Prisma Cloud by Palo Alto Networks Reviews

I work for a monetary provider and handle around five customers. We mostly use Prisma Cloud for CSPN, but we have a banking customer using CWPP. 

Apart from those two use cases, the other customers are not interested in Prisma Cloud's other functionalities because they're green and already have other solutions with partners that they say are more mature. We have not implemented them in the customers' production environment, but we have toyed around with proofs of concept.

My organization is not primarily a customer. We don't use it a lot because we're a security company that mainly provides customers with solutions using this. That said, visibility is the most significant benefit for our clients because some are so large that they're unaware of what they have. 

They don't have adequate governance over expenses, security, and the parts of the network that are communicating. Prisma Cloud gives them reports that will provide instant insight into what's there. A new feature creates a visual map of networks and communications in the discovery part. It's excellent because you can instantly visualize everything. That's one feature that all the customers appreciate.

It performs well in complicated cloud environments. You only need to add your cloud account credentials. Most of the time, Palo Alto recommends using a full admin account for a service account accessing the tool. The tool works just as well, regardless of the company size. That's one of Prisma's biggest strengths. No matter how big you are, the tool can see everything.

Prisma Cloud can scan any cloud provider. We currently use Prisma on GCP, Amazon, Azure, and Alibaba. We also have Oracle, but I haven't used it for Oracle yet. This is crucial because some customers aren't proficient in managing multiple cloud environments. They only need to go to Prisma Cloud and see what they have because the team managing security is not the same one developing the solutions. 

Prisma offers a single pane of glass that lets you do most of what you want in one place. It's not only configurations but also knowing what you have, and your assets are doing. That's the main selling point of Prisma Cloud. It provides you with visualized reports, whether it's in the cloud, live serverless, containers, etc. 

I haven't toyed with CAB personally, but I think you can do that because you can scan images and deployments. I wouldn't say it gives you a lot of value in that regard because most of the CI/CD issues are application-level problems that Prisma Cloud or any other tool wouldn't help you with. Regarding security, you can deploy agents during the integration deployment and gain complete visibility with total memorability that you might introduce in the pipeline. Still, I think it will be a tiny part of the pipeline.

You will not see the problem if you're running an OGs application. While the developers can pinpoint the issue with the information provided, it will never relate to a piece of code and solve it. No tool can tell you exactly which part of the application is the problem, but a tool can identify which process has a vulnerability. Apart from that, many developers have issues finding the root cause of the vulnerability. When it's a library-related vulnerability, the TVD tells you to use another library or play the library. When your own code has the vulnerability, it's hard to pinpoint that.

Prisma provides a lot of information. You can see real-time alerts and forward them to JIRA or whatever tool you use with API or TVD. It also offers anomaly detection. If an administrator is logging in at weird times and doing strange functions, this tool can notify you about them. The anomaly detection is a correlation engine. You seldom get false positives. When it is a false positive, it's something you would expect. The only times I got a false positive were when the administrator forgot the password and tried logging in 50 times. At that point, they just need to contact support and change the password. 

Prisma has massively reduced our alert investigation times. It's 50 times quicker. Without this tool, we must dig up AWS logs, and the format isn't too accessible. The difference between using this tool to investigate an issue compared to a cloud-native solution is two hours versus two minutes. Digging up two logs using Ctrl-left is not the best approach, and it's the only approach cloud providers give you. 

The solution saved us because it helps us turn off idle machines. Most are machines we have turned on, and we didn't know what they do, but we didn't want to turn them off. Prisma Cloud lets you see the communication flows and the asset's actions on the communication map. If you see a device not communicating, it's easier to investigate what it's doing. Sometimes, it's a device generating reports at a particular time. You can schedule it to turn off when it's not active to save money. You also save money by spending less time solving your issues.

Doing cloud compliance without this tool would be impossible because cloud solutions are huge and highly complex. SOS compliance requires that you provide reports in under 24 hours. That's not possible without an automated tool like Prisma Cloud and the CSPN module. You would need to purchase Prisma or a competitor. It helps a lot because some customers have weird compliance requirements, and you can do it all on Prisma Cloud.

