Prisma Cloud by Palo Alto Networks Reviews

We use Prisma Cloud by Palo Alto Networks for our cloud security posture management.

Prisma Cloud by Palo Alto Networks has multiple aspects that help protect the full cloud-native stack. We are not concerned with just one cloud at the enterprise level; we are focused on the multiple cloud environments we have. The solution provides us with a comprehensive dashboard and a comprehensive view of our cloud security posture. Furthermore, the solution not only covers the security posture but also informs us of our compliance with leading industry standards.

The solution does have security automation capabilities, but we do not use much of it in this case. We use automation for the alerts; if there are any misconfigurations, the alerts are automated. However, we do not mitigate any specific items using automation, as that is something we have not configured. We prefer to first look at the problem manually, and then take action against it.

There is no single comprehensive cloud security solution. We will need to use multiple tools, such as those offered by Palo Alto Networks and Check Point. Every security firm has a range of products, so if we consider all of them, we can have anti-virus, anti-malware, vulnerability assessment solutions, EDP software, and cloud security posture management. We need to evaluate each tool, and Prisma and Check Point both offer good solutions, including next-generation firewalls.

The solution provides the visibility and control we need, regardless of how complex or distributed our cloud environment becomes.

The solution can enable us to incorporate security into our CI/CD pipeline and add checkpoints to existing DevOps processes. From an automation standpoint, we enabled certain monitoring features. However, the remediation steps are still manual. This can be integrated into our DevOps pipeline, though some of the features are not being used as we prefer to keep it manual.

The solution provides us with a single tool to protect all of our cloud resources and applications, without having to manage and reconcile disparate security and compliance reports.

The solution reduced runtime alerts. We don't need to receive all the runtime alerts every time, as they will overwhelm us with messages. People often neglect this. Depending on the situation, generally, only very important alerts should be sent. I prefer that the solution be configured for when there is a major business impact. For minor alerts and notifications, we can still check the dashboard. Generally, we monitor the dashboards at certain times. We don't need to be alerted for everything, as this will defeat the purpose of this mechanism.

The solution significantly improved the time taken to investigate alerts by 40 percent with the alert monitoring and all its mechanisms, we receive our critical alerts quickly via email. We can even configure the remediation, although we have not done so yet. 

I appreciate the multi-cloud support that this solution provides; I can use it with AWS, Microsoft Azure, and Google Cloud. I find the ability to configure alerts and monitor misconfigurations in the cloud to be particularly useful, and we take advantage of this feature as well.

Prisma Cloud by Palo Alto Networks is an impressive solution. The solution continuously assesses our security posture, making it the ideal preventive measure. If any misconfigurations occur, I am immediately notified of any unnecessary ports that are open in my cloud. This alerting system allows me to take the necessary steps to secure it before any attack can occur, making it the best preventive measure for our cloud.

I now extensively use cloud security posture management. There needs to be a mechanism that allows me to manually configure compliance more easily. Currently, it requires programming knowledge, so if someone without hardware programming knowledge could customize certain features to their requirements, it would be very helpful.

I have been using the solution for five months.

The solution is stable because it is a SaaS offering.

Nowadays, all cloud solutions are scalable; scalability should be a given feature and does not need to be asked for.

A maximum of ten people have administrative-level access, which will be used by 50 to 60 Security Operations Center personnel. This personnel must log in with various role-based access rights. In total, we have around 70 people using the solution.

In my previous project, we had a dedicated team associated with the account, so we did not have to pay for support. This was beneficial because, most of the time, we would go to our account team instead of the technical support, and our issues would be resolved quickly.

The initial setup is seamless. We only need to integrate our API key and connect it.

The deployment took one hour.

I can see one return on investment due to continuous monitoring. Before, we had a few staff members who monitored our environment, but now the alerting and other processes happen automatically, so there is a good ROI in terms of resources. Additionally, the security posture of the environment is increased and fewer incidents occur, which improves our response time and resource efficiency. There are also indirect ROIs.

The pricing is competitive; for the most part, the security firms have similar prices. Therefore, I believe it is competitive and a good investment. The solution is good quality, so I would not hesitate to invest in Prisma Cloud by Palo Alto Networks.

I give the solution a nine out of ten.

I absolutely recommend Prisma Cloud by Palo Alto Networks at an enterprise level because the solution is an enterprise-grade product.

It is pretty easy to onboard accounts with Prisma Cloud. We use Prisma Cloud Compute and Prisma Cloud policy management. The latter is our primary solution and we use Compute to manage our container security, including threats and vulnerabilities. But we primarily focus on managing the policies for our entire cloud configs, internal threats, and network patterns.

For our market requirements, we do need several other services to be maintained for the perfect security posture. For example, one of the primary resources that we are using in our cloud is EC2 instances. That does need some primary security features, like security groups with proper closures, and proper networking with our firewalls. To make sure all of these premade configs are working, Prisma Cloud helps us to identify whenever any deployments meet up with our cloud. It is helpful with our singular architecture.

Prisma Cloud is very helpful with a full native stack. We don't want to leverage any of the resources directly. Instead, Prisma provides us with the services to automate and increase security posture without any internal agents to run it. Other products have internal agents to run with our cloud to help with the security posture of that cloud, but Prisma does not do that. It has a very simple mechanism to onboard the accounts with their console, where we can use the IAM to scan all of the accounts and identify threats and config mismatches.

The solution has also been helpful when it comes to our investigation times because we have fully automated it with our ticketing system. We use ServiceNow and whenever there are any alerts from Prisma Cloud, we have it configured so that they go directly to ServiceNow. That means the user can identify their incident and can resolve it based on the priority of service level agreements. When they do remediate an issue, Prisma Cloud will resolve the alert within Prisma Cloud and ServiceNow will close it on behalf of the user.

Prisma Cloud saves a lot of manual effort that we had to do within our cloud organization.

Prisma Cloud policy management is more valuable than Prisma Cloud Compute. While we use Compute often, we are not leveraging container security as much. We have limited resources for the containers in our cloud environment. Sooner or later, we will launch multiple container features in our cloud, but right now, we don't have much scope so we haven't had a chance to explore the Compute side much.

