Cortex Cloud by Palo Alto Networks Reviews

We use the solution to monitor and manage our various cloud environments, providing complete visibility in a single platform. We also use it for configuration, network, and anomaly monitoring. On the compute side, that's for containers and Kubernetes, so we know when changes are made and whether those changes are approved or within our required security controls. 

The platform has yet to become part of our CICD pipeline; we mostly use it as a security tool for monitoring and remediation. 

Regarding modules, we use the CSP and the compute module. 

Prisma Cloud helps us take a preventative approach to cloud security. It raises awareness of particular threats. Although it's a reactive type platform in that alerts happen on events that have already occurred, it allows us to take a step back and consider our cloud infrastructure more thoroughly. In this sense, the solution enables us to maintain our posture and current programs. 

The product reduced our runtime alerts by approximately 25%.  

Configuration monitoring and alerting is the most valuable feature; it happens at the cloud's speed, allowing our development team to respond quickly. If a configuration goes against our security best practices, we're alerted promptly and can act to resolve the issue. As cloud security staff, we're not staring at the cloud all the time, and we want to let the developers do their jobs so that our company is protected and work is proceeding within our security controls.

The product provides efficient and comprehensive protection for the full cloud-native stack. It presents its findings in layman's terms; alerts are pretty straightforward as to what's going on and why, whether a configuration needs to be changed, and recommendations on how to remediate.  

We used the solution's security automation capabilities, so in the event of an alert, it can be resolved with the click of a button; we click remediate, and the configuration is changed to the recommended status, which is very helpful. However, we use automation sparingly, as we usually have to coordinate changes in the cloud with development teams or through change control. Our typical usage is for completely forbidden scenarios, such as publicly accessible storage containers. We fix that by clicking remediate, then follow up with the team to determine if that was intentional. Sometimes, although accurate, the recommendation may break something else if there is a compensating control in place. So, automation is helpful but not overly used. 

For the most part, the tool provides the visibility and control we need, regardless of how complex and distributed our cloud environments become. Sometimes the platform can be a little kludgy, but we can usually click around and figure it out. Regarding confidence in our security and compliance postures, I don't know how anyone could have a cloud presence without some form of CSP, and I'm delighted with Prisma.   

The solution provides risk clarity at runtime and across the entire pipeline, showing issues as they are discovered during the build phases. However, we still need to utilize this feature to 100%.  

The UI could use some improvement; we usually find the information we're looking for, but what fields can be clicked on and what workflow to follow to get the required information is not always evident. Sometimes we're all over the place, clicking around to drill in and uncover the alert and investigation details we're looking for.

We've been using the solution almost continuously for around five years.

Prisma Cloud is pretty stable; it's a great product, and I'm happy with it.

The platform constantly evolves regarding new features and functions, which can sometimes be a little overwhelming, but it's very scalable. It's just a matter of familiarizing myself with those functions and features. It's the type of tool that is constantly improving, and its scalability suits our environment well.

The customer support is excellent and helped a lot during the deployment process. I rate them nine out of ten. 

Positive

I demoed other solutions but never actually used or implemented one before Prisma.

The initial setup is pretty straightforward, though some of the documentation is convoluted. The support is good, though, so getting someone on the phone or an engineer to respond via email or meeting is easy. The setup was straightforward, and the support was excellent. If I had the permissions to set up the cloud-side integrations, it would have taken a day, but I had to rely on the availability of other staff members, so it took about a week.

The platform is relatively new and expensive, so it's hard to put a number on it. However, the amount of man-hours saved by it easily uncovering some of the flaws in our security posture means it definitely saved us money. 

The product is very expensive, but the cost is a necessary evil; I don't know how we could have any kind of cloud presence without this type of monitoring. The pricing is calculated by module and resource usage. Ultimately, it saves us money in the amount of time we would spend uncovering what it uncovers, and we might not make the required discoveries without it anyway. Prisma offers incredible value, though I wish it were cheaper.

People argue that there are native tools within the various cloud environments, but nothing that streamlines from a timing and comprehension perspective for small security teams. If you don't have a dedicated team of 20 staff, Prisma is the tool you need. I don't know any company that does what they do or how they do it.

Native tools may uncover a misconfiguration, but for a multi-cloud environment, you have to be proficient with multiple different tools, none of which tells the whole story. Prisma pulls in all the data and gives you everything you need to know in one platform. It also pulls in extra data, including network traffic, anomaly traffic, configuration data, and vulnerability data, so you can correlate that information and make an educated decision as to what's going on in the environment, and what needs to be changed or addressed.

I evaluated Lacework, Sysdig Secure, and Illumio Zero Trust Segmentation, though I see them more as Veracode than CSP competitors. I didn't find any products that compare to what Prisma Cloud does.

I rate the product nine out of ten. 

My advice to those before implementing the platform is to do the integration yourself if you have the time, are IT savvy, and have the necessary permissions. It only requires a little time, a few days to a week at most, and there is great value in doing the integration yourself rather than paying for their support to do it. Onboarding the solution will provide an understanding of how it communicates with the cloud environment, how roles are associated and created, and how the remediate feature functions. It's important to go through those steps rather than paying someone else to do it; you'll save money and understand how the tool does what it does, which is essential in utilizing it.

Regarding the solution securing the entire cloud-native development lifecycle across build, deploy, and run, we have yet to use it that way, not to say that we won't. This feature is a relatively new part of Palo Alto's CICD deployment, so we haven't used it yet.

Prisma Cloud provides a single tool to protect all our cloud resources and applications, without managing and reconciling disparate security and compliance reports to about 70%. However, we have yet to utilize the tool to its full capacity.

It is pretty easy to onboard accounts with Prisma Cloud. We use Prisma Cloud Compute and Prisma Cloud policy management. The latter is our primary solution and we use Compute to manage our container security, including threats and vulnerabilities. But we primarily focus on managing the policies for our entire cloud configs, internal threats, and network patterns.

For our market requirements, we do need several other services to be maintained for the perfect security posture. For example, one of the primary resources that we are using in our cloud is EC2 instances. That does need some primary security features, like security groups with proper closures, and proper networking with our firewalls. To make sure all of these premade configs are working, Prisma Cloud helps us to identify whenever any deployments meet up with our cloud. It is helpful with our singular architecture.

Prisma Cloud is very helpful with a full native stack. We don't want to leverage any of the resources directly. Instead, Prisma provides us with the services to automate and increase security posture without any internal agents to run it. Other products have internal agents to run with our cloud to help with the security posture of that cloud, but Prisma does not do that. It has a very simple mechanism to onboard the accounts with their console, where we can use the IAM to scan all of the accounts and identify threats and config mismatches.

The solution has also been helpful when it comes to our investigation times because we have fully automated it with our ticketing system. We use ServiceNow and whenever there are any alerts from Prisma Cloud, we have it configured so that they go directly to ServiceNow. That means the user can identify their incident and can resolve it based on the priority of service level agreements. When they do remediate an issue, Prisma Cloud will resolve the alert within Prisma Cloud and ServiceNow will close it on behalf of the user.

Prisma Cloud saves a lot of manual effort that we had to do within our cloud organization.

Prisma Cloud policy management is more valuable than Prisma Cloud Compute. While we use Compute often, we are not leveraging container security as much. We have limited resources for the containers in our cloud environment. Sooner or later, we will launch multiple container features in our cloud, but right now, we don't have much scope so we haven't had a chance to explore the Compute side much.

