Prisma Cloud by Palo Alto Networks Reviews

We host a Prisma Cloud platform on AWS. My role is to host the Prisma Cloud application and provide support to the development team.

We use Prisma Cloud to monitor the health of our Kubernetes clusters and to scan images for vulnerabilities. Developers use Prisma Cloud via twistcli CLI to scan images and view vulnerabilities on the Prisma Cloud user interface.

My job is to maintain the production and staging environments, including installing the twistcli client and deploying dependencies. I also help developers troubleshoot issues with pipelines that connect to Prisma Cloud using twistcli CLI.

Prisma Cloud provides security for multi- and hybrid-cloud environments. It can also monitor multiple on-premises and cloud accounts. In our use case, we have around 40 AWS accounts, which we have added to the Prisma Cloud monitoring tool. We receive non-conformance alerts every month. Prisma Cloud monitors every node in AWS. If a developer opens ports globally, Prisma Cloud will detect it and send an alert to our cloud operations technical team, who will immediately alert the respective developer teams. Prisma Cloud also detects certain types of alerts related to managing data plane infrastructure. For example, if a developer deploys an application on a Kubernetes cluster on AWS and then deletes the application, but the EBS & balancer is not deleted, Prisma Cloud will automatically detect this and send a non-conformance alert to our group email ID.

Prisma Cloud's security automation capabilities provide a variety of features, including twistcli CLI, which can be used to identify vulnerabilities in Docker images. When twistcli CLI detects a vulnerability, it sends an alert to a group email address. The alert includes remediation steps that can be easily followed to fix the vulnerability.

In my experience, Prisma Cloud is the best cloud security solution, whether on-premises or in the cloud. It can monitor multiple cloud products, such as Azure and AWS. I believe it is the best tool for meeting the container requirements of cloud-native applications. It is user-friendly, and upgrades are easy to perform, with documentation available on the official site. It can be deployed on-premises or in the cloud infrastructure. I think it is a good security tool for cloud infrastructure.

We started using Prisma Cloud around version 808.48. That is one of the console versions. Recently, they added some features in the newer version, so our dev team asked us to upgrade to the latest version to get those features. As the administrator, I am not aware of all the cases that Prisma Cloud provides, but I can see that it is easy to manage and has improved all the stakeholders' experience, especially for Docker image scanning. We started with a few teams using Prisma Cloud, but now many stakeholders are using it to scan their Docker images using Prisma CLI. With their request, we recently upgraded the console to the latest version to get the latest features. When we started, we only used basic monitoring, but later we started using it for pipelines to scan Docker images. Then, we added AWS accounts and Kubernetes clusters for monitoring. We deploy twistcli depending on the cluster, and it monitors in the console.

It provides good visibility and control regardless of how complex or distributed our cloud environments become.

Prisma Cloud has enabled us to integrate our security into CI/CD pipelines.

It allows us to add touchpoints to existing DevOps processes.

It also provides us with a single tool to protect all of our resources and applications.

Prisma Cloud provides risk clarity at runtime and across our entire pipeline.

Prisma Cloud has reduced runtime alerts and reduced our alert investigation times. We can remediate alerts within 20 minutes.  

twistcli CLIs are the best feature. They provide a twistcli for scanning Docker images. We have integrated a number of pipelines so that whenever any development is built, the image is scanned for vulnerabilities. Based on the vulnerability reports, the pipelines confirm whether the image needs to be rebuilt after fixing the vulnerabilities, and then build another version if necessary.

I have been using Prisma Cloud by Palo Alto Networks for almost four years.

The technical support team is good. They always help me resolve my tickets with minimal downtime.

Positive

The initial deployment was straightforward because of the well-written documentation that was available. I handled the deployment for the AWS cloud environment.

They have an excellent technical team with sound knowledge of the product.

I would rate Prisma Cloud by Palo Alto Networks a nine out of ten for its compatibility, easy upgrades, user-friendliness, and UI.

Regarding maintenance, we have deployed the application on a Kubernetes environment. We will have one EBS value for the console pod and one persistent volume for the application data. We are taking a snapshot of the PV because we can take a backup of the PV in the Prisma Cloud console UI, but this backup is stored on the same PV where the application is running. If the application crashes completely, we will not be able to restore the backup from the UI, and Prisma Cloud has suggested that we maintain a separate cluster for disaster recovery. However, this is too expensive for us. Therefore, we are taking a snapshot of the PV. If the application crashes, we can simply deploy the console on a new cluster and restore the data from the snapshot.

