By Zoha Ahmed · Nov 1, 2026
Ask Reddit which CNAPP or container scanner to buy and the thread turns into an argument about price and alert volume within a few replies. We read all 278 replies in 71 of those threads from the past year, mostly in r/devops, r/sysadmin and r/AskNetsec, counted one vote per person, and removed vendors posting about their own products.
This is the smallest sample in our set: 215 people, with most brands below on single-digit numbers. Orca and Wiz are the only two with enough volume to compare, and Wiz nearly cancels itself out at 26 recommendations against 25 complaints. Treat anything separated by two or three votes as a tie. Every quote links back to its comment.
Two brands are missing from this table on purpose. Minimus drew 19 recommendations and no complaints, RapidFort 11 and one, which would have put both of them near the top. When we looked at who posted them, 18 of Minimus's 19 accounts had two or fewer comments anywhere in this pull, and those comments paraphrase one claim: that switching base images cut their CVE alerts by most of their volume. We count one vote per person and we drop opinions copy-pasted word for word across accounts, but a claim reworded across accounts passes both of those tests. We cannot prove what is behind it either way, so we have left both out of the count rather than rank them on it.
The ranking
| Tool | Recommend | Complain | Threads | |
|---|---|---|---|---|
| 1 | 35 | 9 | 22 | |
| 2 | 26 | 25 | 22 | |
| 3 | 8 | 5 | 7 | |
| 4 | 7 | 7 | 14 | |
| 5 | 6 | 3 | 7 | |
| 6 | 4 | 0 | 2 | |
| 7 | 3 | 0 | 2 | |
| 8 | 3 | 1 | 4 | |
| 9 | 2 | 1 | 8 | |
| 10 | 2 | 1 | 2 |
"Recommend" and "Complain" count different people, not comments. With 215 commenters, a gap of two or three votes means nothing. Also named, with too few opinions to rank: Snyk, Microsoft Defender for Cloud, Aikido Security, Sysdig and Falco, Docker Hardened Images and Checkov. Minimus and RapidFort are excluded for the reason given above.
1. Orca Security
Orca Security
Best overall
The most recommended tool here, and the usual answer when someone wants posture and workload data without an agent.
Why people recommend it
- Agentless snapshot scanning across AWS, Azure and GCP
- Attack path correlation that people said produced actionable alerts
- Onboards fastest in pilots, and usually quoted cheaper than Wiz
Common complaints
- Scanning is periodic, so it lags anything happening live
- Weak on runtime detection next to sensor-based tools
- Still makes more tickets than a small team can clear
What Redditors said
we run orca and it's been solid for agentless scanning across our multi cloud setup
orca nails the attack path correlation pretty good
orca's somewhere in the middle but pricey for what you get.
Wiz and Orca are ticket factories for small teams.
2. Wiz
Wiz
Most capable, most complained about
The most divided line in the table: 26 people recommended it and 25 complained, almost always about the same two things.
Why people recommend it
- Named the strongest at risk prioritisation and blast radius
- Easy to roll into new cloud accounts as you find them
- Catches misconfigurations other tools here missed
Common complaints
- Price is the most repeated complaint, and renewals came in higher
- Alert volume is heavy until someone tunes the policies
- Mid-market teams said it is built for bigger organisations
What Redditors said
We use Wiz and it's stupid-easy to deploy into additional clouds as we find them.
Costs a ton though, but for us it's worth it.
Quit Wiz last summer as after the first year they dramatically increased their pricing.
I tried Wiz for a midsize setup and ended up drowning in alerts.
3. Chainguard
Chainguard
Best if you can pay for it
The best-regarded hardened image vendor and the most expensive. Nobody argued about the product, only the bill.
Why people recommend it
- The reference option for low-vulnerability images
- Guarantees and support people described as an insurance policy
- Cut patching work for teams who switched
Common complaints
- Invoices called brutal, and quoted above Docker Hardened Images
- The proprietary base OS created migration work
- Not open source, which ruled it out for some teams
What Redditors said
Expensive, but well worth it for our requirements
The switch didn't eliminate all the work, but it reduced it significantly.
Those Chainguard invoices can be brutal.
IME, chainguard uses a proprietary OS, so it created a LOT of work to get our services running on it.
4. Trivy
Trivy
Best free scanner
Aqua's open-source scanner is the free default in CI, and its noise is why people start shopping.
Why people recommend it
- Free, and covers images, dependencies and infrastructure as code
- Good at finding dependency vulnerabilities
- Pairs with Grype and Renovate into a working pipeline
Common complaints
- No exploitability context, so findings pile up
- People chased vulnerabilities that were never reachable
- You add agents anyway for real runtime coverage
What Redditors said
trivy for IaC and container images
Pretty good at finding dependency vulnerabilities
Trivy floods you
trivy without exploitability context creates a lot of noise
5. Upwind
Upwind
Best runtime signal
The runtime-first challenger. People who trialled it liked the signal and called the posture side unfinished.
Why people recommend it
- eBPF sensor cuts false positives by tying findings to what runs
- Cheaper than Wiz for better runtime signal
- Good proof of concept experiences reported
Common complaints
- Azure and GCP coverage called immature
- CSPM nowhere near the incumbents, at a price that is not cheap
- Too much work for a small team to justify
What Redditors said
Upwind was the one that surprised us.
Upwind’s eBPF reduced false positives
Upwind was not mature enough for Azure or GCP.
CSPM is nowhere and they are expensive.
6. Check Point CloudGuard
Check Point CloudGuard
Best if you already run Check Point
Only two threads, but four people picked it over something else and none complained.