The solution supports multi- and hybrid-cloud environments. It has multiple cloud strategies like GCP and Azure. It has policy fixes for those cloud environments. We leverage it for AWS and it's important that we can use it for that singular platform.

Prisma Cloud also has log retention periods for the alerts and policies that are triggered, for each account. For example, my account has a specific policy that is high severity. If I need to further investigate, I can do that investigation in the upcoming 30 days. After 30 days, the logs of the triggered alert are not retained by Prisma Cloud on the Palo Alto network.

It also provides us with a single tool to manage our entire cloud architecture. In fact, we are using a multi-account strategy with our AWS organization. We use Prisma as a single source of truth to identify high- or medium-severity threats inside our organization.

Another feature is the automation. It has certain types of policies that can identify network-based threats, such as unusual port or protocol activities. It has tremendous machine-learning capabilities to identify patterns.

When it comes to automation and machine learning, it still needs some more work because sometimes they can give false positives.

In addition, since cloud services are coming up with new features and solutions, Prisma should also keep up with the same level of security. For example, at the previous AWS Summit, numerous services were introduced. Our businesses wanted to develop some of the services with the features in our cloud, but Prisma hasn't come up with any new APIs. Prisma needs to keep up with quick changes as soon as any cloud platform comes up with a new invention.

And one of the main backlogs in their development is in the area of integration. For example, we have ServiceNow in place for ticket management, and Prisma Cloud is supposed to send closure emails for incidents. But from time to time, it fails to do so. We have several other mismatches between Prisma Cloud and ServiceNow. So we have had to focus on incident management.

Integrations with third-party vendors, such as ServiceNow, Slack, and other ticketing tools that Prisma supports have full automation, but there are still some bugs to fix. We see failures from time to time. When our team fixes vulnerabilities or threats, they still see the incidents in place, which makes them liable to pay for SLA failures. Those kinds of things can be avoided if we have fully fledged event management integration with those tools.

They also need to increase their log retention periods to allow further investigation. Sometimes it takes time to check with asset owners and do deep investigations. Because we have numerous accounts, it can take time for asset owners to investigate each and every alert. The log retention period is one of the cons. 

I have been using Prisma Cloud by Palo Alto Networks for more than a year. I started in my role as a cloud security engineer about two and a half years ago, and Prisma Cloud is one of the CSPM solutions that we use.

I use Prisma Cloud every day. It is one of the primary tools I need to monitor and manage the security of our cloud environment. I use it very extensively and my team members use it for identifying threats and managing them with the asset owners.

In terms of performance, they have cloud releases of security features during the first week of every month. Whenever they release new policies, all of a sudden it starts to throw multiple alerts within our console. It is a bit annoying for the DevOps team, but from a security perspective, it is a useful process. But a pre-announcement or pre-testing of the alerts would be a better way for them to do this, instead of creating 50 or 100-plus alerts for our DevOps. We are suggesting better pre-testing of new policies.

It is pretty scalable. When we deploy new AWS accounts within our organization, it applies the same security posture policies to those accounts as well. We can see the security postures it recommends whenever we onboard any new accounts with our organization. The scalability is very good with the management it provides for any accounts we onboard.

Palo Alto Networks is one of the fastest-growing security products in our organization.

From time to time we experience delays in support for critical scenarios. They do have engineering teams at the backend that work with the policies. I understand that. But I'm expecting a more responsive service on their side because sometimes it can even take a week to get a response back from the engineering team.

When we go through the toll-free number to submit a case, they suggest that they are working on it, but sometimes they don't give solutions for such cases for some time.

Positive

We used AWS native security, which is Security Hub. They have their own benchmarks which we leveraged. But we wanted to see more variables with the policies to have a stricter and more secure cloud environment so we moved to Prisma Cloud.

We have been customers of Palo Alto Networks for a very long time because they have several security products, including firewalls that we use in our organization.

The deployment was very straightforward. We were able to onboard IAM policies from our AWS master account to our console with a few clicks. We were able to see that Prisma had started to onboard and ingest for alerts and asset variations within our inventory.

We have a security architect and Palo Alto has a security architect. We deployed it together with the support of a Palo Alto engineer.

When we started using Prima Cloud a year ago, we had 7,000-plus alerts. We went through many of the policies that resulted in numerous false positives and we went through the RQL (Resource Query Language) queries that were not applicable to our environment and that created false positives from their side. We reported them with the details via their case submission. They checked on them and they modified some of the alerts as a result of our request. They are progressing with their changes. We have reduced to 500-plus alerts in the past eight months and we are in good shape in terms of security posture.

Overall, I would rate Prisma Cloud at seven out of 10. It has the scalability and easy onboarding where we can onboard an organization with a few clicks and the integration part will take care of the rest. I appreciate that. But the log retention and integration with third-party solutions need improvement.

I am a cloud security architect. I assess the cloud infrastructure for customers and help implement security control. I use Prisma Cloud for assessment. After we have the visibility, we deploy security controls, such as perimeter firewall control, proxy control, and endpoint security control.

We have purchased the enterprise license that provides all the capabilities such as CSPM, CWP, and DSPM.

Prisma Cloud provides security spanning multi- and hybrid-cloud environments with Azure, GCP, and AWS clouds. It provides comprehensive security for all these CSPs.

By default, Prisma Cloud supports integration with ServiceNow and Remedy. There are a few more default integrations. Cortex is their own native solution, but in terms of overall automation, Prisma Cloud supports a lot of integrations. It is very helpful for organizations to be able to automate these daily tasks. Different organizations use different security tools. A few of them are directly integrated with Prisma Cloud and a few of them are not. However, most organizations use solutions like Remedy and ServiceNow, so these direct integrations are very helpful. They can save about 70% of the time.

Prisma Cloud provides comprehensive visibility into cloud-based resources. Most organizations are shifting their workloads from on-prem to the cloud. Nowadays, everyone is using the cloud infrastructure, and it is a very big challenge for every organization because, without a CNAPP solution, they do not have much visibility into their cloud resources. CNAPP solutions like Prisma Cloud provide visibility into any misconfigurations, threats, or anomalies. They are very good for code-to-cloud visibility.

Prisma Cloud provides code-to-cloud visibility for the application development cycle of an organization. Some organizations use SAST and some organizations use DAST. Prisma Cloud is a combination of both. You can integrate your GitHub or your IDE environment with Prisma Cloud. You can have a view of the vulnerabilities inside your IAC or application code. You also can integrate it with CI/CD. It is very comprehensive. Not many can leverage the complete benefit of Prisma Cloud. In my last organization, we only used it for runtime protection. We did not use it for CI/CD or code and build. In my current organization, we are using it end to end. It is a good tool. We have the complete capability. The first stage is code and build. The second stage is deployment, and the third stage is run time. It provides complete development life cycle protection.

The time to value is usually immediate. At times, the deployment can take some time, but as soon as the deployment is complete, you get the findings.

The visibility and control Prisma Cloud provides completely align with the customers' needs. At times, we have to create some custom policies. It is completely compatible with the needs of the customers.

It provides end-to-end visibility from development to deployment to production. It prevents the development teams from pushing vulnerable code to production. A lot of things can be prioritized and resolved before deployment. By fixing things beforehand, you save a lot of effort or workload later.

Prisma Cloud's findings help us to create policies. In our organization, the vulnerability reports go to the network team or cloud infrastructure team. They analyze the alerts and create organization-level policies. For example, if there is an instance that is using a public IP, based on that incident, they would create a policy at the org level so that in the future, no one assigns any public IP to an instance. It helps them to create better policies.