You can create custom compliance configurations according to your customer's needs and set Prisma up to provide the reports every 24 hours. In fact, you can do reports in 10-minute intervals or in real time. The client can access the dashboard and see if they're compliant. C-level executives in any company love that. 

The most valuable features are the alerts and auto-remediation because it allows us a lot of flexibility to customize and do functions the Palo Alto team never intended. We faced some challenges with certificates because we also have next-gen firewalls. We would like to equip all the traffic because there have been many cases in which the developers have made mistakes. Deploying certificates on virtual machines can be complex in a development environment, but we managed to do that with Prisma Cloud.

Prisma performs well in a fully cloud-native stack if you run several layers and Kubernetes. It's not so smooth if you migrate VMs into the cloud. Some customers try to do that with Prisma Cloud, but it's not compatible with Windows Server. However, you can deploy serverless containers without issue. You must deploy personal cloud agents into the virtual machines. The agents are called defenders. That module is excellent because you can see communications and vulnerabilities across your environment. It can also scan for malware. It tries to do many tasks at once, say the value it provides is the ability to see communications between devices.

The agent can block the traffic trying to exploit the vulnerability, but it can't fix the problem. That's on the application level. Most of the time, you give the application development team the vulnerability report, and they fix the issue, but Prisma protects you in the meantime. You can sleep well knowing that the agent is blocking the malicious traffic.

They recently added a module called Code Security that enables you to scan repositories or infrastructure as code. You can see concept errors like CSPN problems before the deployment. In tab use cases, it's excellent because you can see if there are misconfigurations in Terraform without having to deploy the instance or whatever you are deploying. That can save you money because sometimes people are deploying machines with problems that are easily fixable. It also improves security because you can fix a vulnerability before you have it with Cloud Security, but that's a rather new solution.

The IMD feature could be improved, but Palo Alto is working on that. It's a relatively new module that attempts to identify unnecessary permissions. Prisma Cloud is a platform that adds new modules whenever Palo Alto acquires a company or develops a new solution. The development team is trying to add new features. It also has Click Code Security for infrastructure security, but it doesn't add much value unless your DevOps team is really junior.

While Prisma provides a lot of visibility, it also creates a ton of work. Most customers that implement Prisma Cloud have thousands of alerts that are urgent. It creates a high workload initially. Apart from that, it solves the problems you have. Palo Alto says that 99 percent of breaches come from misconfiguration. I have seen that first hand. I think the fewest alerts a customer had was around 100 still, but they used another tool for that, so that saves a lot.

I have been working with Prisma Cloud for about 15 months.

Prisma's stability is close to 100 percent because it's just a dashboard that connects to your public cloud. It's essentially a website that never goes down, and you could also host it locally if your security requires it. Most of the customers use the Prisma Cloud platform. If it goes down for any reason, the security agents work independently of Prisma Cloud. You send logs to Prisma Cloud and update the configurations via the cloud. However, if the platform goes offline, you still have top-notch security.

As long as you purchase credits, Prisma Cloud is easy to scale.

I have never contacted Palo Alto support because our team is highly proficient in the solution and the platform is easy to use. You deploy the agents, and it just works. 

It's straightforward to deploy the solution because it's cloud-based, so you just set up an account, username, and password. If you think about it, the Prisma Cloud tool does not do much, but what it does is valuable. It does something simple on a scale that human beings could not do. 

Based on my own experience, I would I rate Prisma Cloud a ten out of ten. However, I haven't compared it with other solutions, so maybe other solutions have more features that Prisma is lacking. My advice is to implement Prisma if it has the features you want but also shop around because I'm sure other solutions are just as good as this one.

We were using it for remediation. I was working on a client's project on behalf of our company, and they had multiple subscriptions. They were using not only Azure but also AWS. Rather than managing remediation and governance separately through different clouds, it was proposed to use Prisma Cloud as a single place for remediation of everything.