Why people recommend it
- Held up better under production load in a direct comparison
- Covers misconfigurations, IAM risk, vulnerabilities and attack paths
- Sensible if Check Point is already in the stack
Common complaints
- None in our sample
What Redditors said
once things went live CloudGuard just held up better under actual load
it gives pretty solid visibility into misconfigurations, IAM risks, vulnerabilities and attack paths
7. Prowler
Prowler
Best open source CSPM
The open-source CSPM people suggest when the budget is zero, usually alongside AWS Security Hub.
Why people recommend it
- Free, with checks Security Hub does not run
- Native Security Hub integration
- Covers several providers, which suits small teams
Common complaints
- None in our sample
What Redditors said
Perfect for smaller teams, supports many different providers
8. Kubescape
Kubescape
Best Kubernetes compliance checks
The Kubernetes compliance checker, paired with ARMO's runtime product. The one complaint is about marketing, not the tool.
Why people recommend it
- Compliance checks against clusters with little setup
- Useful multi-cloud visibility
- Replaces work people were doing by hand
Common complaints
- ARMO's own promotion in these subreddits irritated at least one reader
What Redditors said
We use Kubescape for compliance checks and CADR for runtime monitoring.
So much armo cadr ads today
9. AccuKnox
AccuKnox
Best single-vendor bundle
Named across eight threads, but only three people gave an opinion and two of those read like product descriptions.
Why people recommend it
- Bundles CSPM, KSPM, CWPP, CIEM, DSPM and API security under one vendor
- Agentless, and covers drift detection alongside posture
Common complaints
- Interface called clunky next to Wiz
What Redditors said
AccuKnox takes care of drift detection, runtime security, and CSPM/KSPM
AccuKnox feels clunky compared to Wiz's interface
10. Sweet Security
Sweet Security
Too few opinions to judge
Two strong recommendations, one person who cut off contact with the sales team, and no discussion of the product itself.
Why people recommend it
- Two people named it their first pick for runtime cloud detection
Common complaints
- Sales approach called aggressive enough that one user stopped replying
What Redditors said
Sweet Security all day long and twice on Sundays.
Sweet security's sales team is so aggressive that I've cut all contact with them.
The ones Reddit complains about
These three drew more complaints than recommendations. Prisma Cloud and Lacework are the incumbents people inherited and want to replace. AWS Security Hub and GuardDuty are different: nobody is choosing between them and a CNAPP, they are the native baseline everyone already works around.
Prisma Cloud
Prisma Cloud
The one people inherit
Named in ten threads, more than anything but Orca and Wiz, and the people running it are the ones complaining.
Why people recommend it
- Still treated as an industry default alongside Orca
- Hybrid coverage the cloud-native tools do not match
Common complaints
- Noisy out of the box, the same complaint people make about everything here
- The interface and policy management slow down daily work
- The people who actually use it are the ones who dislike it
What Redditors said
Orca Security and Palo Alto Prisma Cloud are the industry go to right now.
how utterly awful prisma cloud is
the UI and policy management can slow down daily operations
AWS Security Hub and GuardDuty
AWS Security Hub and GuardDuty
Native, and slow
The native option. People keep it because it is already there and complain about what they automate around.
Why people recommend it
- No procurement cycle, and the baseline most teams start from
- Works as a CSPM floor with Prowler covering what it misses
Common complaints
- The API is slow and heavily rate limited, which breaks automation
- GuardDuty findings called spam at volume
- Coverage gaps filled with an open-source scanner
What Redditors said
the combo that actually works: Security Hub CSPM
The API is terribly slow and rate limited.
Been there with GuardDuty spam.
Lacework
Lacework
Complaints only in our sample
Three complaints and nothing else. Nobody in our sample recommended it, which is unusual for a tool named in five threads.
Why people recommend it
- The complaints concede it adds runtime coverage on top of posture scanning
Common complaints
- Scans eat pipeline time
- Little visibility into when scans and checks run
- Full coverage means deploying agents
What Redditors said
Lacework adds runtime coverage but eats pipeline time
biggest issue is low/no visibility into when scans/checks occur
How we built this ranking
We pulled every Reddit thread from the past 12 months in devops, sysadmin and security subreddits, then kept the threads about cloud posture management, CNAPP platforms and container and workload scanning. An AI model read each comment that named a tool and labelled it as a recommendation, a complaint or a neutral mention, and we checked that every quote appears word for word in the original comment. Vendors posting about their own products were removed, as was any opinion copy-pasted across different accounts. This category gave us fewer people than any other ranking we have built, 215 against more than 500 for password managers, so the long tail of this table rests on two or three opinions per brand. We refresh the data regularly.
Sell a cloud security platform?
Your buyers are in these threads right now, telling each other what their Wiz renewal came in at. We run Reddit ads that put your brand in front of them.
See how Reddit ads work for SaaSCloud security FAQ
What is the best cloud security tool according to Reddit?
Orca Security, on volume. 35 people recommended it against 26 for Wiz, with 9 complaints against Wiz's 25. On a sample of 215 people, read that as a lead rather than a verdict.
Wiz or Orca?
The threads split almost evenly. Wiz is called the stronger product for risk prioritisation, and nearly every complaint about it is price or alert volume. Orca is quoted cheaper, onboards faster and has a cleaner interface, but loses on runtime detection.
Do hardened container images reduce vulnerability counts?
According to the people using them, yes. Minimus was recommended by 19 accounts and Chainguard by 8, with reports of scanner findings dropping to around a dozen per image. The disagreement is about cost and lock-in, not the result.
What is the best free cloud security tool?
Trivy for images, dependencies and infrastructure as code, and Prowler for posture checks on top of AWS Security Hub. Both come with a condition: Trivy reports findings without exploitability context, which is why several people started paying.