Different modules are valuable for different customers. We are leveraging CSPM. It is one of the best solutions for comprehensive visibility into cloud resource configurations and compliance. It has a lot of out-of-the-box policies, and the visibility that we are getting is impressive.

The DSPM module is valuable. This is the latest one that Palo Alto procured from Dig Security. No competitor provides this functionality in a single pane of glass. The support for Linux and container security is also very good. That is the beauty of Prisma Cloud. However, in terms of Windows security, Prisma Cloud is lacking because currently, there is no runtime protection available.

The UI is very good. We get all the things within a single UI. It is easy to use. A new user can easily understand it. It is very user-friendly.

It does not provide runtime security or protection for Windows Server. It is currently lacking in terms of Windows environment. They are integrating their Cortex solution with Prisma Cloud. Once they have a unified agent, I am sure that these challenges will go away.

DSPM is a bit limited in terms of data security and storage capabilities. It only supports a few databases or storage accounts. There is still a long list of services that they need to support.

I have been using Prisma Cloud for four years.

I would rate it an eight out of ten for stability.

It is working smoothly. There is no issue. Scalability also depends on the environment. It depends on how much credit you have purchased. If you go beyond that, they notify you. They will not allow you to onboard more accounts. It totally depends upon the credits that you have purchased, so scalability within the credit limit is good. It is 100%.

We have about 40 to 50 people using this solution.

Their support is average. It is not too good and not too bad. For about 50% of the cases, they have to reach out to their engineering team. The engineering team takes a couple of days or weeks to revert. They are usually unable to provide support without the involvement of the engineering team.

Neutral

I have worked with CrowdStrike's CNAPP solution and Aqua Security. Prisma Cloud is the best in my opinion. It is a market leader. 

Prisma Cloud has more than 100 compliances built in. It supports almost all the services inside the CSPs, whereas other CNAPP solutions only support a few of the services or most commonly used services such as compute, databases, or networks. Prisma Cloud supports maximum services from the CSP side and more than 100 compliances. It has the capability of RQL, so you can create custom queries and get the required data.

It is very easy if you have an understanding of the solution. If you are new to this field, you can face challenges during implementation. Without proper knowledge of the roles, IAMs, and infrastructure, you will face some challenges during the deployment.

I can deploy it within an hour, but before that, we have to fulfill some prerequisites. We have to create a role for Prisma Cloud. We have to create a service credential. Every organization has its own procedure. They might take a day or a week to create the required service credential and assign necessary permissions to that. Once we have all the prerequisites, within an hour, we can deploy it. After the deployment, it starts providing visibility. It takes approximately 24 hours.

Our environment is hybrid. We are using AWS, Azure, and GCP. We also have an on-prem environment for which we have deployed Defender for CWP capability. Prisma Cloud provides us with cloud-native security and visibility.

They are regularly implementing new features in Prisma Cloud. They are doing regular updates in the backend, and they keep us informed. Mostly, they are performing these kinds of activities at night so that there is minimal impact.

Maintenance-wise, there is not much. Everything runs smoothly. They take the feature requests and notify us when they implement those requests. They are regularly changing and updating it.

I do not have any metrics for cost savings, but it certainly helps with security and compliance. The visibility it provides helps to fix any vulnerabilities. A data or security breach can cost an organization a lot in terms of money and reputation.

Prisma Cloud provides visibility into vulnerabilities, but it is an organization's responsibility to fix those vulnerabilities. Prisma Cloud only provides visibility. It is only an assessment tool. The team has to fix those vulnerabilities. The time taken to fix the vulnerabilities varies because different teams work on it. 

I have not explored all CNAPP solutions. Overall, I would rate Prisma Cloud an eight out of ten.

We use the solution for three areas, CSPM, CWPP, and Cloud Security.

We use Prisma Cloud by Palo Alto Networks mostly for CSPM. CSPM helps us identify and fix misconfigurations in our cloud environment. This can help us prevent security breaches and improve our overall cloud security posture.

Prisma Cloud also provides CWPP. CWPP helps us protect our cloud workloads from malware, ransomware, and other threats. This can help us keep our data safe and secure.

Prisma's Cloud security is something we are still working on.

The solution is deployed as SaaS.

The solution provides security across multi and hybrid-cloud environments. However, we are currently only using it for the public cloud. We do not use it for any hybrid solutions, and we are not running any on-premises solutions on it.

The solution covers the full cloud-native stack with a single pane of glass. If we need a holistic view of our security posture, Prisma Cloud is a good option. It provides a single pane of glass for managing our security across all of our CNCF workloads.

Overall, Prisma Cloud by Palo Alto Networks is a very good product. I have been using it for the past four years, and I found it to be very effective in helping me to understand my cloud security posture. 

I will use the CNCF as an example. I really like the complete tool. When we first started to use the cloud, we didn't know what we were doing. Only the admins knew what they were doing wrong and what the threats were in the cloud. Cloud is a shared responsibility between us and the cloud provider. This is true for any cloud provider, such as GCP, Azure, or AWS. We don't have visibility into what admins are doing wrong or right, or how many admins keep our configuration secure. On-premises has parameters, but the cloud does not. The solution provides visibility into what is wrong in our environment, what has been done wrong, and what we can do to correct it. This is because of the configuration and the misconfiguration. From an architectural perspective, if we are doing the first step wrong, there is no point in going to the second step and making it correct. We should make our first step correct. Prisma Cloud provides visibility for us to do this.

Prisma Cloud's comprehensiveness for securing the entire cloud-native development lifecycle across build, deploy, and run is good. The solution provides a single pane of glass for everything, including core security, data security, CSP, CWPP, and EIM security. Other good options are available, but they do not offer a single pane of glass. Instead, they are individual products or modules that must be used separately. Prisma Cloud can improve IM and data security, but if we do not want to use multiple tools, Prisma Cloud is a good option because it offers a single pane of glass for all our security needs.       

Prisma Cloud provides the visibility and control we need, regardless of how complex or distributed our cloud environment becomes. We can see how many complaints and alerts we have, which gives us a sense of security. 

Prisma Cloud enabled us to integrate security into our CI/CD pipeline and add touchpoints into existing dev ops processes.

Prisma Cloud provides us with a single tool to protect all of our cloud resources and applications without having to manage and reconcile discrete security and compliance reports. For operations, the capability of CSPM works well.

Prisma Cloud provides risk clarity at runtime and across the entire pipeline, showing issues as they are discovered during the build phases. Our developers are able to correct issues using the tools they used to code. Some of the results are false positives but the majority are not.

Prisma Cloud helps reduce some of our runtime alerts by 40 percent.

Prisma Cloud helped reduce our investigation time by up to 60 percent. 

I find the CSPM area to be a more valuable and flexible feature. We have control in our hands, and we can do anything we want with our cloud security posture management.

Prisma covers all the CNCF areas. However, they are not the best in all of them. For example, their identity controls are not the best. They have modules for identity controls, but they are not the best in the market. The same is valid for data security. AWS and Azure have better native data security than Prisma. Individual modules, other than CSPM and CWPP, could be improved.

The security automation capabilities are average. They have a semi-automated remediation policy, but many tools on the market can automatically remediate based on the resource and desired outcome we need. Therefore, I think the automation of alerts could be improved.

The visibility of the reporting data for CI/CD can be improved in our console to make the output visible to management and developers.

I have been using Prisma Cloud by Palo Alto Networks for four years.