The solution supports multi- and hybrid-cloud environments. It has multiple cloud strategies like GCP and Azure. It has policy fixes for those cloud environments. We leverage it for AWS and it's important that we can use it for that singular platform.

Prisma Cloud also has log retention periods for the alerts and policies that are triggered, for each account. For example, my account has a specific policy that is high severity. If I need to further investigate, I can do that investigation in the upcoming 30 days. After 30 days, the logs of the triggered alert are not retained by Prisma Cloud on the Palo Alto network.

It also provides us with a single tool to manage our entire cloud architecture. In fact, we are using a multi-account strategy with our AWS organization. We use Prisma as a single source of truth to identify high- or medium-severity threats inside our organization.

Another feature is the automation. It has certain types of policies that can identify network-based threats, such as unusual port or protocol activities. It has tremendous machine-learning capabilities to identify patterns.

When it comes to automation and machine learning, it still needs some more work because sometimes they can give false positives.

In addition, since cloud services are coming up with new features and solutions, Prisma should also keep up with the same level of security. For example, at the previous AWS Summit, numerous services were introduced. Our businesses wanted to develop some of the services with the features in our cloud, but Prisma hasn't come up with any new APIs. Prisma needs to keep up with quick changes as soon as any cloud platform comes up with a new invention.

And one of the main backlogs in their development is in the area of integration. For example, we have ServiceNow in place for ticket management, and Prisma Cloud is supposed to send closure emails for incidents. But from time to time, it fails to do so. We have several other mismatches between Prisma Cloud and ServiceNow. So we have had to focus on incident management.

Integrations with third-party vendors, such as ServiceNow, Slack, and other ticketing tools that Prisma supports have full automation, but there are still some bugs to fix. We see failures from time to time. When our team fixes vulnerabilities or threats, they still see the incidents in place, which makes them liable to pay for SLA failures. Those kinds of things can be avoided if we have fully fledged event management integration with those tools.

They also need to increase their log retention periods to allow further investigation. Sometimes it takes time to check with asset owners and do deep investigations. Because we have numerous accounts, it can take time for asset owners to investigate each and every alert. The log retention period is one of the cons. 

I have been using Prisma Cloud by Palo Alto Networks for more than a year. I started in my role as a cloud security engineer about two and a half years ago, and Prisma Cloud is one of the CSPM solutions that we use.

I use Prisma Cloud every day. It is one of the primary tools I need to monitor and manage the security of our cloud environment. I use it very extensively and my team members use it for identifying threats and managing them with the asset owners.

In terms of performance, they have cloud releases of security features during the first week of every month. Whenever they release new policies, all of a sudden it starts to throw multiple alerts within our console. It is a bit annoying for the DevOps team, but from a security perspective, it is a useful process. But a pre-announcement or pre-testing of the alerts would be a better way for them to do this, instead of creating 50 or 100-plus alerts for our DevOps. We are suggesting better pre-testing of new policies.

It is pretty scalable. When we deploy new AWS accounts within our organization, it applies the same security posture policies to those accounts as well. We can see the security postures it recommends whenever we onboard any new accounts with our organization. The scalability is very good with the management it provides for any accounts we onboard.

Palo Alto Networks is one of the fastest-growing security products in our organization.

From time to time we experience delays in support for critical scenarios. They do have engineering teams at the backend that work with the policies. I understand that. But I'm expecting a more responsive service on their side because sometimes it can even take a week to get a response back from the engineering team.

When we go through the toll-free number to submit a case, they suggest that they are working on it, but sometimes they don't give solutions for such cases for some time.

Positive

We used AWS native security, which is Security Hub. They have their own benchmarks which we leveraged. But we wanted to see more variables with the policies to have a stricter and more secure cloud environment so we moved to Prisma Cloud.

We have been customers of Palo Alto Networks for a very long time because they have several security products, including firewalls that we use in our organization.

The deployment was very straightforward. We were able to onboard IAM policies from our AWS master account to our console with a few clicks. We were able to see that Prisma had started to onboard and ingest for alerts and asset variations within our inventory.

We have a security architect and Palo Alto has a security architect. We deployed it together with the support of a Palo Alto engineer.

When we started using Prima Cloud a year ago, we had 7,000-plus alerts. We went through many of the policies that resulted in numerous false positives and we went through the RQL (Resource Query Language) queries that were not applicable to our environment and that created false positives from their side. We reported them with the details via their case submission. They checked on them and they modified some of the alerts as a result of our request. They are progressing with their changes. We have reduced to 500-plus alerts in the past eight months and we are in good shape in terms of security posture.

Overall, I would rate Prisma Cloud at seven out of 10. It has the scalability and easy onboarding where we can onboard an organization with a few clicks and the integration part will take care of the rest. I appreciate that. But the log retention and integration with third-party solutions need improvement.

I work for a monetary provider and handle around five customers. We mostly use Prisma Cloud for CSPN, but we have a banking customer using CWPP. 

Apart from those two use cases, the other customers are not interested in Prisma Cloud's other functionalities because they're green and already have other solutions with partners that they say are more mature. We have not implemented them in the customers' production environment, but we have toyed around with proofs of concept.

My organization is not primarily a customer. We don't use it a lot because we're a security company that mainly provides customers with solutions using this. That said, visibility is the most significant benefit for our clients because some are so large that they're unaware of what they have. 

They don't have adequate governance over expenses, security, and the parts of the network that are communicating. Prisma Cloud gives them reports that will provide instant insight into what's there. A new feature creates a visual map of networks and communications in the discovery part. It's excellent because you can instantly visualize everything. That's one feature that all the customers appreciate.

It performs well in complicated cloud environments. You only need to add your cloud account credentials. Most of the time, Palo Alto recommends using a full admin account for a service account accessing the tool. The tool works just as well, regardless of the company size. That's one of Prisma's biggest strengths. No matter how big you are, the tool can see everything.

Prisma Cloud can scan any cloud provider. We currently use Prisma on GCP, Amazon, Azure, and Alibaba. We also have Oracle, but I haven't used it for Oracle yet. This is crucial because some customers aren't proficient in managing multiple cloud environments. They only need to go to Prisma Cloud and see what they have because the team managing security is not the same one developing the solutions. 