Prisma Cloud provided a single window for all security issues, irrespective of the subscription, account, or service provider I was trying to see. The information was totally transparent with Prisma Cloud. Otherwise, it was a daunting task for us to manage everything within AWS itself because each region's or subaccount's data needed to be moved over to another account to see a full picture, and a similar approach was required in Azure as well. The data from a different subscription needed to be copied, which required a batch process to do this job on a daily basis. By integrating AWS and Azure subscriptions with Prisma Cloud, the same task became easier. It was as simple as adding a new account and a credential. That was it. Prisma Cloud took care of the rest of the functions

Prisma Cloud provided security spanning multi-cloud and hybrid-cloud environments. We integrated it with AWS and Azure with multiple subscriptions for each.

With both AWS and Azure, the presentation of the native cloud data was not good. We were more comfortable looking at the same data in Prisma Cloud.

Automation is possible with Prisma Cloud, and that is why we liked it. Automation is still not that good in the native clouds, and Prisma Cloud definitely has an edge compared to the facility that AWS or Azure provides. Although it is an additional cost for IT, overall, there are cost savings. I am not aware of the features provided by GCP. I did not integrate it with Prisma Cloud, but at least with AWS and Azure, Prisma Cloud works much better.

Prisma Cloud provides an agent that can scan container images or Docker images. Otherwise, for Docker images and accounts, AWS provides its own tool and its own format for the report. Similarly, Azure provides its own format to scan those images. We used the agent provided by Prisma Cloud. It unified the approach. Irrespective of the provider, the format of the output and reports was similar. It was easy to compare apples to apples rather than comparing apples to oranges, which definitely is a challenge when we use different cloud providers. Prisma Cloud solved that problem for us.

The level of abstraction is sufficient enough. The complexity is hidden. Only the information that is relevant is displayed, which is better from a developer's perspective because developers do not need to handle that complexity. If architects, like me, need to understand those complexities, they can go into a respective subscription and get the details. The level of abstraction was good enough with Prisma Cloud.

Prisma Cloud provides a single tool to protect all of our cloud resources and applications, without having to manage and reconcile disparate security and compliance reports.

Prisma Cloud reduced the alert investigation time because now, we have a single window. It is quite easy for anyone. A single resource can work on the alerts and memorize similar issues in the past and work on the current issues faster. It has improved productivity.

Prisma Cloud reduced costs. With the different service providers and different subscription models that we had previously, we divided the subscriptions between the analysts. They were responsible for the issues related to the subscription. We had a team of six people previously. After the implementation of Prisma Cloud, all the issues got consolidated, and our team size got reduced to two. The productivity increased because the same analyst could see past issues, revisit those issues, learn quickly, and fix similar issues. They got an idea of how to fix a similar issue, so the overall productivity increased, which reduced the cost.

When we work on, for example, AWS, we need to consolidate the data from different regions, which is an exercise in itself. The same exercise or similar exercise can easily be done in Prisma Cloud. It is as easy as registering a new subscription to AWS, and you start seeing all that data. For example, it is very easy to do analysis of the Defender data, which can include warnings, errors, etc. Although it is natively AWS data, the presentation is not easy for a developer. Prisma Cloud makes it a bit easier. 

The first time I looked at Prisma Cloud, it took me a while to understand how to implement the integration and how to enable features by using the interface for integration. That portion can probably be improved. I have not looked at the latest version. I used the version that was available three months back. It is portal-based, and they might have changed it in the last three months, but at that time, integration was a bit tricky. Even though documentation was available, it took a while for a new person to understand what integration meant, what will be achieved after the integration, or how the integration needed to be done on the Azure or AWS side. That was a bit challenging initially.

I used it for eight or nine months. I last used it about three months ago.

It is stable.

The client's team interacted with the customer support team. We used to highlight the issue to them, and they used to contact Palo Alto's support. We required their support two or three times, but I or my team was not directly involved with their customer support for help.

Positive

I have not used a similar solution before.

I was involved in the implementation. It was all cloud-based. There is a bit of a learning curve when trying to understand how to integrate it. Although some good documentation is available for Prisma Cloud, it was still a bit difficult to understand the product initially. However, the UI that analysts use to work on issues and remediation is quite good. It is not complex. After you have done one or two integrations with your AWS or Azure account or subscription, it becomes a routine activity. It is easy to integrate more subscriptions, but the initial one or two subscriptions of the AWS or Azure account will take some time because some features need to be enabled on the respective cloud as well. It is not only the configuration on the Prisma Cloud side. Some configuration is required on the AWS or Azure side as well.