Prisma Cloud is stable.

Prisma Cloud is a scalable platform that releases new modules every six months.

The technical support is good.

Positive

The initial setup is straightforward for an experienced person who follows the instructions. If we have all the necessary resources, the deployment can be completed in one day.

I first started with the CSPM, then the CSP medium, about a year before moving to computing. I then tried data security for native security and more outside and code security.

We used Palo Alto Networks' Professional Service, which was included in our credit and license. They provided us with assistance with the initial implementation, and we were satisfied with their services.

We have seen a return on investment from using Prisma Cloud because it has improved our compliance and security posture.

The pricing is reasonable. However, I think some modules need to be restructured, particularly those related to data security. The licensing model for data security should be compared to the native security offered by AWS and Azure.

We evaluated Wiz and CrowdStrike. We initially started with CSPM, so Prisma Cloud was more flexible. The representative of the Prisma Cloud CSPM was better and more user-friendly. It gave us more permissions, more controls, and it wasn't complex. We could still do whatever we wanted if it was not given by Prisma out of the box. Therefore, we chose Prisma Cloud.

I give Prisma Cloud by Palo Alto Networks an eight out of ten.

If you are new to the cloud and you are not sure where to start, I would recommend using Prisma Cloud. It will give you a comprehensive view of your cloud security posture and help you to identify any areas where you may be vulnerable. You can also use Prisma Cloud to test and evaluate different security controls before you deploy them in your production environment.

Our entire company uses Prisma Cloud. Anything we deploy in the cloud is protected by the solution.

Prisma Cloud does not require maintenance from our end.

If someone is new to the cloud and looking for cloud security, I think the best place to start is Prisma Cloud. Prisma Cloud offers a comprehensive set of security capabilities, including CSPM, workload security, and cloud security. We can start by using the CSPM module to assess our cloud security posture and identify any potential vulnerabilities. Once we have addressed any critical vulnerabilities, we can then move on to the other modules.

Everything is a lesson because we started with no knowledge. We did not know that there would be many risks and offenses involved in our cloud security environment. We need to know all of the risks, and we can overcome them with Prisma Cloud.

I'm using the main module of Prisma Cloud, which manages security at scale in cloud environments.

Prisma Cloud offers a very interactive UI that lets you work more effectively, faster, and more efficiently. It can also be used as a dashboard for querying the cloud provider since it integrates with most of the APIs of the cloud service providers. It's a very unique tool in the sense that it lets you centralize the security control of all your cloud providers.

The first aspect that is important is the fact that Prisma Cloud is cloud-agnostic. It's actually available for the five top cloud providers: AWS, GCP, Azure, Oracle, and Alibaba Cloud. 

The second aspect is the fact that we can write our own rules to try to detect misconfigurations in those environments.

And Prisma Cloud is a single tool that protects cloud resources and applications without having to manage and reconcile disparate security and compliance reports. That's the main purpose of the CSPM module of Prisma Cloud: You can manage every cloud platform, every cloud account, from a single place, which is the Prisma Cloud dashboard. It gives you a very high overview of every asset, a full site inventory. And you can see the context as well as the severity of the errors that have been raised on each service and asset that has been deployed in the cloud.

In my experience, Prisma Cloud is a valuable asset for enterprises that tend to have a lot of cloud-native applications and that wish to secure, and take control of the security posture of these applications. One of the most important considerations is that Prisma Cloud is a product from Palo Alto Networks, a company that invests heavily in cyber security. There are a lot of features that have come out over time. In the beginning, Prisma Cloud was known for its CSPM capabilities, but today, Prisma Cloud is doing a lot of things that are very beneficial for cloud-native applications.

There are a couple of things that can be enhanced. The first is the coverage that Prisma offers. Today, there are hundreds of built-in policies for AWS and Azure, but GCP and Oracle are not covered as much as AWS. There is a lot of work to do on that part. There is, obviously, a tiny bit of favoritism towards AWS because it has the most market share. It's logical, but the other cloud providers are not as well covered as AWS.

The second issue is the alerting process. Today, it does monitor the resources—and I'm only speaking on the CSPM side of things. Prisma Cloud scans the environment and checks if there are misconfigurations, but it lacks context. There is a real lack when it comes to taking into consideration how the application was designed. For example, you can have an application that is deployed with an open S3 bucket, which is one of the most basic services in AWS. Prisma will tell you that there is a high-severity alert because, with that bucket, there is a possibility of having your data extracted. But sometimes, the data inside those buckets is actually public. So, the process lacks some intelligence.

I've been using Prisma Cloud by Palo Alto Networks for 10 months.

I'm using the SaaS version which is running on Palo Alto's infrastructure, so I've never encountered instability. 

There is some patching behind Prisma Cloud when Palo Alto delivers new features so there are some "patch intervals," but most of the time, Palo Alto does notify you when something like that is coming up. It will say, "Hi. This Friday, the application will be unavailable from 6:00 PM to 7:00 PM." But it is not very disturbing at all.

Because I'm using the SaaS version, there is no issue with scalability. It all depends on the credits and the amount of money that you have put into the tool. Aside from that, you can use it to onboard any cloud account no matter how many resources are in it.

I have contacted their tech support many times, and they are pretty quick. They are very invested and proficient. I get answers within a day or two, at most.

Sometimes, when an issue becomes pretty complicated, it can span a week because it is transferred to different people.

Positive

I did not use another solution before Palo Alto.

We have definitely seen ROI in that using Prisma Cloud is an eye-opener regarding cloud security. In general, Prisma Cloud helped us see a lot of blind spots that we left when designing applications. There were a lot of security misconfigurations that we wouldn't have been able to spot without Prisma. The return on value is in the securing of the applications that we are deploying, as well as through a better understanding of the types of issues in the type of environment.

The cost is run by credits. You can allocate them as you wish, so there are no issues there. I believe the credits, licensing, et cetera, are based on the size of the enterprise that is buying the product.

There are no additional costs beyond the standard fees.

Wiz was one of the tools we looked at. I was not the only one who made the choice, but we went with Prisma because of its capabilities as well as the support. We are investing a lot in Palo Alto Networks, meaning we use a lot of their products, so we know the enterprise itself. We know the quality of their catalog of services.

My advice is to take your time before going the CSPM route. Look at your environments and inventory everything in it. There is, obviously, no shadow IT in the cloud. It's very easy to get an inventory of the resources you are running on. Get an overview and see if having a powerful CSPM at your side is really a need. There are a lot of open-source solutions that can do the job for smaller environments.

From what I understand, Palo Alto is trying to push Prisma Cloud to become more than a simple CSP tool, since it offers the ability to cover the global environment of cloud applications, such as doing scanning and infrastructure-as-code, and managing IAM, rather than doing it directly in the cloud provider. They are trying to centralize things.

It can also be used to manage containerized applications. It can do runtime security in container-based managed services of cloud providers, such as EKS (Elastic Kubernetes Service) which is a service managed by AWS. You can rely on Prisma to put an agent in such environments to monitor and supervise the security. You can also use it to scan the container images that are stored in repositories, whether they are on-premises or in the cloud. I've heard that Palo Alto is doing a lot of things like this, but as of today, I'm only using the CSPM part.

And in terms of security automation capabilities, I've used Checkov, which is the tool they are using for scanning specialized code like Terraform. In its origins, Checkov is an open-source tool and I've been using it with my clients by deploying it in CI/CD chains to scan, automatically, the code that is pushed inside repos and deployed in the cloud. But I have never used the Chekhov that is built into Prisma Cloud.