Our primary use case for this solution is for CWP, CSPM, and scanning for run time. We also use it for monitoring mode and pipeline integration.

This solution has helped our organization by allowing us to have all the products integrated with the service now. This solution helped us by allowing us to schedule and fix things. This is not an easy thing if you're managing 1,000 plus resources.

The most valuable feature for me is the CSPM.

I think Prisma Cloud could improve its preventive governance policy and CWP run time modules.

I have been using this solution for about three years. 

I would say that this solution provides security spending in multi and hybrid cloud environments.

Regarding the comprehensiveness of this solution for protecting the full cloud-native stack, I would say that CSPM is suitable for postal security management, but other than that, there are a lot of pros and cons. We cannot say for 100% that this works for everything on the cloud.

Regarding Prisma Cloud, I would say it has helped us take a preventive approach to cloud security and that it works quite well.

Prisma Cloud provides the visibility and control that we need in the network overall, but the levels of visibility and control vary depending on the module. We need to have the solution integrated with the different tolls, which is quite complex. Our confidence in security and compliance postures is good overall in terms of complaints.

Prisma Cloud has enabled us to integrate security into our Ci/CD pipeline and as touch points into existing DevOps processes. When it comes to the seamlessness of the dash points in our DevOps and touchpoints, there are pros and cons, but a lot of the things have to do with the vendor itself and that's where the challenge is. The integrations are critical because we need to have a lot of talks with Prisma to sort out all those issues.

When it comes to this solution providing us with a single tool to protect our cloud resources and applications without having to manage our security and the compliance report, I would say it's fine with the organization. We plan to move in the future when we move the workloads into the cloud more and more, and we will think about it when we see how it will behave with more workloads and that's when we will discuss it all.

Prisma Cloud provides risk clarity at runtime across the entire pipeline showing issues as they are discovered during the billing basis. But other tools have more capability than Prisma for governance policies. Our developers can correct Prism's governance policies using the tools they use to code and only once they have indicated the safety pipeline, they will get the others to make it a bit more visible and fix vulnerabilities before moving to production.

We are currently using almost all modules of this solution.

I would say that Prisma Cloud has helped us reduce runtime alerts.

I would say that Prisma Cloud has helped us save money because it allows us to have information on the threat before it happens.

I would rate this solution an eight, on a scale from one to 10, with one being the worst and 10 being the best.

We use Prisma Cloud for cloud security management. We use the CSPM and compute modules.

Prisma Cloud provides security spanning multi and hybrid cloud environments, which is moderately essential to our organization.

The security automation capabilities help remediate vulnerabilities, which correlate to cost savings.

After a few months, the benefits of Prisma Cloud became apparent. We have begun integrating the Prisma Cloud alert or inventory module into the computing environment. This is a positive development as it enhances tool interoperability and consolidates a significant amount of previously inaccessible data.

Prisma Cloud can secure 60 to 70 percent of the entire Cloud-native development life cycle.

Prisma Cloud provides the visibility and control we need regardless of how complex or distributed our cloud environment becomes. This improves our compliance posture.

Prisma Cloud provides 70 percent of coverage in a single tool to protect our cloud resources and applications.

It has helped save our organization around 20 percent, protecting our cloud resources and applications.

Prisma Cloud compliance monitoring helps us improve our overall compliance posture.

Prisma Cloud's most valuable features are its ability to detect vulnerabilities as they occur and its CSPM function, which provides a complete inventory of assets.

I like the scanning features provided by Prisma Cloud, including the image scan and source scan.

Prisma Cloud needs to improve its reporting. If they report a Go vulnerability and claim that Prisma Defender hasn't released a patch, it won't help us. However, if they report that Prisma Defender has released a patch, that is beneficial. Reporting the Go vulnerability within Defender is ineffective because I cannot directly fix a Go vulnerability.

The integration with other tools can be improved. It provides all the cloud details but is not entirely linked to the compute model.

There needs to be more transparent communication when they will have downtime.

I have been using Prisma Cloud for over two years.

I would rate the stability of Prisma Cloud nine out of ten.

I would rate the scalability of Prisma Cloud five out of ten because it is dependent on vendor resources rather than its own. For example, image scanning is entirely reliant on us.

The technical team requires a lot of information for every ticket we submit, and if there is ever an out-of-the-box issue, they don't respond to us or take a long time to respond.