Prisma offers a single pane of glass that lets you do most of what you want in one place. It's not only configurations but also knowing what you have, and your assets are doing. That's the main selling point of Prisma Cloud. It provides you with visualized reports, whether it's in the cloud, live serverless, containers, etc. 

I haven't toyed with CAB personally, but I think you can do that because you can scan images and deployments. I wouldn't say it gives you a lot of value in that regard because most of the CI/CD issues are application-level problems that Prisma Cloud or any other tool wouldn't help you with. Regarding security, you can deploy agents during the integration deployment and gain complete visibility with total memorability that you might introduce in the pipeline. Still, I think it will be a tiny part of the pipeline.

You will not see the problem if you're running an OGs application. While the developers can pinpoint the issue with the information provided, it will never relate to a piece of code and solve it. No tool can tell you exactly which part of the application is the problem, but a tool can identify which process has a vulnerability. Apart from that, many developers have issues finding the root cause of the vulnerability. When it's a library-related vulnerability, the TVD tells you to use another library or play the library. When your own code has the vulnerability, it's hard to pinpoint that.

Prisma provides a lot of information. You can see real-time alerts and forward them to JIRA or whatever tool you use with API or TVD. It also offers anomaly detection. If an administrator is logging in at weird times and doing strange functions, this tool can notify you about them. The anomaly detection is a correlation engine. You seldom get false positives. When it is a false positive, it's something you would expect. The only times I got a false positive were when the administrator forgot the password and tried logging in 50 times. At that point, they just need to contact support and change the password. 

Prisma has massively reduced our alert investigation times. It's 50 times quicker. Without this tool, we must dig up AWS logs, and the format isn't too accessible. The difference between using this tool to investigate an issue compared to a cloud-native solution is two hours versus two minutes. Digging up two logs using Ctrl-left is not the best approach, and it's the only approach cloud providers give you. 

The solution saved us because it helps us turn off idle machines. Most are machines we have turned on, and we didn't know what they do, but we didn't want to turn them off. Prisma Cloud lets you see the communication flows and the asset's actions on the communication map. If you see a device not communicating, it's easier to investigate what it's doing. Sometimes, it's a device generating reports at a particular time. You can schedule it to turn off when it's not active to save money. You also save money by spending less time solving your issues.

Doing cloud compliance without this tool would be impossible because cloud solutions are huge and highly complex. SOS compliance requires that you provide reports in under 24 hours. That's not possible without an automated tool like Prisma Cloud and the CSPN module. You would need to purchase Prisma or a competitor. It helps a lot because some customers have weird compliance requirements, and you can do it all on Prisma Cloud.

You can create custom compliance configurations according to your customer's needs and set Prisma up to provide the reports every 24 hours. In fact, you can do reports in 10-minute intervals or in real time. The client can access the dashboard and see if they're compliant. C-level executives in any company love that. 

The most valuable features are the alerts and auto-remediation because it allows us a lot of flexibility to customize and do functions the Palo Alto team never intended. We faced some challenges with certificates because we also have next-gen firewalls. We would like to equip all the traffic because there have been many cases in which the developers have made mistakes. Deploying certificates on virtual machines can be complex in a development environment, but we managed to do that with Prisma Cloud.

Prisma performs well in a fully cloud-native stack if you run several layers and Kubernetes. It's not so smooth if you migrate VMs into the cloud. Some customers try to do that with Prisma Cloud, but it's not compatible with Windows Server. However, you can deploy serverless containers without issue. You must deploy personal cloud agents into the virtual machines. The agents are called defenders. That module is excellent because you can see communications and vulnerabilities across your environment. It can also scan for malware. It tries to do many tasks at once, say the value it provides is the ability to see communications between devices.

The agent can block the traffic trying to exploit the vulnerability, but it can't fix the problem. That's on the application level. Most of the time, you give the application development team the vulnerability report, and they fix the issue, but Prisma protects you in the meantime. You can sleep well knowing that the agent is blocking the malicious traffic.

They recently added a module called Code Security that enables you to scan repositories or infrastructure as code. You can see concept errors like CSPN problems before the deployment. In tab use cases, it's excellent because you can see if there are misconfigurations in Terraform without having to deploy the instance or whatever you are deploying. That can save you money because sometimes people are deploying machines with problems that are easily fixable. It also improves security because you can fix a vulnerability before you have it with Cloud Security, but that's a rather new solution.

The IMD feature could be improved, but Palo Alto is working on that. It's a relatively new module that attempts to identify unnecessary permissions. Prisma Cloud is a platform that adds new modules whenever Palo Alto acquires a company or develops a new solution. The development team is trying to add new features. It also has Click Code Security for infrastructure security, but it doesn't add much value unless your DevOps team is really junior.

While Prisma provides a lot of visibility, it also creates a ton of work. Most customers that implement Prisma Cloud have thousands of alerts that are urgent. It creates a high workload initially. Apart from that, it solves the problems you have. Palo Alto says that 99 percent of breaches come from misconfiguration. I have seen that first hand. I think the fewest alerts a customer had was around 100 still, but they used another tool for that, so that saves a lot.

I have been working with Prisma Cloud for about 15 months.

Prisma's stability is close to 100 percent because it's just a dashboard that connects to your public cloud. It's essentially a website that never goes down, and you could also host it locally if your security requires it. Most of the customers use the Prisma Cloud platform. If it goes down for any reason, the security agents work independently of Prisma Cloud. You send logs to Prisma Cloud and update the configurations via the cloud. However, if the platform goes offline, you still have top-notch security.

As long as you purchase credits, Prisma Cloud is easy to scale.

I have never contacted Palo Alto support because our team is highly proficient in the solution and the platform is easy to use. You deploy the agents, and it just works. 

It's straightforward to deploy the solution because it's cloud-based, so you just set up an account, username, and password. If you think about it, the Prisma Cloud tool does not do much, but what it does is valuable. It does something simple on a scale that human beings could not do. 

Based on my own experience, I would I rate Prisma Cloud a ten out of ten. However, I haven't compared it with other solutions, so maybe other solutions have more features that Prisma is lacking. My advice is to implement Prisma if it has the features you want but also shop around because I'm sure other solutions are just as good as this one.

I work with Palo Alto products, including their firewalls, VM-Series, CM-Series, hardware, and Prisma Cloud by Palo Alto Networks. I recommend Prisma Cloud by Palo Alto Networks primarily for financial services, FSI, and energy companies.