Similarly, I know Prisma offers the possibility of auto-remediation, but I have not enabled this option. It could be a bit dangerous because there is the context and a lot of things to take into consideration before blocking something, before deployment or after deployment. So, I have not used its preventive actions.

The solution provides visibility into complex or distributed cloud environments, but I can think of a couple of scenarios where clients might not think the same. It supports the top five clouds, but if you are using another cloud provider, you won't be able to use Prisma Cloud for that instance. You would be able to use the Compute module, but it would be very hard to use the CSPM capabilities on such a cloud provider since their APIs are not working with Prisma. But if you are using the most commonly used clouds, Prisma Cloud is a very valuable asset.

Prisma Cloud is a very powerful tool and it can be used in various scenarios, but it doesn't cover everything. You might choose a cloud provider that is not supported or prioritized by Prisma. If you are using Oracle Cloud or Alibaba, you might want to get another solution, maybe one that comes with better policies and a better investment in those technologies.

Aside from that, Prisma Cloud is a good solution if you are using a mainstream cloud provider. Prisma Cloud can help enhance your security posture. Because it's a Palo Alto product, you can be sure that there is a lot of maintenance behind it. The product will be able to keep up with the market. They will keep the features coming and it will continue to be a better product over time.

We use Prisma Cloud in several ways and there are a lot of use cases. The first way that we use it is for inventory. It keeps a near real-time inventory of virtual compute storage and services. Second, we use it for monitoring and alerting of misconfigurations or other items of security significance. Next is compliance. We use it to monitor compliance with the centers for internet security (CIS) benchmarks.

Prisma provides security that spans multi/hybrid-cloud environments. We have it configured to watch for compliance in AWS, the Google Cloud Platform, and very soon, Azure as well. This is important to us because our risk management organization mandated the fact that we would maintain this overwatch capability in any of our clouds that have virtual compute storage or workloads.

Prisma's comprehensiveness for protecting the full cloud-native stack is excellent.

The comprehensiveness of the cloud-native development lifecycles is excellent. For us, the deploy functionality is not applicable but the build and run capabilities are. It positively affects our operations and gives us optics that we wouldn't otherwise have, at the speed of the cloud.

Prisma provides the visibility and control that we need, regardless of how complex our environments are. This very much boosts our confidence in our security and compliance postures. It's also been deemed acceptable as a sufficient presence and efficacy of control by our internal auditors and external regulators alike.

This solution has enabled us to integrate security into our CI/CD pipelines and add touchpoints as a control stop in the release chain. The touchpoints are seamless and very natural to our automation.

Prisma Cloud is a single tool that we can use to protect all of our cloud resources without having to manage and reconcile several security and compliance reports. It unifies and simplifies the overall operations.

Using this tool provides us with risk clarity across the entire pipeline because we use it as a pre-deployment control, ensuring that the run state is known and the risk posture is known at runtime. Our developers use this information to correct issues using our tools for YAML, JSON, CloudFormation templates, and Terraform.

Prisma does so much pre-screening that it limits the number of runtime alerts we get. This is because those pre-deployment code controls are known before the run state.

The investigations capabilities enhance our process and lower incident response and threat detection time. However, it is an enabler and it is run in parallel with our SIEM, which is Splunk. Most of what we're going to do, investigation-wise, is going to be in Splunk, simply because there's better domain knowledge about the use of that tool in Splunk's query language.

The most valuable feature is the continuous cloud compliance monitoring and alerting. The way Prisma works is that it has a tentacle from Palo Alto's AWS presence into ours. That tentacle is an application program interface, an API, a listener. That listener goes in and is entitled to look at all of the Amazon Web Services' logging facilities. It can then do event correlation, and it can tattletale on misconfigurations such as an S3 storage bucket made publicly available. We wouldn't otherwise be aware of that if Prisma didn't watch for it and alert on it.

Prisma provides cloud workload protection and cloud network security in a single pane of glass, and these items are very important to us. It also provides cloud infrastructure entitlement management but identity and access management is not something that we use Prisma for. We implemented a PoC but we opted to use another tool for that use case.

The security automation capabilities provided by this product are excellent and industry-leading. Palo Alto bought a company called Twistlock, which makes a pre-deployment code scanner. They added its functionality to the feature set of Prisma in the form of this compute module. Now, we're able to use the Twistlock capability in our automation, which includes our toolchains and pipelines.

This tool provides excellent features for preventative cloud security. We use all of the auto-remediation capabilities that Prisma offers out of the box. That "see something, do something" auto-remediation capability within Prisma keeps our human responders from having to do anything. It's automated, meaning that if it sees something, it will right the wrong because it has the entitlement to do that with its Prisma auto-remediation role. It's great labor savings and also closes off things much quicker than a human could.

Palo just keeps bolting on valuable features. They just show up in the console, and they have their little question mark, down in the lower right-hand corner, that shows what's new, and what's changed for August or September. They just keep pouring value into the tool and not charging us for it. We like that.

We would like to have the detections be more contemporaneous. For example, we've seen detections of an overprivileged user or whatever it might be in any of the hundreds of Prisma policies, where there are 50 minutes of latency between the event and the alert. We'd always want that to be as quick as possible, and this is going to be true for every customer.

The billing function, with the credits and the by-workload-licensing and billing, is something that is a little wonky and can be improved.

We began using Prisma Cloud in October or November 2018, when it was still known as RedLock.

Stability-wise, it has been perfect.

The scalability is excellent. Palo keeps adding cloud support, such as for Alibaba, Oracle, and others.

We have approximately 5,500 employees. Our deployment is all-encompassing overwatch to all of our AWS accounts, of which there are 66. We also have two or three different folders within GCP.

We do have plans to increase our usage. This includes using it for more of its capabilities. For example, there is a workload protection link that we haven't fully embraced. There are also some network security features and some dashboarding and geo-mapping capabilities that we could make better use of.

The technical support is excellent. We have premium support with Palo Alto and I never have any critique for the quality or speed of support.

We have used this solution from the outset of our cloud journey. It began with Evident.io, then it became RedLock, and then it became Prisma Cloud.

The initial setup is very straightforward. We did it several times.

The first one was deployed to AWS, which probably took about an hour. Years later, as we adopted the Google Cloud, it was configured in probably half an hour.

Palo provides the necessary setup instructions and you can't go wrong, as long as you have the role entitlement set up for Prisma. The handshake only takes about an hour.

Our deployment was done entirely in-house.

We have three people, full-time, who are responsible for the maintenance. Their roles are policy management, meaning these are the rule sets. It's called RQL, the RedLock query language, the out-of-the-box policies that are ever dynamic. When there's a new policy, we have to go in and rationalize that with our cyber organization.

We have to scrutinize the risk rating that's put on it by Palo. We have to realize when we're going to turn it on and turn it off. Also, we have to consider the resulting incident response procedures associated with the alert happening.

One metric that would be meaningful in this regard is that our company has had no cloud-based compromise. 

You can expect a premium price because it is a premium quality product by a leading supplier.

We are a strategic partner with Palo Alto, meaning that we use all of their solutions. For example, we use their NG firewalls, WildFire, Panorama, Prisma, and all of their stuff. Because Prisma was an add-on for us, we get good pricing on it.

There are costs in addition to the standard licensing fees. The credits consumption billing model is new and we're going to be using more of the features. As we embrace further and we start to use these workload security protections, those come at an incremental cost. So, I would say that our utilization, and thus the cost, would trend up as it has in the past.