It is a website, so deployment is not a challenge. It is as simple as registering an account and making the payment, which the IT team already did before they created an account for us, so, as such, there is no deployment. If we want to use an agent, then certainly some deployments are required on the machines, but that is the agent deployment. The product itself does not require any deployment.

From a maintenance perspective, not much maintenance is required. It is a one-time integration. It will then be set for a few years unless you want to remove some of the subscriptions or something changes in Azure or AWS. There is a limitation on the Azure or AWS side but not on the Prisma side, so maintenance is there, but it is low.

There was a cost reduction. That was the benefit that we had visualized while evaluating Prisma Cloud as one of the possible solutions. The complexity of IT operations had also reduced, and the team size had also reduced after implementing Prisma Cloud.

We used the enterprise edition. A standard edition is also there. I am aware of these two editions. I know that there is some cost, but I do not have the exact figures with me. The cost was not on the higher side. Overall, the cost gets recovered with its implementation.

I have not compared it with other tools, but overall, I found it to be pretty good when resolving the challenges that we were facing early on. I did not get a chance to look at the Gartner report in terms of where it stands, but based on my experience with this solution, I was quite satisfied.

It is a good solution. Each team should utilize it. Every good organization is now moving towards or trying to be provider agnostic, so if you are using multiple providers, you should at least give Prisma Cloud a try.

Prisma Cloud enables you to integrate security into your CI/CD pipeline and add touchpoints into existing DevOps processes. I know it is possible, but we were already using some other tools, so we did not try this feature. We already had a good process utilizing other scanning tools, so we did not try that feature, but I know that they have this feature.

Prisma Cloud provides risk clarity at runtime and across the entire pipeline, showing issues as they are discovered during the build phases, but this is linked to the CI/CD pipeline, which we did not implement. We looked at the risk level of the infrastructure deployed. We also looked at which cloud platform is having issues. The risk-level clarity was certainly there. It was possible to see the risk level and prioritize the activities or other items with a higher risk, but we never tried CI/CD pipelines.

Overall, I would rate Prisma Cloud a nine out of ten.

We use Palo Alto to secure our network.  We are using the PA-820 firewall and all of the Prisma Cloud modules. It helps reduce our vulnerability to hacking and any malicious attacks on the network. With that appliance, we can minimize those things and control what goes in and out 

We have reduced network calls by 80 percent. The benefit of Palo Alto is the ability to create security across multiple levels and protect against hacks and vulnerabilities. You start to see these benefits within one or two days after implementing these devices. 

We are also using a honeypot to detect a target on our site. Once we have the target, we are blacklisting those using the firewall. The solution has reduced our investigation times by about 50 to 75 percent. It minimizes the alerts, so we're seeing fewer.

I like Palo Alto's threat protection and Wi-Fi coverage. It has advanced features like DNS security and sandboxing. The automation capabilities are excellent.

The UI could be improved.

I have been using Palo Alto for almost eight months.

Palo Alto provides good support and doesn't take long to resolve an issue. 

We previously used Cisco ASA. We decided to switch because we wanted to adopt a UTM approach in which all the logs and reports go to a single dashboard. Everything is visible in Panorama, which comes with the Palo Alto appliances. We need to purchase a separate license for Panorama, but it's there. 

There are many competitors, such as FortGate, but Palo Alto is better. FortiGate has some advantages in terms of throughput. You can get better throughput if you enable all the engines in parallel. However, I've heard about Fortinet devices being compromised, but I've never heard of that happening with Palo Alto. 

I rate Palo Alto Prisma Cloud nine out of 10. Everything is neat, clean, and easy to use. However, when you commit changes through the UI, it takes some time to load on every system. 

We use Prisma Cloud by Palo Alto Networks to scan the Kubernetes cluster.

We use Prisma Cloud's threat detection module.

We implemented Prisma Cloud by Palo Alto Networks to help us address vulnerabilities within our Kubernetes cluster.

