Prisma Cloud is Palo Alto Networks’ IaC security and CNAPP platform. It covers cloud security posture management, workload protection, entitlement management, data security, and code security across AWS, Azure, GCP, OCI, Alibaba Cloud, and IBM Cloud.
The platform’s code security module is built on Checkov, the open-source IaC scanner from Bridgecrew (acquired by Palo Alto in 2021). Checkov has been downloaded over 2 million times.
Palo Alto Networks is merging Prisma Cloud with Cortex CDR to create Cortex Cloud. The new platform became available in Q3 FY25 (late 2025).
Existing Prisma Cloud customers are being transitioned with all capabilities preserved.
What is Prisma Cloud?
Prisma Cloud Enterprise Edition is a unified CNAPP that bundles CSPM, CWPP, CIEM, DSPM, code security, cloud network security, and web application/API security into a single platform. Rather than buying separate tools for each discipline, teams get a consolidated view of cloud risk.
The platform connects to cloud provider APIs to scan configurations, workloads, entitlements, and code. It maps relationships across resources, identities, and vulnerabilities to prioritize the issues that actually matter in your environment.
Key Features
| Module | Details |
|---|---|
| CSPM | Configuration monitoring across AWS, Azure, GCP, OCI, Alibaba, IBM. 100+ compliance frameworks including CIS. |
| CWPP | Workload protection for VMs, containers, serverless. Runtime defense and vulnerability management. |
| CIEM | Identity and entitlement management across multi-cloud. Net-effective permissions analysis. |
| DSPM | Sensitive data discovery, classification, and access monitoring across cloud storage. |
| Code Security | Built on Checkov. Scans Terraform, CloudFormation, Kubernetes, Helm, ARM templates. SCA and secrets detection. |
| CNS | Cloud network segmentation and microsegmentation. |
| Web App/API | Application-layer protection for web applications and APIs. |
Code Security (Checkov)
The code security module scans infrastructure-as-code files against hundreds of built-in policies based on CIS, NIST, PCI, and HIPAA benchmarks.
Developers get feedback in their IDE and as pull request comments with fix suggestions. The module also runs in CI/CD pipelines, blocking misconfigurations before they reach production.
Supported IaC frameworks: Terraform, CloudFormation, Kubernetes manifests, Helm charts, ARM templates, and Serverless Framework.
Cloud Security Posture Management
CSPM monitors configurations across multiple cloud providers from a single console. It detects misconfigurations like publicly accessible storage buckets, overly permissive security groups, unencrypted databases, and disabled audit logging.
The compliance engine maps findings to regulatory frameworks and generates reports for auditors. Teams can set custom policies or use the built-in policy library.
Cloud Workload Protection
CWPP covers the full workload lifecycle from vulnerability scanning in the CI pipeline to runtime defense in production. It protects VMs, containers, and serverless functions.
Container security includes image scanning, runtime monitoring, and compliance checks for Kubernetes clusters. The platform also supports agentless scanning for workloads where agent deployment isn’t practical.
Entitlement Management
CIEM discovers cloud identities and their effective permissions across AWS, Azure, and GCP. It compares granted permissions against actual usage to flag excessive access, so teams can enforce least-privilege without breaking production.
Getting Started
When to Use Prisma Cloud
Prisma Cloud makes sense for organizations already in the Palo Alto Networks ecosystem or those looking to consolidate multiple cloud security tools into one platform. Having CSPM, CWPP, CIEM, DSPM, and code security in a single console reduces tool sprawl.
Strengths:
- Unified platform covering CSPM, CWPP, CIEM, DSPM, and code security
- Code security built on Checkov, a proven open-source IaC scanner
- Multi-cloud support including AWS, Azure, GCP, OCI, Alibaba, and IBM
- 100+ compliance frameworks with audit-ready reporting
- Integration with Palo Alto’s broader security portfolio
Limitations:
- Commercial product with enterprise pricing (no free tier for the platform itself)
- Complexity of a multi-module platform requires dedicated training
- Transitioning to Cortex Cloud may cause uncertainty for new buyers
- Checkov open-source can be used independently for basic IaC scanning
For a broader view of CNAPP platforms and cloud security, see our cloud infrastructure security guide. For open-source alternatives to the IaC scanning component, see Checkov or Trivy.
For other CNAPP platforms, compare with Wiz and Orca Security.