We evaluated several other products such as DivvyCloud, Dome9, and a product by Sophos.

We did a full comparison matrix and rationalization of each of the capabilities. Our sister company was using DivvyCloud at the time and as we do from time to time, we conferred with them about what their likes and dislikes were. They were moderately pleased with it but ultimately, we ended up going with Palo Alto.

My advice for anybody who is considering this product is to give it a good look. Give it a good cost-balance rationalization versus the cost of a compromise or breach, because it's your defense mechanism against exposure.

I would rate this solution a ten out of ten.

We had an internal debate regarding our firewall solution for the cloud. Initially we had a vendor that suggested we could build a whole environment using the Azure firewall, but we had requirements for Zero Trust architecture. We are essentially like a bank. We were planning to host some PCI services in the cloud and we were planning to create all the zones. When we looked at the feature set of Azure, we were not able to find Layer 7 visibility, which we had on our firewalls, and that is where the debate started. We thought it was better to go with a solution that gives us that level of visibility. Our team was comfortable with Palo Alto as a data center firewall, so we went for Prisma Cloud.

The comprehensiveness of the solution for protecting the full cloud-native stack is pretty good. It is doing a good job in three areas: identification, detection, and the response part is also very clear. We are able to see what is wrong, what is happening, and what we allowed, even for troubleshooting. If something goes bad, we need to check where it went bad and where it started. For example, if there is an issue that seems to be performance-related, we are able to look at the logs and the traffic flow and identify if the issue really is performance-related or if it is a security issue. Because we are new to the cloud, we are using a combination of different features to understand what is going on, if the application owner does not know what is wrong. We use the traffic analysis to find out what it was like yesterday or the day before and what is missing. Perhaps it is an authentication issue. We use it a lot for troubleshooting.

We have implemented Palo Alto's SOAR solution, Demisto, and have automated some of the things that our SOC team identified, related to spam and phishing. Those workflows are working very well. Things that would take an analyst between three and six hours to do can now be achieved in five to eight minutes because of the automation capabilities.

Overall, the Palo Alto solution is extremely good for helping us take a preventative approach to cloud security. One of the problems that we had was that, in the cloud, networking is different from standard networking. Although only a portion of our teams is trained on the cloud part, because we had engineers who were using the platform, they were able to quickly adapt. We were able to use our own engineers who were trained in the data center to very quickly be able to work on Prisma Cloud. But when we initially tried to do that with Azure itself, we had a lot of difficulty because they did not have the background in how Azure cloud works.

Also, when you have a hybrid cloud deployment, you will have something on-prem. Maybe your authentication or certain applications are still running on-prem and you are using your gateway to communicate with the cloud. A lot of troubleshooting happens in both the data centers. When we initially deployed, we had separate people for the cloud and for the local data centers. This is where the complication occurred. Both teams would argue about a lot of things. Having a single solution, we're able to troubleshoot very quickly. The same people who work on our Palo Alto data center firewalls are able to use Prisma Cloud to search and find out what went wrong, even though it's a part of the Azure infrastructure. That has been very good for us. They were easily able to adapt and, without much training, they were able to understand how to use Prisma Cloud to see what is happening, where things are getting blocked, and where we need to troubleshoot.

The solution provides the visibility and control we need, regardless of how complex or distributed the cloud environments become. If you have traffic passing through multiple zones and you have your own data center as well, that is where it does the magic. Using Prisma Cloud, we're able to quickly troubleshoot and identify where the problem is. Suppose that a particular feature in Office 365 is not working. The packet capture capability really helps us. In certain cases, we have seen where Microsoft has had bugs and that is one area where this solution has really helped us. We have been able to use the packet capture capability to find out why it was not working. That would not have been possible in a normal solution. We are using it extensively for troubleshooting. We are capturing the data and then going back to the service provider with the required logs and showing them the expected response and what we are getting. We can show them that the issue is on their side.

When it comes to Zero Trust architecture, it's extremely good for compliance. In our data center, we did a massive project on NSX wherein we had seven PCI requirements. We needed to ensure that all the PCI apps pass through the firewall and that they only communicate with the required resources and that there was no unexpected communication. We used Prisma Cloud to implement Zero Trust architecture in the cloud. Even in between the subnets, there is no communication allowed. Only what we allowed is passing through the firewall. The rest is getting blocked, which is very good for compliance.

If I have to generate a report for the PCI auditor, it is very simple. I can show him that we have the firewall with the vulnerability and IPS capabilities turned on, and very quickly provide evidence to him for the certification part. This is exactly what we wanted and is one of the ways in which the solution is helping us.

Another of the great things about Prisma Cloud is that the management console is hosted. That means we are not managing the backend. We just use Prisma Cloud to find out where an issue is. We can go back in time and it is much faster. If you have an appliance, the administration and support of it are also part of your job. But when you have Prisma Cloud, you don't care about those things. You just focus on the issues and manage the cloud appliances. This is something that is new for us and extremely good. Even though we have a lot of traffic, the search and capabilities are very fast, making them extremely good for troubleshooting.

Because the response is much faster, we're able to quickly find problems, and even things that are not related to networking but that are related to an application. We are able to help the developers by telling them that this is where the reset packet is coming from and what is expected.

We are using the new Prisma Cloud 2.0 Cloud Security Posture Management features. For example, there are some pre-built checklists that we utilize. It really helps us identify things, compared to Panorama, which is the on-prem solution. There are a lot of elements that are way better than Panorama. For instance, it helps us know which things we really need to work on, identifying issues that are of high importance. The dashboards and the console are quite good compared to Panorama.

If one of our teams is talking about slowness, we are able to find out where this slowness is coming from, what is not responding. If there is a lock on the database, and issues are constantly being reported, we are able to know exactly what is causing the issue in the backend application.

The main feature is the management console which gives us a single place to manage all our requirements. We have multiple zones and, using UDR [user-defined routing] we are sending the traffic back to Palo Alto. From there we are defining the rules for each application. What we like about it is the ease of use and the visibility.

The application visibility is amazing. For example, sometimes we don't know what a particular custom port is for and what is running on it. The visibility enables us to identify applications, what the protocol is, and what service is behind it. Within Azure, it is doing a great job of providing visibility. We know exactly what is passing through our network. If there is an issue of any sort we are able to quickly detect it and fix the problem.

The solution provides Cloud Security Posture Management, Cloud Workload Protection, Cloud Network Security, and Cloud Infrastructure Entitlement Management in a single pane of glass. When it comes to anomaly detection, because we have Layer 7 visibility, if there is something suspicious, even though it is allowed, we are able to identify it using the anomaly detection feature. We also wanted something where we could go back in time, in terms of visibility. Suppose something happened two hours back. Because of the console, we are able to search things like that, two hours back, easily, and see what happened, what change might have happened, and where the traffic was coming from. These features are very good for us in terms of investigation.

In addition, there are some forensic features we are utilizing within the solution, plus data security features. For example, if we have something related to financial information, we can scan it using Prisma Cloud. We are using a mixture of everything it offers, including network traffic analysis, user activity, and vulnerability detection. All these things are in one place, which is something we really like.

Also, if we are not aware of what the port requirements are for an application, which is a huge issue for us, we can put it into learning mode and use the solution to detect what the exact port requirements are. We can then meet to discuss which ones we'll allow and which ones are probably not required.