Prisma Cloud provides security in multi- and hybrid-cloud environments. It is a security console that is essential to our organization. We have implemented Prisma Cloud on the Kubernetes cluster for threat detection and vulnerability monitoring.

Prisma Cloud's security automation capabilities are good. Once integrated with our Kubernetes cluster, it automatically detects vulnerabilities and provides reports in the dashboard, which we can use to generate CSV formats to help our development team detect vulnerabilities.

Before implementing Prisma Cloud, we had difficulty preventing threats. After implementation, the vulnerabilities were resolved, and we now receive immediate notifications to help us prevent threats.

Prisma Cloud protects both our Azure and AWS cloud environments.

The most valuable features are vulnerability monitoring, serverless access, container runtime features, and Defender.

Prisma Cloud supports generating CSV files, but I would also like it to generate PDF files for reporting. 

I have been using Prisma Cloud by Palo Alto Networks for two years.

Prisma Cloud has a stability rating of 99.99 percent.

The solution has very good performance 

The technical support is dedicated and they respond quickly.

Positive

We previously used Lacework, but we faced some licensing issues in our parent company, so we switched to Prisma Cloud.

The initial setup is straightforward and was completed by my manager and me.

Initially, we implemented it along with the vendor team, they guided us excellently.

Prisma Cloud's pricing is good.

We evaluated other solutions' costs and features.

I would rate Prisma Cloud a ten out of ten.

Twenty-four people monitor Prisma Cloud alerts each day in our organization, and any issues are sent to developers to be addressed.

Maintenance is required to upgrade the dashboard.

It's a service that we have acquired for our cybersecurity department. We deployed Prisma Cloud by Palo Alto in all our clouds, which are Amazon, Azure, and Alibaba.

We are doing cloud security compliance as a security posture, and we are also doing workflow protection.

The solution gives us a lot of visibility across all of our cloud solutions. It helps with the security posture across all of our clouds. 

The security posture and workflow protection are excellent.

From the initial POC, compared to what we had witnessed with Check Point, it's easier to use.

Prisma Cloud is quite a good solution. However, the price is not good. 

We'd like to have more native integration with clouds and additional security checks in the future. It will be nice to see a general evolution of the solution. 

I've been using the solution for about one year.

The stability has been good so far after less than a year of use.

We are early in the process in terms of using the solution. We're not expecting to scale in the next few years. The problem there will be the licensing costs.

Right now, the environment we use is quite big already. We have several clouds already and need the visibility the solution provides. 

Our consultants deal with technical support. I do not deal with support directly. 

We did not previously use a different solution. We wanted our partner to validate our security with a tool from time to time. However, it was a service they were providing to us.

My team was involved in the deployment. I was not directly involved. It was straightforward with the help of our consultants.

Our consulting partner helped us with the initial deployment. 

We witnessed an ROI. It helped reduce risks and sped up threat detection. We avoided human mistakes as well while using this solution. 

We noted the value almost immediately once it was deployed. 

The price is high. In the future, when there are more competitors at the same level with different clouds, maybe the position will be different. 

We evaluated Check Point due to the relationship we have with them. Yet, they did not completely support Alibaba. Alibaba was only compatible with Check Point and Prisma. However, Check Point was at a very early stage and not quite as developed. 

I'd rate the solution an eight out of ten. 

I generally use Prisma Cloud to dive deeper into any security findings generated by Prisma. It's also a good way to get a complete inventory of all our cloud assets spread across different cloud platforms.

The customers that we work with have really benefited from Prisma Cloud by including it in their workflows and security audits. Prisma Cloud has really helped them improve their security posture.

Prisma Cloud's inventory reporting is pretty good. If you have multiple clouds or platforms, you can have a list of all your cloud resources within Prisma. The security posture management is also great.

We continuously work with our security teams to find any issues with their infrastructure. Prisma continuously monitors the infrastructure, which helps us locate those resources and patch those findings.

The information presented in the UI sometimes doesn't look intuitive enough. For instance, if I want to look at all the resources that are affected by a certain finding, sometimes it's not easy to locate how to look at all those resources in one place. But that's just a UI quirk. However, API-wise, Prisma Cloud is pretty good for locating what you're looking to find.