The threat detection feature in Prisma Cloud by Palo Alto Networks integrates with cloud-native controls like AWS GuardDuty and similar services on Azure and GCP. It also brings its own threat intelligence from Unit 42 and supports external intel feeds like VirusTotal. Multi-cloud compliance monitoring leads to a normalized view and can reduce workforce requirements.

The cost of Prisma Cloud by Palo Alto Networks is too high. I would also appreciate the addition of NLP to reduce the learning curve and make configuring queries more user-friendly.

I have been working with Prisma Cloud by Palo Alto Networks since it was called RedLock in 2019.

The initial setup is straightforward. Day zero involves cloud integration following an admin guide. Day one involves policy tuning, customization, and configuring compliance policies like GDPR.

The ROI is challenging to quantify. While there is tangible reduction in workforce needed, exact cost savings cannot be easily measured.

Pricing and licensing are expensive. There are different experiences with ROI, and exact cost benefits are hard to quantify.

If you have a multi-cloud environment, Prisma Cloud by Palo Alto Networks is essential for reducing costs and normalizing outputs. In a single-cloud, limited setup with good automation, you might not need it. I rate the overall solution at seven to seven and a half.

We are running multiple VMs on GCP and use Prisma Cloud to monitor the CICD pipeline for any issues. If there are issues, we raise tickets in Jira. 

Prisma Cloud keeps our servers secure in most cases. We get the most value from the alerts when we have security issues. The runtime protection is also a good thing. We're also exploring the possibility of automating the CICD pipeline. 

We realized the benefits immediately after we integrated or connected our account.  We used to get a lot of false positives, but we took steps to fix that. In most cases, we get help with that. It doesn't take much time to identify the problem.

Prisma covers the full development cycle and helps us a lot. We use it in the development phase and get a good value from it. We catch issues before the production stage.

Prisma Cloud's real-time detection and monitoring of our entire system is the most useful. We also value Prisma's runtime protection and security alerts.

We like Prisma's preventative approach to cloud security. It alerts us about security issues before they become a problem. If our cloud system has outages, our clients may switch to another competing platform. With the preventative approach, we can ensure our servers are always up. 

The UX part of Prisma's user interface could be simplified and the metrics tool should be highlighted more.

I have used Prisma Cloud for three months.

Prisma Cloud is stable. We haven't had any downtime, crashes or lag. 

Prisma Cloud is highly scalable. 

It was easy to deploy and integrate Prisma Cloud. We connected to our account and chose the platforms and environments we have. When we first deployed Prisma Cloud, we didn't know much about it, so it took 30 minutes to an hour. Deployment was a one-person job. It doesn't require any maintenance on our end because it's a cloud platform, so we just receive alerts. 

I rate Prisma Cloud 10 out of 10. The first thing a new user should do is check the documentation and the official YouTube videos. You can always contact their technical support if you have any issues. I don't think they will require technical support because the videos are useful and the documentation is also good. You can also easily integrate and see the reports on the UI. 

We use Palo Alto to secure our network.  We are using the PA-820 firewall and all of the Prisma Cloud modules. It helps reduce our vulnerability to hacking and any malicious attacks on the network. With that appliance, we can minimize those things and control what goes in and out 

We have reduced network calls by 80 percent. The benefit of Palo Alto is the ability to create security across multiple levels and protect against hacks and vulnerabilities. You start to see these benefits within one or two days after implementing these devices. 

We are also using a honeypot to detect a target on our site. Once we have the target, we are blacklisting those using the firewall. The solution has reduced our investigation times by about 50 to 75 percent. It minimizes the alerts, so we're seeing fewer.

I like Palo Alto's threat protection and Wi-Fi coverage. It has advanced features like DNS security and sandboxing. The automation capabilities are excellent.

The UI could be improved.

I have been using Palo Alto for almost eight months.

Palo Alto provides good support and doesn't take long to resolve an issue. 

We previously used Cisco ASA. We decided to switch because we wanted to adopt a UTM approach in which all the logs and reports go to a single dashboard. Everything is visible in Panorama, which comes with the Palo Alto appliances. We need to purchase a separate license for Panorama, but it's there. 

There are many competitors, such as FortGate, but Palo Alto is better. FortiGate has some advantages in terms of throughput. You can get better throughput if you enable all the engines in parallel. However, I've heard about Fortinet devices being compromised, but I've never heard of that happening with Palo Alto. 

I rate Palo Alto Prisma Cloud nine out of 10. Everything is neat, clean, and easy to use. However, when you commit changes through the UI, it takes some time to load on every system. 

We are using CSPM, IM Security, and Cloud Workload Protection modules.

There are different use cases for Prisma Cloud. Our use case for the CSPM module is to assess compliance with standards such as HIPAA and GDPR, based on our current cloud CSV vendor and configuration. We need to use a CSPM tool to calculate the risk score associated with our current compliance posture.

Some of the reasons we implemented Prisma Cloud were to find the total number of assets in the compliance asset inventory and use the CSPM to assess our workload security. If we have a container environment, we can secure it using cloud workload protection. Additionally, IM Security can help us to determine if our saved credentials are exposed to the public network.

Prisma Cloud provides security for multi- and hybrid-cloud environments. This is the best use case for supporting multi-cloud vendors because, even if we have different cloud service providers, such as AWS, Azure, or GCP, we can manage and view all data in a single, consolidated screen.

All cloud service providers have limitations when it comes to cloud-native stack visibility. Prisma Cloud integrates with all CSPs, switches and correlates the data, and provides complete configuration details for alerts and incidents.

Prisma Cloud's security automation capabilities are effective, allowing us to specify our audit criteria and key configuration audit parameters to detect and automatically remediate misconfigurations. We also have playbooks to automate remediation.

It helps us take a preventative approach to cloud security. We recently received an incident alert for a resource with a security group that allows all ports, which is not a best practice. We will send a notification to the DevOps team and make a change to only allow the necessary ports. We can also automate this process to automatically remove all port access and only allow specific limited ports. Additionally, we can proactively define security keys for our servers and identify and fix vulnerabilities.