The only part that is actually tough for us is that we have a professional services resource from Palo Alto working with us on customization. One of the things that we are thinking about is that if we have similar requirements in the future, how can we get his capability in-house? The professional services person is a developer and he takes our requirements and writes the code for the APIs or whatever he needs to access. We will likely be looking for a resource for the Demisto platform.

The automation also took us time, more than we thought it would take. We had some challenges because Demisto was a third-party product. Initially, the engineer who is with us thought that everything was possible, but later on, when he tried to do everything, he was not able to do some things. We had to change the strategy multiple times. But we have now reached a point where we are in a comfort zone and we have been able to achieve what we wanted to do.

Also, getting new guys trained on using the solution requires some thought. If someone is already trained on Palo Alto then he's able to adapt quickly. But, if someone is coming from another platform such as Fortinet, or maybe he's from the system side, that is where we need some help. We need to find out if there is an online track or training that they can go to.

Related to training is the fact that changes made in the solution are reflected directly in the production environment. As of now, we are not aware of any method for creating a demo environment where we can train new people. These are the challenges we have.

We have been using Prisma Cloud by Palo Alto Networks for about eight months.

We have not had many issues with the solution's stability, and whatever challenges we have had have been in the public cloud. But with the solution itself there has only been one issue we got stuck on and that was NAT-ing. It was resolved later. We ran into some issues with our design because public internet access was an issue, and that took us some time. But it was only the NAT-ing part where we got stuck. The rest has all been smooth.

As of now, we have not put a load on the system, so we will only know about how it handles that when we start migrating our services. For now, we've just built the landing zones and only very few services are there. It will take like a year or so before we know how it will handle our load.

This is our main firewall solution. We are not relying on the cloud-based firewall as of now. All our traffic is going through Prisma Cloud. Once we add our workloads, we will be using the full capacity of the solution.

We have not had any issues up to now.

We initially tried to use the Azure firewall and the VPC that is available in Azure, but we had very limited capabilities that way. It was just a packet filtering solution with a lot of limitations and we ended up going back to Palo Alto.

The initial setup was straightforward. There was an engineer who really helped us and we worked with them directly. We did not have any challenges.

The initial deployment took us about 15 days and whatever challenges we had were actually from the design side. We wanted to do certain things in a different way and we made a few changes later on, but from the deployment and onboarding perspectives, it was straightforward.

We have a team of about 12 individuals who are using Prisma Cloud, all from the network side, who are involved in the design. On the security side, three people use it. We want to increase that number, but as I mentioned earlier, there is the issue of how we can train people. For maintenance, we have a 24/7 setup and we have at least six to eight engineers, three per shift. Most of them are from the network security side, senior network security engineers, who mainly handle proxy and firewall.

Our implementation strategy included using a third-party vendor, Crayon, who actually set up the basic design for us. Once the design was ready, we consulted with the Palo Alto team telling them that this was what we wanted to implement: We will have this many zones and these are the subnets. It didn't take much time because we knew exactly what our subnets were but also because the team that was helping us had already had experience with deployment.

Our experience with Crayon went well. Our timeline was extremely short and in the time that was available they did an excellent job. We reached a point where the landing zones were ready and whatever issues we had were resolved.

I can't say much about the pricing because we still have not started using the solution to its full capabilities. As of now, we don't have any issues. Whatever we have asked for has been delivered.

If you pay for three years of Palo Alto, it's better. If you're planning on doing this, it's obviously not going to be for one year, so it's better if you go with a three-year license.

The only challenge we have is with the public cloud vendor pricing. The biggest lesson I have learned is around the issues related to pricing for public cloud. So when you are doing your segmentation and design, it is extremely important that you work with someone who knows and understands what kinds of needs you will have in the future and how what you are doing will affect you in terms of costs. If you have multiple firewalls, the public cloud vendor will also charge you. There are a lot of hidden costs.

Every decision you make will have certain cost implications. It is better that you try to foresee and forecast how these decisions are going to affect you. The more data that passes through, the more the public cloud will charge you. If, right now, you're doing five applications, try to think about what 100 or 250 applications will cost you later.

If we had gone with the regular Azure solution, some of the concerns were the logging, monitoring, and search capabilities. If something was getting blocked how would we detect that? The troubleshooting was very complicated. That is why we went with Prisma Cloud, for the troubleshooting.

Microsoft is not up to where Palo Alto is, right now. Maybe in six months or a year, they will have some comparable capabilities, but as of now, there is no competitor.

Before choosing the Palo Alto product we checked Cisco and Fortinet. In my experience, it seemed that Cisco and Forinet were still building their products. They were not ready. We were lucky that when we went to Palo Alto they already had done some deployments. They already had a solution ready on the marketplace. They were quickly able to provide us the demo license and walk us through the capabilities and our requirements. The other vendors, when we started a year ago, were not ready.

If you have compliance requirements such as PCI or ISO, going with Palo Alto would be a good option. It will make your life much easier. If you do not have Layer 7 visibility requirements and you do not have auditing and related requirements, then you could probably survive by going with a traditional firewall. But if you are a midsize or enterprise company, you will need something that has the capabilities of Prisma Cloud. Otherwise, you will have issues. It is very difficult to work with the typical solution where there is no log and you don't know exactly what happened and there is too much trial and error.

Instead of allowing everything and then trying to limit things from there, if you go with a proper solution, you will know exactly what is blocked, where it is blocked, and what to allow and what not to allow. In terms of visibility, Prisma Cloud is very good.

One thing to be aware of is that we have a debate in our environment wherein some engineers from the cloud division say that if we had an Azure-based product, the same engineer who is handling the cloud, who is the global administrator, would have visibility into where a problem is and could handle that part. But because we are using Palo Alto, which has its own administrators, we still have this discussion going on.

Prisma Cloud also provides security spanning multi- and hybrid-cloud environments, which is very good for us. We do not have hybrid cloud as of now, but we are planning, in the future , to be hosting infrastructure on different cloud providers. As of now we only have Azure.

Because Zero Trust is something new for us, we have actually seen a significant increase in alerts. Previously, we only had intra-zone traffic. Now we have inter-zone traffic. Zero Trust deployments are very different from traditional deployments. It's something we have to work on. However, because of the increased security, we know that a given computer tried to scan something during office hours, or who was trying to make certain changes. So alerts have increased because of the features that we have turned on.

We have a very large public cloud estate. We have nearly 300 public cloud accounts, with almost a million things deployed. It's pretty much impossible to track all of the security and the compliance issues using anything that would remotely be considered homegrown—scripts, or something that isn't fully automated and supported. We don't have the time, or necessarily even the desire, to build these things ourselves. So we use it to track compliance across all of the various accounts and to manage remediation. 

We also have 393 applications in the cloud, all of which are part of various suites, which means there are at least 393 teams or groups of people who need to be held accountable for what they have deployed and what they wish to do. 

It's such a large undertaking that automating it is the only option. To bring it all together, we use it to ensure that we can measure and track and identify the remediation of all of our public cloud issues.

The solution provides risk clarity at runtime and across the entire pipeline, showing issues as they are discovered during the build phases. Our developers are able to correct them using the tools they use to code. It gives our developers a point to work towards. If the information provided by this didn't exist, then we wouldn't be able to give our developers the direction that they need to go and fix the issues. It comes back to ownership. If we can give full ownership of the issues to a team, they will go fix them. Honestly, I don't care how they fix them. I don't really mind what tools they use.

It is reducing run-time alerts. It's still in the process of working on those, but we have already seen a significant decrease, absolutely.