Neutral

I previously used AWS tools and Tenable products, but we switched to Prisma Cloud because of its real-time vulnerability identification.

Initial deployment is straightforward and takes one to two hours when all required information is available. However, if complete requirements are missing, manual deployment of all agents is necessary, which is a significantly time-consuming process.

Prisma Cloud is affordable.

I would rate Prisma Cloud eight out of ten.

We have over 100 users.

Our environment is complex. Prisma Cloud is deployed across multiple locations using many tools.

Prisma Cloud requires a lot of maintenance for upgrades and Defender.

I would recommend Prisma Cloud to others. The scanning and runtime are one step ahead of the competition.

I do not personally use it in my organization. I am a consultant, and I support my clients. I understand the environment, and based on that, I suggest they implement Prisma Cloud. My job is to do a technical evaluation of the product and recommend it to my clients. I give my recommendation to the client as an advisor. I tell them about the features and capabilities of Prisma Cloud and how they can utilize it. I also do a price or cost-effectiveness comparison of different products, but in the end, my clients decide whether they want to choose the technology over the cost or vice versa.

There have been multiple use cases of Prisma Cloud. The use cases vary based on a client's requirements. It is not necessary to implement all the features and capabilities of Prisma Cloud, but generally, it is for continuous compliance monitoring. The Cloud Security Posture Management (CSPM) feature identifies vulnerabilities within your IT organization or ITOps environment. The main part is to ensure compliance with industry standards such as GDPR and CIS Benchmarks.  

Vulnerability scanning has been a major problem for clients. Nowadays, clients do not have just one cloud. They are not using just AWS or Azure. They have multiple clouds. For example, the primary site is on Oracle, the disaster recovery site is sitting on AWS, and some of their applications are on Azure, so there are three hybrid cloud environments. We try to identify the best solution that can seamlessly integrate with all three cloud providers. Our clients want a centralized Cloud Security Posture Management solution for monitoring vulnerabilities and threats. This is one of the major use cases for which we recommend the Prisma Cloud CSPM solution to our clients.

Prisma Cloud can seamlessly integrate with all clouds. When you go into a cloud, there are multiple landscapes. Some are Windows machines, and some are Linux machines. There are different APIs, different databases, and different types of environments with microservices, Kubernetes, etc. Prisma Cloud has the capability to integrate with all these. That is the beauty. This seamless integration is very critical in every product.

There are multiple CSPM products in the market. The key feature of Prisma Cloud is seamless integration. They have thousands of in-built APIs. You do not need to do much customization. It can seamlessly integrate with multiple clouds. It can integrate seamlessly with Azure, AWS, Oracle, Alibaba Cloud, etc. This is the main feature and the key selling point of Prisma Cloud. For example, today, the client is using only Azure Cloud, but tomorrow, the requirement might come for AWS or Oracle Cloud. It does not mean that they are going to buy a new product for CSPM. That is the beauty of Prisma Cloud, and this is where Prisma Cloud scores. It integrates seamlessly. It does not mean that other products cannot integrate. They can integrate, but they might not seamlessly integrate, or they might integrate only with AWS and Azure but not with Oracle or Alibaba Cloud. All of my client base is in the GCC region. I have clients in UAE, Saudi Arabia, Qatar, Kuwait, and Oman. Oman has Google Cloud. Saudi Arabia has Alibaba Cloud and Oracle Cloud. UAE has AWS Cloud and Azure Cloud. In Saudi Arabia, there are even private clouds. Prisma Cloud can even integrate with your private cloud. You can integrate your on-premise cloud.

Prisma Cloud can protect the full cloud-native stack. It is great, and it can solve your needs from a security point of view. The whole purpose of Prisma Cloud is to scan vulnerabilities.

Prisma Cloud's security automation capabilities are good. For example, you can define a policy for virtual machines. The policy hits an API and scans all your virtual machines. It can identify a virtual machine that is not supposed to have access to the Internet, but its ports are open. If you have set the rules, it can also remove the access of the port or the VM to access the Internet. This capability is definitely there, but it is based on the defined rules and policies and how you do the configuration.

Prisma Cloud provides good visibility. The dashboard or UI is user-friendly. You get a holistic view of your entire infrastructure. 

Prisma Cloud integrates security into our CI/CD pipeline at the resource,  component, and infrastructure levels, but at the application level, it is limited. For application-level security, you need to do something else. You need to have an additional capability or additional security solution.

It provides a single tool to protect all of our cloud resources and applications, without having to manage and reconcile disparate security and compliance reports.

