How to choose

Which cloud security setup? Five questions

1. How many clouds? If you're almost all on one cloud, its native tools may cover most of what you need, for roughly $100,000-165,000 a year at 2,000 workloads. With two or more clouds, independent platforms earn their price, because each native tool is strongest on its home cloud.
2. Who triages? Price the people alongside the licence. The cheapest licence can turn into the most expensive option once a team of four to six has to build the ranking and routing that a platform sells.
3. Agents or not? Start agentless to see everything within days, then add sensors where you need to catch or stop an attack in progress.
4. How will you pay? If you have a committed-spend contract with a cloud, check whether a vendor's marketplace listing counts toward it. Since May 1, 2025, AWS counts only software that runs on AWS.
5. Which rules apply? Card data (PCI DSS), US federal customers (FedRAMP), New York financial licences (NYDFS) and EU financial firms (DORA) each set fix windows and reporting clocks. Export the evidence your auditor wants before the tool deletes it.

My defaults: for a B2B software company on one cloud with a couple of thousand workloads, I'd turn on the cloud's own posture checks and threat detection, since they're cheap and count toward the commitment. I'd add a platform once there's a second cloud or once the team spends more time stitching findings together than getting them fixed, and buy it through the marketplace if it qualifies. I'd route every finding to the owning team's tracker with a named owner, require an expiry date on every exception, and measure the program on exposed, exploitable risks closed each month rather than on findings found.