Customer Snapshot
| Attribute | Details |
|---|---|
| Industry | FinTech / SaaS |
| Company Size | 200–500 employees |
| Cloud Environment | GCP (70%), Azure (30%) |
| Workloads | VMs + GKE (Kubernetes-heavy) |
| Databases | MySQL (primary), MongoDB |
| Code & CI/CD | GitHub, Jenkins Plugins |
| IAM Profile | 10–15 people with console access |
| Compliance | ISO 27001, SOC 1, SOC 2, GDPR |
| Existing Evaluations | Wiz, Orca |
| Primary Interest | CSPM (with appetite for full platform) |
| Products Hosted | 2 enterprise SaaS products on GCP using OLTP |
The Situation: A FinTech Outgrowing Manual Cloud Security
This is a profile we see frequently in FinTech SaaS. A company running two enterprise products on GCP, processing financial transactions via OLTP, with a secondary Azure footprint handling roughly 30 percent of their infrastructure. The engineering team had grown quickly, the cloud surface had expanded across both providers, and the security function was lean by design — not under-invested, but deliberate. A VP of Digital Transformation covering automation, customer success, and marketing, paired with a security-focused counterpart. Two people making decisions for a cloud environment that spans two providers, multiple GKE clusters, a mix of VMs, and databases handling real financial data.
They came looking for CSPM. That is where the conversation started. But it became clear very quickly that the actual need was broader: multi-cloud visibility, Kubernetes security for GKE, compliance evidence generation for four frameworks, and a platform that could grow with them across code security and cloud posture without adding another three tools to the stack.
They had already looked at Wiz and Orca. Both were on the table. A colleague had recommended evaluating Cloudanix alongside those two, and the conversation that followed revealed why a CNAPP+ approach fits this profile better than a pure-play CNAPP.
The Core Tension
Two clouds. GKE as the primary compute surface. Four compliance frameworks running in parallel. A small team evaluating three vendors. And a recognition that buying a CSPM tool today means buying into a platform for the next 2–3 years. So the choice needs to cover not just today’s gap but tomorrow’s surface.
The team was technically sophisticated. They had already used an AI tool to generate a comparison between Wiz, Orca, and Cloudanix before the first call. They knew the feature landscape. What they needed was clarity on which platform would cover the most surface without requiring them to bolt on additional point tools as their security maturity grew.
Where the Gaps Were?
Multi-Cloud Without Unified Visibility
Running 70% GCP and 30% Azure means operating across two completely different security models: GCP’s IAM hierarchy (organization → folder → project → resource) and Azure’s management group / subscription model. Each has its own native security tooling (GCP Security Command Center and Microsoft Defender for Cloud) and each provides a single-cloud view only.
For a team of this size, context-switching between two cloud provider consoles, two security dashboards, two sets of findings, and two compliance reporting mechanisms is not sustainable. The question they were asking was straightforward: can we see GCP and Azure in one place, with one set of findings, one compliance view, and one prioritisation model?
Neither GCP SCC nor Defender for Cloud can answer that question. They are designed for their own cloud and have no cross-cloud correlation capability.
GKE as a First-Class Security Surface
With GKE handling the majority of compute workloads, Kubernetes security is not an add-on concern; it is the primary attack surface. GKE-specific security gaps that need dedicated coverage:
- Pod security misconfigurations: Privileged pods, host PID/network sharing, containers running as root, missing security contexts, overly permissive pod security policies.
- RBAC sprawl: ClusterRoleBindings granting excessive permissions, service accounts with more access than their workloads require, default service accounts left active.
- Network policy gaps: Missing or overly permissive NetworkPolicies that allow lateral movement between namespaces.
- Image security: Containers pulling from public registries without vulnerability scanning, unsigned images, base images with known CVEs.
- GKE-specific configuration: Binary Authorization not enforced, Workload Identity not configured (falling back to node-level service accounts), private clusters not enabled, legacy ABAC still active.
- Secrets in plain text: Kubernetes secrets stored without encryption at rest, or worse, hardcoded in pod specs and ConfigMaps.
Most CSPM tools treat Kubernetes as a checkbox. They run CIS Kubernetes Benchmark checks and call it done. For a team where GKE is 70%+ of compute, that level of coverage is insufficient. They need a platform that treats GKE clusters, namespaces, workloads, and RBAC as first-class graph entities with the same depth of analysis applied to cloud resources.