It provides risk clarity at runtime and across the entire pipeline, showing issues as they are discovered during the build phases. It discovers issues at the scanning level. It also has the capability to rescan. For example, if you have discovered an issue or vulnerability, after resolving it, you can rescan the same resource to identify whether it has been mitigated or not.

Prisma Cloud has reduced runtime alerts by 60% to 70%. It has also reduced alert investigation time by 60% to 70%. With these time savings, you also save money. By preventing any vulnerabilities or threats, you also save your organization's reputation.

It has a feature for customized security policy. I implement it in banking, health insurance, and other sectors, and every organization has its own customized policies and procedures. In Prisma Cloud, you can customize policies, and based on that, you can do monitoring. 

It has multiple capabilities, such as threat detection and remediation. You can even orchestrate. For example, you can set a rule that a specific set of users need to have XYZ access. If any user is identified as having an additional level of privilege, which he or she is not supposed to have, Prisma Cloud can scan and identify it. If you have set the policy, it can also do mitigation. It can remove the access accordingly.

One major observation is that it is not possible to implement Prisma Cloud on-premises. This is the limitation. Prisma Cloud itself is on a cloud. It is sitting on AWS and Google Cloud. It is a SaaS solution, but some of my clients have a local regulatory requirement, and they want to install it locally on their premises. That capability is not there, but government entities and ministries want to have Prisma Cloud installed locally.

It is stable. It is a leading product.

It is a SaaS-based application, so we need not to worry about scalability. It is their responsibility. They have to ensure its scalability and high availability.

From what I know, their support is good enough. They meet the SLAs. They have been good so far. That could be because they are new in the GCC market, and someone from Europe or the UK might have different feedback. 

I did not use any similar solution previously.

We provide consultancy. We do the implementation but with the support of the vendor. It is not just about buying the product. It is about how you design and configure it. We ensure that the implementation is done as per the defined design.

The key point for a successful product implementation is how you configure it and what is your use case. Every client has different requirements and different use cases. It depends on how you drive it. You need to define the use cases, the policies, and the procedures, and you need to ensure they are aligned with your business objective. You may have the best product in the world, but if you do not know how to configure it based on your use cases and your environment, it will not work for you. You will have vulnerabilities in your environment even after you have invested millions.

The vendor takes care of the implementation, and we validate and guide them with the implementation.

In terms of maintenance, it is not a set-it-and-forget-it solution. It is based on your IT environment. Generally, small organizations do not use a CSPM solution. It is used by mid to large organizations. In such organizations, there are multiple changes in the IT resources. The environment is agile. Every day you add something or change something, and you need to ensure that it is integrated with Prisma Cloud. It is an ongoing operational activity.

We evaluated multiple products. Zscaler was one of them.

My clients are quite happy with this solution. Some of my clients are also based in the UK and Europe. So far, it has been good. It met their expectations. Their use cases are met, and they are able to monitor all their infrastructure. It has been good so far, and it worked for all the generic or standard use cases. That does not mean that it is going to solve all the use cases for all customers. If you want to go for a CSPM solution, you need to do a technical evaluation.

If you are looking into implementing a CSPM solution, I would advise first understanding your existing cloud landscape or your on-premise landscape. Understand your local regulatory requirements and local laws. After that, define the use cases. Define what exactly you are looking for and then go to market and evaluate different products. You can check whether there is an integration with AWS, Oracle, Alibaba, or any other cloud. If your regulatory requirements are that you cannot host your solution outside your country or you need to have it on-premises in your data center, not someone else's data center, you have to choose accordingly. You cannot go for Prisma Cloud. If you do not have any such regulatory requirements, you can go with Prisma Cloud or any other solution. 

You should also understand your future landscape in terms of:

• Over the next five or ten years, how do you want to grow? 
• What is your current IT strategy? 
• How are you evolving? 
• What would be your technology? 
• Would there be any major digital transformation? 
• How seamlessly can it integrate? 

You need to consider multiple parameters. It is also about money. It should also meet your financial budget.

Overall, I would rate Prisma Cloud a seven out of ten.

I'm using the main module of Prisma Cloud, which manages security at scale in cloud environments.

Prisma Cloud offers a very interactive UI that lets you work more effectively, faster, and more efficiently. It can also be used as a dashboard for querying the cloud provider since it integrates with most of the APIs of the cloud service providers. It's a very unique tool in the sense that it lets you centralize the security control of all your cloud providers.

