Cloudanix
Disclosure: that's usCNAPP+ — the five CNAPP pillars (CSPM, CIEM, CWPP, CDR, Code Security) plus four additions: Agentic JIT for AI coding agents, Code-to-Cloud lineage, compliance-led design for regional regulators, and data-aware controls (DAM, DB-JIT, residency). Inverse heritage to Aqua: Cloudanix is CSPM-first, expanding into workload depth — Aqua is container-first, expanding into posture. Pick the orientation that matches where your risk actually lives.
Where it wins
- Multi-region by default: 4 independent regional control planes (US · EU · India · Middle East) + CloudPrem (deploy inside your VPC).
- MCP-native Agentic JIT: the credential broker and action firewall for Claude Code, Cursor, Kiro, Codex.
- Database JIT & DAM as first-class products, not DSPM bolt-on.
- Published pricing. Standard contract. No per-cloud minimum.
- Compliance-led: DPDPA, RBI, SAMA, IRDAI, DORA shipped as first-class objects.
Where buyers move past it
- If you want the deepest container scanning and SBOM depth available, Aqua and Sysdig still have stronger heritage there.
- Definitional content library (CloudSec-Academy-style) is growing, not yet category-largest.
- Analyst recognition is emerging, not established.
- If your sole evaluation criterion is "fastest first finding via sidescan on AWS," Orca's sidescan ramp is still the benchmark.