We have improved our organization in many ways. The first benefit is that we have from Prisma Cloud a complete asset inventory of all our cloud resources across all CSP vendors. This includes the number of assets and the number of VM instances currently running. This is a valuable use case, as it provides us with visibility into our entire cloud environment. The second benefit is that Prisma Cloud can help us identify misconfigured assets. This is also a valuable use case, as it helps us to ensure that our cloud resources are configured securely. The third benefit is that Prisma Cloud can help us to identify unusual access to our cloud resources. This can be helpful in identifying and responding to security threats. For example, if a user logs into a cloud instance from India and then two hours later logs into the same instance from the US, this could be a sign that the user's account has been compromised. Prisma Cloud can alert us to this type of activity so that we can investigate and take appropriate action.

The comprehensiveness in securing the entire cloud-native development lifecycle is great. We have integrated this solution with our CI/CD pipeline tools, so it scans and validates code in real-time, only allowing legitimate code to be processed further and executed.

It provides us with the visibility and control we need. At first, we may receive many alerts, but once we fine-tune them to generate genuine alerts only for legitimate traffic, our confidence in our security and compliance posture increases.

It also makes it easy to integrate our security with our existing CI/CD pipeline.

Prisma Cloud provides us with a single tool to protect all of our cloud resources and applications without having to manage and reconcile security tools.

Prisma Cloud provides clear visibility into risks at runtime and across the entire pipeline, showing issues as they are discovered. Our developers are able to correct the issues using just a few tools.

Prisma Cloud has reduced our runtime alerts by 20 percent. It reduced our alert investigation time to ten minutes. It also has saved us between 30 to 40 percent of our costs.

CSPM is the most valuable feature for any organization that runs its workloads in the cloud. CSPM can audit the current cloud configuration, identify misconfigurations, and assess risk.

If a customer is already running their workloads in the cloud and wants to secure them, Defender emails can be used to easily identify potential risks. Additionally, the CI/CD pipeline can be scanned to identify any vulnerabilities in the code that developers have written. When code is uploaded, it will be validated and only legitimate code will be applied to the production application. This means that no vulnerabilities will be present in the code.

CSPM can also be used to scan existing infrastructure for vulnerabilities.

The IM security has room for improvement. I would like more important features added.

I have been using Prisma Cloud by Palo Alto Networks for three years.

Prisma Cloud is stable.

Prisma Cloud is scalable.

The technical support is good.

Positive

The initial deployment was straightforward. All components can be deployed in one day, but the CSPM alone only takes half an hour.

Ten people were required for the deployment.

Prisma Cloud is more expensive than some other solutions, but when we consider all of its use cases, the cost averages out.

I would rate Prisma Cloud by Palo Alto Networks nine out of ten.

In terms of our location, we have different cloud service providers, such as AWS and Azure. The majority are AWS and Azure, where we have integrated Prisma Cloud. In terms of Docker and containers, we have integrated some types of labs and CI/CD parts. Therefore, we currently manage both AWS and Azure, as well as a few GCP parts, within a single console.

We have over 50 users.

Prisma Cloud requires maintenance and the OEM initially notifies us of the priority and schedule for maintenance.

We have cloud security posture management and CWPP.  We are also using Cortex, another Palo Alto product. We needed another cloud security tool to create an additional security layer on our CSPM solution. It's essential to secure our infrastructure against any zero-day attacks. 

We needed a cloud security tool to identify misconfigurations in our cloud infrastructure. We were using AWS Cloud Cover since we only had one cloud provider. We onboarded the SysTrack and were able to find the most configurations. In a short period of time, we detected the issues and got alerts.

Before we implemented Prisma Cloud, we were unable to detect misconfigurations based on the policies that we set up. Prisma has that capability. You can add custom policies, and the tool can handle the reconfiguration. 

You can also get feedback from the customer's side about custom policies that can be added on Prisma. We can see the custom policies contributed by other organizations, which has upskilled my knowledge. The primary benefit is the layer of security added to our other infrastructure. 

We started seeing the benefits immediately once the solution was fully deployed. After about a month, we could start digesting data into the tool. Then, we started enabling all the features that we secured for other organizations. After around two months, we could use the features and see the things we were unable to detect. We were able to set up remediation on the tool. Other teams like the developers and tech ops were able to get the details over Jira since it was integrated with SysTrack. 

Our development lifecycle was already prebuilt, and Prisma has absorbed it. There's nothing that Prisma doesn't cover or that isn't reported to the organization. The developers are able to see best practices for any type of resource. They secured training from the product team, and Palo Alto's developers attended it. They shared their knowledge base so we could make the right decisions about resources before making any changes to the AWS cloud.

Prisma can provide solid visibility even if your cloud infrastructure is complex. It can divide the infrastructure into different parts to give you visibility into vulnerability management, configurations, or workload protection. It doesn't matter how complex your cloud infrastructure is. Prisma can digest it and provide the right guidance.

Prisma was able to quickly integrate and onboard our account. As a fintech company, we need a cloud security tool with modules that can benefit the organization. It has a feature that gives you recurring reports for a specified period. 

The solution is handy for the team that handles the Jira tickets because it enables them to automate the tickets. We had to add them manually in the past, so Prisma has absorbed a significant chunk of their workload. It helps us to discover risks throughout the pipeline using the CWPP features. You can quickly identify a misconfiguration and resolve it. In addition to the features it adds, Prisma has helped us to solve tickets faster.

It creates an alert in under a minute. The software team receives this and notifies the owner of the resource within five minutes and resolves the issue according to the SLA. It helps us resolve zero-day cases. It would cost us a lot of money. Prisma helps us to resolve those issues promptly. 

I like Prisma's ability to integrate with other tools. We can integrate it with Jira so that when Prisma triggers an alert, it opens a ticket in Jira. That was a big selling point for the product. There's a feature called the guest custom template that allows you to trigger alerts in Jira based on the template. That can also be added as a feature on Jira.  

Prisma can work with multiple cloud types and hybrid environments. We use AWS, but Prisma also offers hybrid or multi-cloud features. You can onboard AWS, Azure, GCP, or any other cloud provider. You can do more with Prisma than basic cloud scanning. It can detect and handle misconfiguration on the local network or the cloud. 