The first aspect that is important is the fact that Prisma Cloud is cloud-agnostic. It's actually available for the five top cloud providers: AWS, GCP, Azure, Oracle, and Alibaba Cloud. 

The second aspect is the fact that we can write our own rules to try to detect misconfigurations in those environments.

And Prisma Cloud is a single tool that protects cloud resources and applications without having to manage and reconcile disparate security and compliance reports. That's the main purpose of the CSPM module of Prisma Cloud: You can manage every cloud platform, every cloud account, from a single place, which is the Prisma Cloud dashboard. It gives you a very high overview of every asset, a full site inventory. And you can see the context as well as the severity of the errors that have been raised on each service and asset that has been deployed in the cloud.

In my experience, Prisma Cloud is a valuable asset for enterprises that tend to have a lot of cloud-native applications and that wish to secure, and take control of the security posture of these applications. One of the most important considerations is that Prisma Cloud is a product from Palo Alto Networks, a company that invests heavily in cyber security. There are a lot of features that have come out over time. In the beginning, Prisma Cloud was known for its CSPM capabilities, but today, Prisma Cloud is doing a lot of things that are very beneficial for cloud-native applications.

There are a couple of things that can be enhanced. The first is the coverage that Prisma offers. Today, there are hundreds of built-in policies for AWS and Azure, but GCP and Oracle are not covered as much as AWS. There is a lot of work to do on that part. There is, obviously, a tiny bit of favoritism towards AWS because it has the most market share. It's logical, but the other cloud providers are not as well covered as AWS.

The second issue is the alerting process. Today, it does monitor the resources—and I'm only speaking on the CSPM side of things. Prisma Cloud scans the environment and checks if there are misconfigurations, but it lacks context. There is a real lack when it comes to taking into consideration how the application was designed. For example, you can have an application that is deployed with an open S3 bucket, which is one of the most basic services in AWS. Prisma will tell you that there is a high-severity alert because, with that bucket, there is a possibility of having your data extracted. But sometimes, the data inside those buckets is actually public. So, the process lacks some intelligence.

I've been using Prisma Cloud by Palo Alto Networks for 10 months.

I'm using the SaaS version which is running on Palo Alto's infrastructure, so I've never encountered instability. 

There is some patching behind Prisma Cloud when Palo Alto delivers new features so there are some "patch intervals," but most of the time, Palo Alto does notify you when something like that is coming up. It will say, "Hi. This Friday, the application will be unavailable from 6:00 PM to 7:00 PM." But it is not very disturbing at all.

Because I'm using the SaaS version, there is no issue with scalability. It all depends on the credits and the amount of money that you have put into the tool. Aside from that, you can use it to onboard any cloud account no matter how many resources are in it.

I have contacted their tech support many times, and they are pretty quick. They are very invested and proficient. I get answers within a day or two, at most.

Sometimes, when an issue becomes pretty complicated, it can span a week because it is transferred to different people.

Positive

I did not use another solution before Palo Alto.

We have definitely seen ROI in that using Prisma Cloud is an eye-opener regarding cloud security. In general, Prisma Cloud helped us see a lot of blind spots that we left when designing applications. There were a lot of security misconfigurations that we wouldn't have been able to spot without Prisma. The return on value is in the securing of the applications that we are deploying, as well as through a better understanding of the types of issues in the type of environment.

The cost is run by credits. You can allocate them as you wish, so there are no issues there. I believe the credits, licensing, et cetera, are based on the size of the enterprise that is buying the product.

There are no additional costs beyond the standard fees.

Wiz was one of the tools we looked at. I was not the only one who made the choice, but we went with Prisma because of its capabilities as well as the support. We are investing a lot in Palo Alto Networks, meaning we use a lot of their products, so we know the enterprise itself. We know the quality of their catalog of services.

My advice is to take your time before going the CSPM route. Look at your environments and inventory everything in it. There is, obviously, no shadow IT in the cloud. It's very easy to get an inventory of the resources you are running on. Get an overview and see if having a powerful CSPM at your side is really a need. There are a lot of open-source solutions that can do the job for smaller environments.

From what I understand, Palo Alto is trying to push Prisma Cloud to become more than a simple CSP tool, since it offers the ability to cover the global environment of cloud applications, such as doing scanning and infrastructure-as-code, and managing IAM, rather than doing it directly in the cloud provider. They are trying to centralize things.