I have been using Prisma Cloud by Palo Alto Networks for the past six months.

It is a stable product. I haven't seen any outages with Prisma Cloud.

It is a scalable product.

Prisma Cloud's customer service is pretty great.

Positive

We used a different solution before switching to Prisma Cloud. The decision to switch to Prisma Cloud was a strategic decision made by the enterprise.

The initial deployment was pretty straightforward. We primarily use it with our AWS cloud, and it's pretty easy to set up cross-account roles to get access to Prisma. Prisma Cloud uses cross-account IAM roles in AWS. You just set those roles up using a stack SAT across your entire set of AWS accounts, and Prisma can access all those accounts immediately.

We implemented in-house.

Prisma Cloud has really improved our productivity and freed up resource time from manually hunting for findings to automating it.

Before choosing Prisma Cloud, we did a few POCs for products like DivvyCloud, Dome9, and Cisive. All these products pretty much do the same thing with a few differentiating factors, but not enough to really stand out.

I rate Prisma Cloud an eight on a scale of one to ten for ease of use. It is pretty intuitive, except for not being able to locate resources affected by a certain finding individually.

Prisma Cloud has helped free up staff to work on other projects. Previously, we used to do ad hoc scripting to find different resources affected by a certain finding. However, we no longer have to do that because everything is automated.

At least ten hours each week were freed up because of the Prisma Cloud.

Meeting with all the industry professionals at the RSA conference is a great feeling. We get to learn about the latest trends in cybersecurity, all the new products that are coming up to tackle all the challenges, and especially the role of AI and machine learning in cybersecurity.

We've been looking at improving our hybrid connectivity solutions and making them more secure. We explored a few solutions at the RSA conference, which will come into play when we decide.

Overall, I rate Prisma Cloud an eight out of ten.

We were implementing and expanding a system that we had internally. We were creating a system called Midas, which was about keeping data safe. It was cloud-based. We wanted to keep data safe and provide an analytics environment on the cloud.

We now have a service offering that secures data and allows large volumes of data to be secured and exposed within a tight and well-founded community.

It helped to reduce downtime in our organization.

Its ease of integration is valuable because we need to get the solution out of the door quickly, so speed and ease matter.

The area for improvement is less about the product and more about the upsell. If we've already agreed that we'd like your product x, y, or z, don't try to add fries to my burger. I don't need it.

The firm has been using it for about two years. My direct interaction with it was about a year ago.

I didn't notice any kind of instability, but there are foibles and little nuances.

We are happy with it overall. I'd rate them an eight out of ten.

Positive

We had a number of different solutions and still do.

It was in-between in terms of complexity. We leveraged our Palo Alto friends to help us get over the humps, and they did a great job.

We didn't take help from any third party. Palo Alto implemented it.

We have not seen an ROI in this case, but we didn't buy it for a return on investment.

We evaluated multiple solutions. They have a well-known product line in the industry, and we stopped and talked with them and picked them because of their capabilities and competencies.

In terms of providing a unified platform that natively integrates all security capabilities, I'm not expert enough to say that it supplies everything, but it's well-known. There are a number of different features and capabilities in their suite.

To a colleague at another company who says, “We are just looking for the cheapest and fastest firewall," I would say that it's never the cheapest and the fastest. You always need to lay down what your needs are and then go after who has the right level of capabilities, competencies, and price point.

Palo Alto embeds machine learning in the core of the firewall to provide inline, real-time attack prevention. Every vendor needs to be considering how they're going to appropriately integrate both generative AI and machine learning. As we move forward, it's going to be table stakes.

In terms of the value I receive from attending an RSA Conference, I have two hats. I'm working for an organization. It's federally funded research and development. Attending an RSA Conference helps me keep a finger on the pulse of that, but I also am a security blogger, so I make sure that I'm keeping up to date. Talking to people is another important part of this conference. The one thing that's missing from the conference is that there's so much focus on reaction instead of protection up front and thinking about things up front, but it's a very valuable conference overall. 

Overall, I'd rate them an eight out of ten. They are well known in this field, and they do have good products that are niche to what they're doing.

We use it for visibility, compliance, and governance. It is the official CSPM solution for our bank.