The solution can control access and automate some tasks. For example, if any automation needs to be built on any of the API calls, we can have a consolidated page for any processes that need to use the API. You can use the APA. Once you establish console access, you can build automation and integrate it with Prisma.

The CSPM module has so many features for developing a preventative approach that you don't need to look to any others, but the IAC security module lets you store infrastructure as code securely. You can scan an IAC template from a tool like Terraform and compare it with the CSPM modules. 

I have one example of a threat that Prisma proactively prevented. In 2021, Prisma discovered and resolved a Log4J vulnerability shortly after it was introduced. 

It would be nice if Prisma Cloud merged its modules for CSPM and infrastructure as code. It would simplify the pricing and make it easier for customers to evaluate the solution because there are different modules, and you need to add it to your subscription separately. 

Overall, Prisma is continuously improving. They do feature requests by allowing the users to vote on things. If a recommendation receives enough votes, they will add it to the solution. 

We have used Prisma Cloud for two-and-a-half years

Prisma Cloud is stable. I've never experienced any downtime aside from the scheduled maintenance window. 

Prisma Cloud is scalable. You can add a hundred master accounts more than on the SysTrack Lab.

I rate Palo Alto support nine out of 10. Their product team has been helpful. I just had a conversation with them. They answer all my questions even if it's after hours. When you send them a message, you get a response in a minute or two. 

Positive

We had previously used PingSafe. I feel like switching to Prisma was the right decision. PingSafe lacked multiple features that Prisma has. After we did our PoC with Prisma, we found that these features added value to our cloud infrastructure security. Once we switched, we noticed an improvement at the management level. We also reduced the number of data tickets that we needed to manually create.

In the first phase, we did a PoC, and the initial deployment took around a month. We worked with Palo Alto's customer success and technical teams. We worked closely with them in the first year, but after that, our deployment was highly mature, so we didn't need to bug them so much. All of the implementation steps were provided by email. Two members of our team were involved. 

Prisma is a cloud-based solution, so it requires no maintenance on our side once it's deployed. Maintenance is handled during a scheduled window, and they send us advance notification the day before.  

Prisma costs a little more than our previous solution, but it has more features. Our previous solution lacked the features we expect from a CSPM tool.

We didn't look at anything else once we learned about this product and did a PoC. And once we evaluated Prisma, we discussed it internally with our team and made the decision to book it. 

I rate Prisma Cloud nine out of 10. If you're considering Prisma, I suggest starting with a PoC. Consider all the features and go for the ones that are suitable for your organization and add value. You could adopt the solution blindly, but there are some additional costs for the add-ons. 

I do not personally use it in my organization. I am a consultant, and I support my clients. I understand the environment, and based on that, I suggest they implement Prisma Cloud. My job is to do a technical evaluation of the product and recommend it to my clients. I give my recommendation to the client as an advisor. I tell them about the features and capabilities of Prisma Cloud and how they can utilize it. I also do a price or cost-effectiveness comparison of different products, but in the end, my clients decide whether they want to choose the technology over the cost or vice versa.

There have been multiple use cases of Prisma Cloud. The use cases vary based on a client's requirements. It is not necessary to implement all the features and capabilities of Prisma Cloud, but generally, it is for continuous compliance monitoring. The Cloud Security Posture Management (CSPM) feature identifies vulnerabilities within your IT organization or ITOps environment. The main part is to ensure compliance with industry standards such as GDPR and CIS Benchmarks.  

Vulnerability scanning has been a major problem for clients. Nowadays, clients do not have just one cloud. They are not using just AWS or Azure. They have multiple clouds. For example, the primary site is on Oracle, the disaster recovery site is sitting on AWS, and some of their applications are on Azure, so there are three hybrid cloud environments. We try to identify the best solution that can seamlessly integrate with all three cloud providers. Our clients want a centralized Cloud Security Posture Management solution for monitoring vulnerabilities and threats. This is one of the major use cases for which we recommend the Prisma Cloud CSPM solution to our clients.

Prisma Cloud can seamlessly integrate with all clouds. When you go into a cloud, there are multiple landscapes. Some are Windows machines, and some are Linux machines. There are different APIs, different databases, and different types of environments with microservices, Kubernetes, etc. Prisma Cloud has the capability to integrate with all these. That is the beauty. This seamless integration is very critical in every product.

There are multiple CSPM products in the market. The key feature of Prisma Cloud is seamless integration. They have thousands of in-built APIs. You do not need to do much customization. It can seamlessly integrate with multiple clouds. It can integrate seamlessly with Azure, AWS, Oracle, Alibaba Cloud, etc. This is the main feature and the key selling point of Prisma Cloud. For example, today, the client is using only Azure Cloud, but tomorrow, the requirement might come for AWS or Oracle Cloud. It does not mean that they are going to buy a new product for CSPM. That is the beauty of Prisma Cloud, and this is where Prisma Cloud scores. It integrates seamlessly. It does not mean that other products cannot integrate. They can integrate, but they might not seamlessly integrate, or they might integrate only with AWS and Azure but not with Oracle or Alibaba Cloud. All of my client base is in the GCC region. I have clients in UAE, Saudi Arabia, Qatar, Kuwait, and Oman. Oman has Google Cloud. Saudi Arabia has Alibaba Cloud and Oracle Cloud. UAE has AWS Cloud and Azure Cloud. In Saudi Arabia, there are even private clouds. Prisma Cloud can even integrate with your private cloud. You can integrate your on-premise cloud.

Prisma Cloud can protect the full cloud-native stack. It is great, and it can solve your needs from a security point of view. The whole purpose of Prisma Cloud is to scan vulnerabilities.

Prisma Cloud's security automation capabilities are good. For example, you can define a policy for virtual machines. The policy hits an API and scans all your virtual machines. It can identify a virtual machine that is not supposed to have access to the Internet, but its ports are open. If you have set the rules, it can also remove the access of the port or the VM to access the Internet. This capability is definitely there, but it is based on the defined rules and policies and how you do the configuration.

Prisma Cloud provides good visibility. The dashboard or UI is user-friendly. You get a holistic view of your entire infrastructure. 

Prisma Cloud integrates security into our CI/CD pipeline at the resource,  component, and infrastructure levels, but at the application level, it is limited. For application-level security, you need to do something else. You need to have an additional capability or additional security solution.