The entire concept is the right thing for us. It's what we need. The application is the feature, so to speak it. What it does is what we want it for: looking across the various cloud estates and providing us with information about what's going on in our cloud, where it is, when it happened. The product is the most valuable feature. It's not a do-all and end-all product. That doesn't exist. But it's a product with a very specific purpose. And we bought it for that very specific purpose.

When it comes to protecting the full cloud native stack—the pure cloud component of the stack—it is very good.

One of the main reasons we like Prisma Cloud so much is that they also provide an API. You can't expect to give someone an account on Prisma Cloud, or on any tool for that matter, and say, "Go find your things and fix them." It doesn't work like that. We've got to be able to clearly identify who owns what in our organization so that we can say, "Here's a report for your things and this is what you must go and fix." We pull down the information from the API that Prisma Cloud provides, which is multi-cloud, multi-account—hundreds and hundreds of different types of alerts graded by severity—and then we can clearly identify that these alerts belong to these people, and they're the people who must remediate them. That's our most important use case, because if you can't identify users, you can't remediate. No user is going to sit there going through over a million deployed things in the public cloud and say, "That one's mine, that one's not, that's mine, that's not." It's both the technology that Prisma Cloud provides and the ability to identify things distinctly, that comprise our use case.

It also provides the visibility and control we need, regardless of how complex or distributed our cloud environments become. It doesn't care about the complexity of our environment. It gives us the visibility we need to have confidence in our compliance. Without it, we would have no confidence at all.

It is also part of our DevOps processes and we have integrated security into our CI/CD pipeline. To be honest, those touchpoints are not as seamless as they could be because our processes do rely on multiple tools and multiple teams. But it is one of the key requirements in our DevOps life cycle for the compliance component to be monitored by this. It's a 100 percent requirement. The teams must use it all the time and be compliant before they move on to the next stage in each release. It is a bit manual for us, but that's because of our environment. It's given our SecOps teams the visibility they need to do their jobs. There's absolutely no chance that those teams would have any visibility, on a normal, day-to-day basis, simply because the SecOps teams are very small, and having to deal with hundreds of other development teams would be impossible for them on a normal basis.

Based on my experience, the customization—especially the interface and some of the product identification components—is not as customizable as it could be. But it makes up for that with the fact that we can access the API and then build our own systems to read the data and then process and parse it and hand it to our teams. At that point, we realized, "Okay, we're not never going to have it fully customizable," because no team can expect a product, off-the-shelf, to fit itself to the needs of any organization. That's just impossible.

So customization from our perspective comes through the API, and that's the best we can do because there is no other sensible way of doing it. The customization is exactly evident inside the API, because that's what you end up using.

In terms of the product having room for improvement, I don't see any product being perfect, so I'm not worried about that aspect. The RedLock team is very responsive to our requirements when we do point out issues, and when we do point out stuff that we would like to see fixed, but the product direction itself is not a big concern for us.

We've been using it since before it was called Prisma Cloud. We're getting on towards two years since we first purchased it.

The stability of Prisma Cloud is very good. I have no complaints along those lines. It seems to fit the requirements and it doesn't go down. Being a SaaS product, I would expect that. I haven't experienced any instability, and that's a good thing.

Again, as a SaaS product, I would expect it to just scale.

We regularly use Palo Alto technical support for the solution. I give it a top rating. They're very good. They have a very good customer success team. We've never had any issues. All our questions have been answered. It has been very positive.

We did not have a previous solution.

The initial setup was very straightforward. It's a SaaS product. All you have to do is configure your end, which isn't very hard. You just have to create a role for the product and, from there on, it just works, as long as the role is created correctly. Everything else you do after that is managed for you.

We have continuously been deploying it on new accounts as we spin them up. Our deployment has been going on since year one, but we've expanded. Two years ago we probably had about 40 or 50 cloud accounts. Now, we have 270 cloud accounts.

We have a team that is dedicated to managing our security tools. Something this big will always require some maintenance from our side: new accounts, and talking to internal teams. But this is as much about management of the actual alerts and issues than it is anything else. It's no longer about whether the tool is being maintained. We don't maintain it. But what we do is maintain our interaction with the tool. We have two people, security engineers, who work with the tool on a regular basis.

It's a non-functional ROI. This isn't a direct-ROI kind of tool. The return is in understanding our security postures. That's incredibly important and that's why we bought it and that's what we need from it. It doesn't create funds; it is a control. But it certainly does stop issues, and how do you quantify that?

Pricing wasn't a big consideration for us. Compared to the work that we do, and the other costs, this was one of the regular costs. We were more interested in the features than we were in the price.

If a competitor came along and said, "We'll give you half the price," that doesn't necessarily mean that's the right answer, at all. We wouldn't necessarily entertain it that way. Does it do what we need it to do? Does it work with the things that we want it to work with? That is the important part for us. Pricing wasn't the big consideration it might be in some organizations. We spend millions on public cloud. In that context, it would not make sense to worry about the small price differences that you get between the products. They all seem to pitch it at roughly the same price.

Before the implementation of Prisma Cloud, there were only two solutions in the market. The other one was Dome9. We did an evaluation and we chose this one, and they were both very new. This is a very new concept. It pretty much didn't exist until Prisma Cloud came along.

The Prisma Cloud solution was chosen because of the way it helped integrate with our operations people, and our operations people were very happy with it. That was one of the main concerns.

Both solutions are very good at what they do. They approach the same problem from different directions. It was this direction that worked for us. Having said that, certain elements of Prisma Cloud were definitely more attractive to us because they matched up with some of our requirements. I'm very loath to say one product is better than the other, because it does depend on your requirements. It does depend on how you intend to use it and what it is, exactly, that you're looking for.

You need to identify how you'll be using it and what your use cases are. If you don't have a mature enough organizational posture, you're not going to use it to actually fix the issues because you won't have the teams ready to consume its information. You need to build that and that needs to be built into the thinking around that product. There's no point having information if you're not going to act on it. So understand who is going to act on it, and how, and then you've got a much better path to understanding your use for this. There's no point in buying a product for the sake of the product. You need the processes and the workflows that go with it and you need to build those. It's not good enough to just hope that they will happen.

The solution doesn't secure the entire spectrum of compute options because there are other Palo Alto products that secure containers, for example. This is very specifically focused on the configuration of the public cloud instances. It doesn't look inside those instances. You would need something else for that. You don't want to be using other products to do this. You don't want to mistake this for something that does everything. It doesn't. It is a very specific product and it is amazingly good at what it does.

We do integrate it with our workflow as part of the process of getting an application onto the internet. It does integrate with our workflow, giving us a posture as part of the workflow. But it is not a workflow tool.

It definitely does multi-cloud. It does the three major ones plus Alibaba Cloud. It doesn't reach into hybrid cloud, in the sense that it doesn't understand anything non-cloud. We don't use it to provide security, although it is very good for that. We already have an advanced security provision posture, because we are a very large organization. We just use it to inform us of security issues that are outside our other controls.

Prisma Cloud doesn't provide us with a single tool to protect all of our cloud resources and applications in terms of security and compliance reports because we have non-cloud-related tools being folded into the reports as well. Even though it works on the cloud, and is excellent at what it does, we integrate it with our Qualys reports, for example, which is the scanning on our hosts. Those hosts are in the cloud, but this doesn't touch them. There's no such thing as a single security tool, frankly. It's basically part of our portfolio and it's part of what every organization needs, in my opinion, to be able to manage their cloud security postures. Otherwise, it would just never work.