The only module we are using is the compliance module.

In Prisma Cloud, we were able to create frameworks using the RQL language, frameworks that are modeled after our Archer security baselines. Archer is the tool that we used to track all exceptions and security baselines. With Prisma Cloud we have been able to create custom baselines, based on the Archer framework that we have, and not just go off of CIS or NIST frameworks. 

We have also been able to generate reports for teams using the automated scripting tools that Prisma Cloud provides. On a weekly basis, we share those reports with the teams that are impacted. They go back and remediate their findings as needed, or we fine-tune the Prisma Cloud compliance language as needed if there is any ambiguity in there. 

Over the course of a few weeks, the teams remediate these issues and our compliance percentage goes up. Our compliance percentage for production environments was 95 percent. We then made some new acquisitions and they were at 40 or 50 percent, which was very bad. When we brought them under our company's umbrella, we gave them these reports, and they improved their compliance percentage. That has been helping us hugely.

Also, it does a good job of providing a view of our overall posture. Our confidence in our security and compliance posture was what I would describe as a "head in the sand" type of situation before. People would say, "Ah, we should be okay." But once we started digging into stuff and started putting our Archer baselines into the Prisma Cloud queries, that's when we realized that things looked poorer than we had imagined or assumed. This has been a wake-up call for our organization, and everybody has taken notice that we really have a hard job ahead of us.

In addition, with this solution we are seeing a single pane of glass to protect all of our cloud resources and appliances. We are seeing multiple occurrences with multiple platforms under one roof. That has really helped to simplify things.

Prisma Cloud does have some good investigation built into it. When an alert is generated, it does a good job at correlation, not the greatest in the world, but it gives you a good starting point. So it has helped us work on those alerts or investigate them more easily. It reduces our investigation time by 40 to 50 percent because it does all the initial investigation and puts all the findings together. You don't have to manually log into a lot of different accounts or tools to find out that information.

Financially, the only way I can think of that the solution has improved things is in our compliance structure. We spend less time after audits by putting in the effort beforehand. Recently, we have had a lot of good wins where audits have not been able to find a lot of issues. In the past, they used to find 15 or 16 findings, and now, they're able to find only one or two. When you have fewer audit findings, you have fewer man-hours dedicated to dealing with them. We are able to move those man-hours into our actual work rather than just audit work. We have been able to achieve some productivity there. I would estimate it has saved us 5 to 10 percent, in terms of money.

The most valuable feature is the option to add custom queries using the RQL language that they supply so that we can customize the compliance frameworks to what we need to look for.

The comprehensive view that it offers, the compliance percentage based on a framework for a particular account or a particular environment, is extremely useful. We can give those reports to the individual application teams so that they can remediate the findings. It also helps that we can give them read-only access, so we don't even get involved. They log in on their own and can pull a report, based on our instructions, and then do the remediation themselves. It helps us not be the middleman and not waste our time just generating reports for the application teams.

Also, Prisma Cloud provides security for multi and hybrid-cloud environments. We started off using it for our AWS environments, but now Azure and GCP are starting to come into play. We haven't started using those yet, we have just started initial discussions with them, but it has already been decided that Prisma Cloud would be the CSPM even for our Azure and GCP environments.

One definite area for improvement is the auto-remediation or the CWP area. 

The second one is the RQL language. It is still not very flexible and does not cover a lot of use cases. The RQL language could be dramatically improved to add more options. The cloud is adding more and more complexity in terms of number of services or the number of options for each service, especially when it comes to security options like encryption at rest and encryption in transit. And there is the issue of the interlinking of these services. One cloud service uses another cloud service, like CloudFront in front of a load balancer. These interactions are creating numerous new combinations and the RQL language really needs enhancement to handle those queries. 

We ourselves have put in a lot of enhancement requests to Palo Alto, looking at these corner cases, so they can look into those and improve them.

I have been using Prisma Cloud by Palo Alto Networks for about two years.

Prisma Cloud is a little slow, but it is fairly stable.

It is a scalable solution. No matter how many accounts you add, it still can scale. Even the reports that we set up run pretty quickly. They have done a good job of making their platform scalable.