It provides a single tool to protect all of our cloud resources and applications, without having to manage and reconcile disparate security and compliance reports.

It provides risk clarity at runtime and across the entire pipeline, showing issues as they are discovered during the build phases. It discovers issues at the scanning level. It also has the capability to rescan. For example, if you have discovered an issue or vulnerability, after resolving it, you can rescan the same resource to identify whether it has been mitigated or not.

Prisma Cloud has reduced runtime alerts by 60% to 70%. It has also reduced alert investigation time by 60% to 70%. With these time savings, you also save money. By preventing any vulnerabilities or threats, you also save your organization's reputation.

It has a feature for customized security policy. I implement it in banking, health insurance, and other sectors, and every organization has its own customized policies and procedures. In Prisma Cloud, you can customize policies, and based on that, you can do monitoring. 

It has multiple capabilities, such as threat detection and remediation. You can even orchestrate. For example, you can set a rule that a specific set of users need to have XYZ access. If any user is identified as having an additional level of privilege, which he or she is not supposed to have, Prisma Cloud can scan and identify it. If you have set the policy, it can also do mitigation. It can remove the access accordingly.

One major observation is that it is not possible to implement Prisma Cloud on-premises. This is the limitation. Prisma Cloud itself is on a cloud. It is sitting on AWS and Google Cloud. It is a SaaS solution, but some of my clients have a local regulatory requirement, and they want to install it locally on their premises. That capability is not there, but government entities and ministries want to have Prisma Cloud installed locally.

It is stable. It is a leading product.

It is a SaaS-based application, so we need not to worry about scalability. It is their responsibility. They have to ensure its scalability and high availability.

From what I know, their support is good enough. They meet the SLAs. They have been good so far. That could be because they are new in the GCC market, and someone from Europe or the UK might have different feedback. 

I did not use any similar solution previously.

We provide consultancy. We do the implementation but with the support of the vendor. It is not just about buying the product. It is about how you design and configure it. We ensure that the implementation is done as per the defined design.

The key point for a successful product implementation is how you configure it and what is your use case. Every client has different requirements and different use cases. It depends on how you drive it. You need to define the use cases, the policies, and the procedures, and you need to ensure they are aligned with your business objective. You may have the best product in the world, but if you do not know how to configure it based on your use cases and your environment, it will not work for you. You will have vulnerabilities in your environment even after you have invested millions.

The vendor takes care of the implementation, and we validate and guide them with the implementation.

In terms of maintenance, it is not a set-it-and-forget-it solution. It is based on your IT environment. Generally, small organizations do not use a CSPM solution. It is used by mid to large organizations. In such organizations, there are multiple changes in the IT resources. The environment is agile. Every day you add something or change something, and you need to ensure that it is integrated with Prisma Cloud. It is an ongoing operational activity.

We evaluated multiple products. Zscaler was one of them.

My clients are quite happy with this solution. Some of my clients are also based in the UK and Europe. So far, it has been good. It met their expectations. Their use cases are met, and they are able to monitor all their infrastructure. It has been good so far, and it worked for all the generic or standard use cases. That does not mean that it is going to solve all the use cases for all customers. If you want to go for a CSPM solution, you need to do a technical evaluation.

If you are looking into implementing a CSPM solution, I would advise first understanding your existing cloud landscape or your on-premise landscape. Understand your local regulatory requirements and local laws. After that, define the use cases. Define what exactly you are looking for and then go to market and evaluate different products. You can check whether there is an integration with AWS, Oracle, Alibaba, or any other cloud. If your regulatory requirements are that you cannot host your solution outside your country or you need to have it on-premises in your data center, not someone else's data center, you have to choose accordingly. You cannot go for Prisma Cloud. If you do not have any such regulatory requirements, you can go with Prisma Cloud or any other solution. 

You should also understand your future landscape in terms of:

• Over the next five or ten years, how do you want to grow? 
• What is your current IT strategy? 
• How are you evolving? 
• What would be your technology? 
• Would there be any major digital transformation? 
• How seamlessly can it integrate? 

You need to consider multiple parameters. It is also about money. It should also meet your financial budget.

Overall, I would rate Prisma Cloud a seven out of ten.

We use it for visibility, compliance, and governance. It is the official CSPM solution for our bank.

The only module we are using is the compliance module.

In Prisma Cloud, we were able to create frameworks using the RQL language, frameworks that are modeled after our Archer security baselines. Archer is the tool that we used to track all exceptions and security baselines. With Prisma Cloud we have been able to create custom baselines, based on the Archer framework that we have, and not just go off of CIS or NIST frameworks. 

We have also been able to generate reports for teams using the automated scripting tools that Prisma Cloud provides. On a weekly basis, we share those reports with the teams that are impacted. They go back and remediate their findings as needed, or we fine-tune the Prisma Cloud compliance language as needed if there is any ambiguity in there. 

Over the course of a few weeks, the teams remediate these issues and our compliance percentage goes up. Our compliance percentage for production environments was 95 percent. We then made some new acquisitions and they were at 40 or 50 percent, which was very bad. When we brought them under our company's umbrella, we gave them these reports, and they improved their compliance percentage. That has been helping us hugely.

Also, it does a good job of providing a view of our overall posture. Our confidence in our security and compliance posture was what I would describe as a "head in the sand" type of situation before. People would say, "Ah, we should be okay." But once we started digging into stuff and started putting our Archer baselines into the Prisma Cloud queries, that's when we realized that things looked poorer than we had imagined or assumed. This has been a wake-up call for our organization, and everybody has taken notice that we really have a hard job ahead of us.

In addition, with this solution we are seeing a single pane of glass to protect all of our cloud resources and appliances. We are seeing multiple occurrences with multiple platforms under one roof. That has really helped to simplify things.

Prisma Cloud does have some good investigation built into it. When an alert is generated, it does a good job at correlation, not the greatest in the world, but it gives you a good starting point. So it has helped us work on those alerts or investigate them more easily. It reduces our investigation time by 40 to 50 percent because it does all the initial investigation and puts all the findings together. You don't have to manually log into a lot of different accounts or tools to find out that information.

