC scanning, and detection/response while maintaining strong market presence and strategic vision.

Q: How do I interpret a Forrester Wave?

A: https://www.forrester.com/policies/forrester-wave-methodology/

Report:

Top Vendor Products for Cloud Workload Security in 2024

Cloud Workload Security Vendor Product Comparisons 2024

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2024?

Q: What does "Leader" mean in Forrester Wave terms?

Q: How do I interpret a Forrester Wave?

Reference