Four Compliance Frameworks Running Simultaneously
ISO 27001, SOC 1, SOC 2, and GDPR each with different control structures, different audit cycles, and different evidence requirements. For a FinTech processing financial transactions, these are not optional checkboxes. They are conditions of doing business with enterprise customers and operating in regulated markets.
The compliance challenge for this team was not understanding the frameworks; it was generating evidence across two cloud providers and their Kubernetes workloads without spending weeks assembling spreadsheets before every audit. They needed continuous compliance posture mapped to all four frameworks, with evidence exportable in formats auditors accept.
Manual compliance reporting across GCP + Azure + GKE for four frameworks requires dedicated headcount. This team did not have that luxury and should not need it.
Jenkins CI/CD Without Integrated Security Gates
Jenkins with plugins as the CI/CD layer means the build pipeline exists but security scanning within that pipeline is either absent or bolted on without integration into the broader security posture. The risk: code ships to GKE clusters without pre-deployment security checks, and findings in production have no lineage back to the commit that introduced them.
For a team running two enterprise OLTP products, a vulnerability in production that could have been caught at build time is not a minor miss, it is a financial and compliance risk.
Why Wiz and Orca Were Not the Complete Answer?
The team had already evaluated Wiz and Orca. Both are strong products. But for this specific profile (GCP-heavy, GKE-first, multi-cloud, with compliance requirements across four frameworks and a small team that cannot afford tool sprawl) there are structural gaps:
What Wiz Does Well and Where It Stops?
Wiz excels at agentless cloud posture, attack-path visualisation, and toxic-combination detection. It has strong GCP coverage and a well-built enterprise sales motion. For a team evaluating CSPM only, Wiz is a credible choice.
Where it stops for this team:
- SaaS-only deployment. No option to deploy inside the customer’s own GCP or Azure account. For a FinTech handling transaction data, data residency and egress control matter.
- No JIT access. As the team matures and needs to eliminate standing privilege across GCP, Azure, GKE, and databases, Wiz has no broker for that.
- No Database Activity Monitoring. With MySQL and MongoDB handling OLTP transactions, the team will eventually need query-level monitoring, dynamic PII masking, and destructive-query prevention. Wiz does not cover the data tier.
- Closed graph. You cannot bring your own rules, your own data, or query the asset graph in natural language.
What Orca Does Well and Where It Stops?
Orca pioneered SideScanning for agentless cloud visibility and provides broad multi-cloud coverage including GCP and Azure. Solid CSPM with reasonable Kubernetes support.
Where it stops for this team:
- Similar limitations on JIT and DAM. No built-in Just-In-Time access brokering, no database activity monitoring.
- No coding agent security. As AI coding tools enter this team’s workflow (a matter of when, not if, for a FinTech engineering team of this size), neither Wiz nor Orca offers an on-host firewall for coding agents.
- Support model. Ticket-based support versus engineering-led, shared-channel support is a meaningful difference for a small team that needs answers quickly.
The structural point: both Wiz and Orca solve today’s CSPM problem. Neither solves tomorrow’s JIT, DAM, or AI-agent security problem without adding more tools. For a team evaluating a 2–3 year platform decision, that matters.
How Cloudanix Addresses This Situation?
Unified Multi-Cloud Dashboard: GCP + Azure in One View
Cloudanix connects to GCP projects and Azure subscriptions via read-only service accounts and app registrations which is agentless, and requires no infrastructure changes. Both clouds appear in a single dashboard with:
- Findings normalised across providers (the same misconfiguration in GCP IAM and Azure AD appears with the same severity, the same remediation guidance, and the same compliance mapping).
- Cross-cloud correlation: an identity in Azure AD that has permissions reaching GCP resources via federated access is visible as a single attack path, not two separate findings in two separate tools.
- Aggregate posture scoring across both clouds, with the ability to drill into per-project (GCP) or per-subscription (Azure) views.
For a team that is 70% GCP and 30% Azure, this means they are not running two security workflows. They are running one.
GKE and Kubernetes Security as a First-Class Citizen
Cloudanix treats GKE clusters, namespaces, workloads, RBAC bindings, network policies, and pod security configurations as first-class entities in the unified asset graph. This means:
- Kubernetes Security Posture Management (KSPM): Continuous assessment against CIS Kubernetes Benchmark, GKE-specific hardening guidelines, and custom rules. Not just a one-time scan, but continuous monitoring as cluster configurations drift.
