Agentless or runtime protection? 5 cloud security platforms that offer both

In July 2026, Broadcom disclosed a critical, unauthenticated vulnerability in the VMware vCenter Server, one that lets anyone walk into a management plane without credentials. While a patch that addresses the vulnerability was released on the same day as the disclosure, today there’s still no temporary fix available, and weeks later, security researchers at Greenbone confirmed that attackers were actively exploiting the flaw in the wild.

While security personnel across organizations continue to scramble to patch the vulnerability, the disclosure gave thought leaders plenty of fuel for the agentless-vs-runtime debate. This kind of vulnerability reveals the contrast between the two approaches.

After all, agentless scanning is the best way to surface a vulnerability, pinpoint where it lies, and identify the best way to fix it. What scanning can’t do, however, is protect you while you close the vulnerability. There’s always a window of time between discovering a flaw and completing patching, and that window sometimes takes hours, sometimes days or weeks. This window becomes a race between security teams and malicious actors who want to exploit it.

But runtime protection can help. Runtime solutions can detect suspicious behavior that indicates that someone is trying to take advantage of a vulnerability, and either alert security teams or automatically block the attack. Wiz is one platform that’s built to address exactly this dilemma, pairing fast agentless visibility and vulnerability discovery with real, active runtime detection.

Agentless scanning and runtime protection are built to complement each other, not compete. Agentless scanning identifies vulnerabilities, misconfigurations, and exposed assets, while runtime protection monitors live activity to detect or stop attacks as they happen.

As we’ll see, many leading CNAPP platforms combine both approaches, but they weigh the balance between visibility and response differently.

Wiz offers Wiz Defend for fast, multi-cloud agentless scanning that covers all environments, and the Wiz Sensor add-on for real-time detection. Its core strength lies in visibility, but it automatically correlates runtime events with cloud exposures to deliver valuable contextual risk prioritization.

Wiz is unique for its Security Graph functionality, which delivers deep attack-path analysis. The solution gives users a broad understanding of vulnerabilities alongside real-time active threat detection.

• Wiz Sensor is an agent-based add-on for runtime detection.
• Security Graph automatically correlates runtime detections with identity, exposure, and data context.
• Coverage spans containers, Kubernetes, VMs, Windows, hybrid/on-prem, and AI infrastructure.

Prisma Cloud offers agentless cloud scanning and an integrated agent-based runtime module to deliver strong vulnerability detection with runtime protection.

Prisma stands out for the most extensive CNAPP feature set, although it places more emphasis on agent-based runtime protection than on agentless visibility.

Prisma Cloud key capabilities:

• Deep integration for organizations already using Palo Alto Networks products.
• Combines posture management and runtime protection in a single platform.

Microsoft’s Defender for Cloud integrates agentless scanning across Azure and hybrid environments with runtime protection based on Windows telemetry, which takes a different approach from Linux-specific eBPF tools.

Defender for Cloud is a strong fit for organizations that operate primarily in Microsoft environments and have an extensive Azure or Windows Server stack, thanks to its native Microsoft ecosystem integration.

Microsoft Defender for Cloud key capabilities:

• Native Windows telemetry integration.
• Runtime protection across VMs, containers, and Kubernetes within Azure and hybrid environments.
• Strong fit for organizations already using Microsoft 365 Defender or Sentinel.

Upwind Security uses eBPF-based runtime detection that’s baked into the main platform alongside agentless scanning, allowing it to provide continuous cloud visibility and real-time threat detection.

It’s notable as one of the few solutions that’s runtime-first, making it well suited to companies that are most concerned with detecting and dealing with live attacks.

Upwind Security key capabilities:

• Correlates runtime findings with cloud context to reduce alert noise.
• New entrant offering an emerging option.

FortiCNAPP is Fortinet’s cloud security platform that unites agentless posture and runtime behavioral detection in a single suite. Originally built by Lacework, it was acquired by Fortinet in August 2024 and rebranded as FortiCNAPP.

This solution is a solid choice for organizations that have a lot of Fortinet products in their security ecosystem, as well as security teams that are urgently concerned with monitoring workloads for active threats.

• Behavioral analysis layered onto agentless cloud visibility.
• Adds strong cloud security technology to Fortinet’s Security Fabric.
• Strongest fit for organizations standardized on Fortinet’s other security products.

Each of the five platforms we reviewed offers both vulnerability scanning and runtime protection, though they arrive at that combination differently. Wiz and Prisma Cloud both pair strong agentless visibility with equally capable runtime detection. Upwind built its platform runtime-first, adding agentless scanning around it rather than the other way around. Microsoft Defender and FortiCNAPP lean on deep integration with their respective ecosystems, Azure and Fortinet’s Security Fabric, to tie the two together.

Set against the backdrop of the recent VMware disclosure, any organization running hybrid or on-prem infrastructure shouldn’t just be checking if they’ve addressed all vulnerabilities, but whether they would know if a malicious actor is attempting to exploit unaddressed vulnerabilities right now. Each of these five platforms should be able to help with both concerns, not just one of them.

What is the difference between agentless CNAPP and runtime protection?

The difference between agentless CNAPP and runtime protection lies in the tasks that they execute. Agentless CNAPP scans environments for vulnerabilities, misconfigurations, and exposed assets, usually without deploying any software on workloads. Runtime protection usually uses a lightweight agent to monitor workloads for attempted attacks, and to stop them immediately.

Can agentless cloud security platforms detect active attacks?

Not on their own. Agentless scanning is built to find vulnerabilities and exposures, not to watch for exploitation as it happens. That’s why leading CNAPP platforms increasingly pair agentless scanning with runtime detection, closing that gap rather than leaving it as a permanent limitation.

Which CNAPP platforms offer both posture management and runtime defense?

Most mature CNAPP platforms offer posture management alongside runtime protection. The main difference lies in the way in which they combine the two capabilities. Wiz, Palo Alto Networks Prisma Cloud, Microsoft Defender for Cloud, Upwind Security, and Fortinet FortiCNAPP all deliver agentless visibility as well as runtime defense.

Do all runtime security tools work the same way across Windows and Linux?

No. Some runtime security tools are designed primarily for Linux operating systems or telemetry sources. Wiz, Prisma, Microsoft, and FortiCNAPP all support both Windows and Linux, while Upwind focuses on Linux. That said, Microsoft Defender has particularly strong Microsoft ecosystem coverage, given its native integration with Windows telemetry.

Featured image credit