We have been acquiring companies quite a bit recently so we will be using Prisma Cloud heavily. This is our only company-approved CSPM tool. Even though we have some of the native tools in use, like Security Hub from AWS, or Azure Security Center, now called Defender for Cloud in Azure, the official CSPM is Prisma Cloud. It is the center of attraction for us so it is being used by everybody. In the future, we will be adding more accounts as needed until a decision is made on Wiz. We still have a good amount of time left in our Prisma Cloud contract, so we are not looking to switch to Wiz anytime soon.

Technical support is excellent. We have a dedicated account manager from Prisma Cloud who has an office hours session every Monday, and he also attends our standup calls. If Prisma Cloud has any new improvements or any updates that we might be interested in, he brings them up on those calls. We also have a weekly knowledge-sharing session where Prisma Cloud's personnel come in and make a 30-minute presentation and address the enhancement requests that we put in. They'll tell us what updates have happened, what improvements have happened, et cetera.

Positive

The initial setup was straightforward. It was done by one of our team leads, who is a cloud security fellow. He used to be a senior cyber security engineer. It took him three months of full-time work to set up those compliance frameworks, the custom RQL queries based on our Archer baseline, and then, import all the accounts. The importing of the accounts is pretty straightforward. They provide an API or you can even import manually. That's not at all a problem.

We have 10 to 15 users in the solution. Four or five of us are from cloud security proper, and we have administrative rights. Our cloud operations team, seven or eight people, looks at the alerts and investigates and resolves them. They engage us if they need any assistance because they're not very cloud aware yet. And we have a few pilot users who are from the application teams, and they have a read-only role. They generate a report for themselves. Many people still want spoon-feeding and say, "Can you generate a report for us or give us a screenshot of this and that?" We do that occasionally, but we are trying to move away from that process.

For maintenance, there are only two of us, and one of us is doing it full-time, more or less. The other one is more of a standby. We are documenting the procedures. We do weekly maintenance in Prisma Cloud, where we make sure the users are onboarded, there are no stale users, and take care of the general upkeep of the tool. The idea is that, in the future, we'll probably get a junior engineer for that role, while the senior engineer can perform enhancements or more advanced configurations.

When it comes to protecting the full cloud-native stack, Prisma Cloud is fairly okay. Compared to other tools out there, I don't think it is an extremely good product, but it's a reasonably okay product to work with. I've used Wiz in the past, and Wiz does a better job on full native-cloud security.

For example, there is the auto-remediation feature in Wiz, which Prisma Cloud eventually caught up to. Wiz also has agentless scanning that Prisma Cloud is, again, catching up to. There is also Terraform code scanning for CI/CD pipelines that Wiz came up with, ISC code scanning, et cetera. Those are some of the excellent features of Wiz.

Wiz also offers granular compliance frameworks in the sense that you could write your own compliance queries and make them part of a framework. Prisma Cloud's RQL is not that flexible. We are still running into some issues in some corner cases where there are no RQL queries available.

Prisma Cloud's security automation capabilities are very basic. Prisma Cloud is primarily a CSPM, not a CWPP. Even Wiz does not offer that many automation capabilities; they were coming out just at the end of the last year. But compared to other products that I have worked with, which are purely CWPP, Prisma Cloud would not even come close.

I would rate Prisma Cloud at about six out of 10 for helping to take a preventative approach to cloud security. It gets the job done. Our company has invested money in it, so we can't move away from it for another two or three years. But we are already piloting Wiz to see if we like it. Once the contract with Prisma Cloud is up, we will probably jump to Wiz. That's the idea within the company.

If I were to rate Prisma Cloud from one to 10, I would maybe rate it at six, while Wiz would be a nine.

We have started using some of the modules for securing the entire cloud-native development cycle across build, deploy, and run, but we have not really operationalized them. They're in the initial phases. It's not the maturity of Prisma Cloud that's in question, it's about the maturity of our company as a whole. Our company was not really tuned to CI/CD, secure DevOps, and the like, so we are slowly starting to integrate that. We haven't seen the results yet, but I would say it's very promising on that front at this time.

My advice would be to compare other products and understand what you want to do before you purchase or implement it.