- Workload-level visibility: Every pod, deployment, and statefulset assessed for security context misconfigurations, privilege escalation paths, and image vulnerabilities.
- RBAC analysis: Over-permissive ClusterRoleBindings and RoleBindings surfaced with specific remediation steps. Default service accounts that should be disabled, flagged automatically.
- Network policy assessment: Namespaces without NetworkPolicies identified. Overly permissive policies that allow cross-namespace traffic flagged with blast-radius context.
- GKE-specific checks: Workload Identity configuration, Binary Authorization enforcement, private cluster mode, legacy ABAC detection, node auto-upgrade status, and Shielded GKE Nodes validation.
- Image vulnerability scanning: Container images assessed for known CVEs with EPSS and KEV correlation. So the team knows not just that a CVE exists, but whether it is actively exploited and whether their specific workload is exposed.
For this team, where GKE is the dominant compute surface, this is the difference between a CSPM that checks cloud resources and ignores the workloads running on them, and a platform that treats the entire stack (cloud infrastructure, Kubernetes orchestration, and container workloads) as a unified security surface.
Compliance Across Four Frameworks Without Manual Assembly
Cloudanix maps findings to ISO 27001, SOC 1, SOC 2, and GDPR out of the box all four frameworks this team needs, plus 11 more (HIPAA, PCI DSS, NIST, FedRAMP, HITRUST, RBI, MAS, APRA, DPDPA, CIS, OWASP).
The compliance engine runs across both GCP and Azure findings, and across Kubernetes workloads within those clouds. This means:
- One compliance dashboard showing posture against all four frameworks simultaneously.
- Control-level evidence that maps specific GCP/Azure/GKE findings to specific ISO 27001 Annex A controls, SOC 2 Trust Service Criteria, and GDPR Articles.
- Continuous monitoring compliance posture updates as findings are remediated or new misconfigurations are introduced. The team sees their audit readiness in real time, not once a quarter.
- Audit-ready evidence export in Excel and PDF formats that auditors accept. No manual spreadsheet assembly. No weeks of preparation before an ISO 27001 surveillance audit or SOC 2 report period.
For a FinTech operating under four frameworks across two clouds, this eliminates the single largest time sink: manually correlating findings to controls and assembling evidence packages.
Code Security Integrated with Jenkins and GitHub
Cloudanix integrates with GitHub repositories and CI/CD pipelines to provide security scanning that connects to the cloud posture layer:
- SAST, SCA, and secrets scanning on every pull request in GitHub, with findings surfaced as PR comments so developers see security issues before code merges.
- 2,000+ secret patterns detected including GCP service account keys and Azure client secrets that would grant cloud access if leaked.
- CI quality gates via Jenkins integration, so builds that introduce critical vulnerabilities or expose secrets are flagged before deployment to GKE clusters.
- Code-to-cloud lineage: When a vulnerability is found in a running GKE workload, the platform traces it back to the specific commit, PR, and repository that introduced it. The team does not just know there is a CVE in production; they know exactly where it entered the codebase.
For a team running two enterprise OLTP products on GKE, deploying through Jenkins, with code on GitHub, this means security is part of the development workflow, not a separate console to check after the fact.
1,000+ Checks with GenAI Remediation Playbooks
Every finding across GCP, Azure, and GKE includes actionable remediation guidance. For critical and high-severity issues, GenAI-powered playbooks provide:
- Step-by-step fix instructions specific to the cloud provider and resource type.
- Copy-paste-ready
gcloudCLI commands for GCP,azCLI commands for Azure, andkubectlcommands for GKE. - Terraform and CloudFormation snippets where applicable.
- Blast-radius context: what other resources are affected if this misconfiguration is exploited.
For a lean team where the security function is not separate from operations, this is the difference between an alert that creates research work and an alert that creates immediate action.
The Platform Grows With the Team
This team came for CSPM. But they expressed interest in the entire platform. With Cloudanix, the expansion path is natural and does not require additional vendors:
- Today: CSPM + Compliance + Code Security across GCP and Azure.
- Next: CIEM (Cloud Infrastructure Entitlement Management) for the 10 to 15 console users, surfacing over-permissive roles, unused permissions, and identity risk.