Financially, the only way I can think of that the solution has improved things is in our compliance structure. We spend less time after audits by putting in the effort beforehand. Recently, we have had a lot of good wins where audits have not been able to find a lot of issues. In the past, they used to find 15 or 16 findings, and now, they're able to find only one or two. When you have fewer audit findings, you have fewer man-hours dedicated to dealing with them. We are able to move those man-hours into our actual work rather than just audit work. We have been able to achieve some productivity there. I would estimate it has saved us 5 to 10 percent, in terms of money.

The most valuable feature is the option to add custom queries using the RQL language that they supply so that we can customize the compliance frameworks to what we need to look for.

The comprehensive view that it offers, the compliance percentage based on a framework for a particular account or a particular environment, is extremely useful. We can give those reports to the individual application teams so that they can remediate the findings. It also helps that we can give them read-only access, so we don't even get involved. They log in on their own and can pull a report, based on our instructions, and then do the remediation themselves. It helps us not be the middleman and not waste our time just generating reports for the application teams.

Also, Prisma Cloud provides security for multi and hybrid-cloud environments. We started off using it for our AWS environments, but now Azure and GCP are starting to come into play. We haven't started using those yet, we have just started initial discussions with them, but it has already been decided that Prisma Cloud would be the CSPM even for our Azure and GCP environments.

One definite area for improvement is the auto-remediation or the CWP area. 

The second one is the RQL language. It is still not very flexible and does not cover a lot of use cases. The RQL language could be dramatically improved to add more options. The cloud is adding more and more complexity in terms of number of services or the number of options for each service, especially when it comes to security options like encryption at rest and encryption in transit. And there is the issue of the interlinking of these services. One cloud service uses another cloud service, like CloudFront in front of a load balancer. These interactions are creating numerous new combinations and the RQL language really needs enhancement to handle those queries. 

We ourselves have put in a lot of enhancement requests to Palo Alto, looking at these corner cases, so they can look into those and improve them.

I have been using Prisma Cloud by Palo Alto Networks for about two years.

Prisma Cloud is a little slow, but it is fairly stable.

It is a scalable solution. No matter how many accounts you add, it still can scale. Even the reports that we set up run pretty quickly. They have done a good job of making their platform scalable.

We have been acquiring companies quite a bit recently so we will be using Prisma Cloud heavily. This is our only company-approved CSPM tool. Even though we have some of the native tools in use, like Security Hub from AWS, or Azure Security Center, now called Defender for Cloud in Azure, the official CSPM is Prisma Cloud. It is the center of attraction for us so it is being used by everybody. In the future, we will be adding more accounts as needed until a decision is made on Wiz. We still have a good amount of time left in our Prisma Cloud contract, so we are not looking to switch to Wiz anytime soon.

Technical support is excellent. We have a dedicated account manager from Prisma Cloud who has an office hours session every Monday, and he also attends our standup calls. If Prisma Cloud has any new improvements or any updates that we might be interested in, he brings them up on those calls. We also have a weekly knowledge-sharing session where Prisma Cloud's personnel come in and make a 30-minute presentation and address the enhancement requests that we put in. They'll tell us what updates have happened, what improvements have happened, et cetera.

Positive

The initial setup was straightforward. It was done by one of our team leads, who is a cloud security fellow. He used to be a senior cyber security engineer. It took him three months of full-time work to set up those compliance frameworks, the custom RQL queries based on our Archer baseline, and then, import all the accounts. The importing of the accounts is pretty straightforward. They provide an API or you can even import manually. That's not at all a problem.

We have 10 to 15 users in the solution. Four or five of us are from cloud security proper, and we have administrative rights. Our cloud operations team, seven or eight people, looks at the alerts and investigates and resolves them. They engage us if they need any assistance because they're not very cloud aware yet. And we have a few pilot users who are from the application teams, and they have a read-only role. They generate a report for themselves. Many people still want spoon-feeding and say, "Can you generate a report for us or give us a screenshot of this and that?" We do that occasionally, but we are trying to move away from that process.

For maintenance, there are only two of us, and one of us is doing it full-time, more or less. The other one is more of a standby. We are documenting the procedures. We do weekly maintenance in Prisma Cloud, where we make sure the users are onboarded, there are no stale users, and take care of the general upkeep of the tool. The idea is that, in the future, we'll probably get a junior engineer for that role, while the senior engineer can perform enhancements or more advanced configurations.

When it comes to protecting the full cloud-native stack, Prisma Cloud is fairly okay. Compared to other tools out there, I don't think it is an extremely good product, but it's a reasonably okay product to work with. I've used Wiz in the past, and Wiz does a better job on full native-cloud security.

For example, there is the auto-remediation feature in Wiz, which Prisma Cloud eventually caught up to. Wiz also has agentless scanning that Prisma Cloud is, again, catching up to. There is also Terraform code scanning for CI/CD pipelines that Wiz came up with, ISC code scanning, et cetera. Those are some of the excellent features of Wiz.

Wiz also offers granular compliance frameworks in the sense that you could write your own compliance queries and make them part of a framework. Prisma Cloud's RQL is not that flexible. We are still running into some issues in some corner cases where there are no RQL queries available.

Prisma Cloud's security automation capabilities are very basic. Prisma Cloud is primarily a CSPM, not a CWPP. Even Wiz does not offer that many automation capabilities; they were coming out just at the end of the last year. But compared to other products that I have worked with, which are purely CWPP, Prisma Cloud would not even come close.

I would rate Prisma Cloud at about six out of 10 for helping to take a preventative approach to cloud security. It gets the job done. Our company has invested money in it, so we can't move away from it for another two or three years. But we are already piloting Wiz to see if we like it. Once the contract with Prisma Cloud is up, we will probably jump to Wiz. That's the idea within the company.

If I were to rate Prisma Cloud from one to 10, I would maybe rate it at six, while Wiz would be a nine.

We have started using some of the modules for securing the entire cloud-native development cycle across build, deploy, and run, but we have not really operationalized them. They're in the initial phases. It's not the maturity of Prisma Cloud that's in question, it's about the maturity of our company as a whole. Our company was not really tuned to CI/CD, secure DevOps, and the like, so we are slowly starting to integrate that. We haven't seen the results yet, but I would say it's very promising on that front at this time.

My advice would be to compare other products and understand what you want to do before you purchase or implement it.