- Then: Just-In-Time Access for GCP, Azure, GKE, and databases. Eliminate standing privilege entirely. Broker time-bound, scoped access via Slack or Teams with full audit trail.
- Eventually: Database Activity Monitoring for MySQL and MongoDB query-level monitoring, dynamic PII masking for GDPR-regulated data, destructive-query prevention, and keyless database access.
This is the structural advantage over Wiz and Orca for this team: they are not buying a CSPM today and then shopping for a JIT vendor, a DAM vendor, and a coding-agent-security vendor over the next two years. They are buying into a platform that covers all of those surfaces on a single asset graph, with a single rule engine.
Platform Impact
30 min Agentless onboarding for GCP + Azure | 2 clouds Unified in a single dashboard | 1,000+ checks Including GKE-specific rules | 4 frameworks ISO 27001, SOC 1, SOC 2, GDPR mapped continuously | 10–15 users Identity visibility without separate CIEM tool | 2 products Code-to-cloud lineage via GitHub + Jenkins
The Bigger Picture: Why FinTech Multi-Cloud Profiles Need CNAPP+
This company’s situation (GCP-primary with Azure secondary, GKE as the compute backbone, multiple compliance frameworks, a small security function, and enterprise products handling financial transactions) is increasingly common in FinTech SaaS.
The typical arc: The company builds on a single cloud (GCP, in this case), adds a secondary provider as enterprise customers demand specific cloud presence or as specific workloads benefit from Azure services, and suddenly the security tooling that worked for single-cloud no longer provides a unified picture. Native tools (GCP SCC, Defender for Cloud) are locked to their respective providers. Point-tool CNAPPs cover posture but not identity, access, or the data tier. And the team (small by design, stretched across both clouds and compliance obligations) cannot afford to manage three to five separate security tools.
The answer is not to buy the loudest CNAPP and bolt on point tools as gaps emerge over the next two years. The answer is to choose a platform that covers the surface today (CSPM, KSPM, compliance, code) and has a clear, shipping path to the surface you will need tomorrow (JIT, DAM, CIEM, AI-agent security).
That is what CNAPP+ means in practice. Not a marketing label, but a platform decision that saves a lean FinTech team from the tool sprawl that created the problem in the first place.
Key Outcomes
✅ 30-Minute Onboarding: Agentless connection to GCP projects and Azure subscriptions. ✅ Unified Multi-Cloud View: GCP and Azure in a single dashboard with normalised findings. ✅ GKE-First Kubernetes Security: KSPM with CIS Benchmark, GKE hardening, RBAC analysis, and workload-level visibility. ✅ Four-Framework Compliance: ISO 27001, SOC 1, SOC 2, and GDPR mapped continuously with audit-ready evidence export. ✅ Code Security Integration: GitHub + Jenkins with SAST, SCA, secrets scanning, and code-to-cloud lineage. ✅ GenAI Remediation: Copy-paste-ready gcloud, az, and kubectl commands for every finding. ✅ Single Platform Path: CSPM → CIEM → JIT → DAM without adding vendors. ✅ Wiz/Orca Gaps Covered: JIT access, Database Activity Monitoring, CloudPrem, and BYOR — surfaces neither competitor ships today.
Running GKE Workloads Across GCP and Azure?
If your infrastructure is GCP-heavy with Azure secondary, your compute runs primarily on GKE, and you need compliance evidence across ISO 27001, SOC 2, and GDPR without assembling spreadsheets; Cloudanix was built for this. One platform, one graph, agentless onboarding in 30 minutes, and a path from CSPM to full CNAPP+ without tool sprawl.
Book a Free Assessment to see your GCP and Azure environment through Cloudanix — unified findings, compliance mapping, and GKE security posture — in under 30 minutes.
Related Resources
- What is CSPM (Cloud Security Posture Management)?
- What is Google Kubernetes Engine (GKE)?
- What is Cloud Compliance?
- CNAPP vs CSPM: What’s the Difference and Which Do You Need?
- Importance of Kubernetes Security
- What is CNAPP (Cloud Native Application Protection Platform)?
- Securing Multi-Cloud Infrastructure
- Container Security and Real-Time Visibility for Modern Cloud
- From Tool Sprawl to a Single Dashboard: E-Commerce Cloud Security
- Implementing JIT Access in AWS, Azure & GCP
- Cloudanix vs Wiz
- Cloudanix vs Orca