It can also be used to manage containerized applications. It can do runtime security in container-based managed services of cloud providers, such as EKS (Elastic Kubernetes Service) which is a service managed by AWS. You can rely on Prisma to put an agent in such environments to monitor and supervise the security. You can also use it to scan the container images that are stored in repositories, whether they are on-premises or in the cloud. I've heard that Palo Alto is doing a lot of things like this, but as of today, I'm only using the CSPM part.

And in terms of security automation capabilities, I've used Checkov, which is the tool they are using for scanning specialized code like Terraform. In its origins, Checkov is an open-source tool and I've been using it with my clients by deploying it in CI/CD chains to scan, automatically, the code that is pushed inside repos and deployed in the cloud. But I have never used the Chekhov that is built into Prisma Cloud.

Similarly, I know Prisma offers the possibility of auto-remediation, but I have not enabled this option. It could be a bit dangerous because there is the context and a lot of things to take into consideration before blocking something, before deployment or after deployment. So, I have not used its preventive actions.

The solution provides visibility into complex or distributed cloud environments, but I can think of a couple of scenarios where clients might not think the same. It supports the top five clouds, but if you are using another cloud provider, you won't be able to use Prisma Cloud for that instance. You would be able to use the Compute module, but it would be very hard to use the CSPM capabilities on such a cloud provider since their APIs are not working with Prisma. But if you are using the most commonly used clouds, Prisma Cloud is a very valuable asset.

Prisma Cloud is a very powerful tool and it can be used in various scenarios, but it doesn't cover everything. You might choose a cloud provider that is not supported or prioritized by Prisma. If you are using Oracle Cloud or Alibaba, you might want to get another solution, maybe one that comes with better policies and a better investment in those technologies.

Aside from that, Prisma Cloud is a good solution if you are using a mainstream cloud provider. Prisma Cloud can help enhance your security posture. Because it's a Palo Alto product, you can be sure that there is a lot of maintenance behind it. The product will be able to keep up with the market. They will keep the features coming and it will continue to be a better product over time.

It is pretty easy to onboard accounts with Prisma Cloud. We use Prisma Cloud Compute and Prisma Cloud policy management. The latter is our primary solution and we use Compute to manage our container security, including threats and vulnerabilities. But we primarily focus on managing the policies for our entire cloud configs, internal threats, and network patterns.

For our market requirements, we do need several other services to be maintained for the perfect security posture. For example, one of the primary resources that we are using in our cloud is EC2 instances. That does need some primary security features, like security groups with proper closures, and proper networking with our firewalls. To make sure all of these premade configs are working, Prisma Cloud helps us to identify whenever any deployments meet up with our cloud. It is helpful with our singular architecture.

Prisma Cloud is very helpful with a full native stack. We don't want to leverage any of the resources directly. Instead, Prisma provides us with the services to automate and increase security posture without any internal agents to run it. Other products have internal agents to run with our cloud to help with the security posture of that cloud, but Prisma does not do that. It has a very simple mechanism to onboard the accounts with their console, where we can use the IAM to scan all of the accounts and identify threats and config mismatches.

The solution has also been helpful when it comes to our investigation times because we have fully automated it with our ticketing system. We use ServiceNow and whenever there are any alerts from Prisma Cloud, we have it configured so that they go directly to ServiceNow. That means the user can identify their incident and can resolve it based on the priority of service level agreements. When they do remediate an issue, Prisma Cloud will resolve the alert within Prisma Cloud and ServiceNow will close it on behalf of the user.

Prisma Cloud saves a lot of manual effort that we had to do within our cloud organization.

Prisma Cloud policy management is more valuable than Prisma Cloud Compute. While we use Compute often, we are not leveraging container security as much. We have limited resources for the containers in our cloud environment. Sooner or later, we will launch multiple container features in our cloud, but right now, we don't have much scope so we haven't had a chance to explore the Compute side much.

The solution supports multi- and hybrid-cloud environments. It has multiple cloud strategies like GCP and Azure. It has policy fixes for those cloud environments. We leverage it for AWS and it's important that we can use it for that singular platform.

Prisma Cloud also has log retention periods for the alerts and policies that are triggered, for each account. For example, my account has a specific policy that is high severity. If I need to further investigate, I can do that investigation in the upcoming 30 days. After 30 days, the logs of the triggered alert are not retained by Prisma Cloud on the Palo Alto network.

It also provides us with a single tool to manage our entire cloud architecture. In fact, we are using a multi-account strategy with our AWS organization. We use Prisma as a single source of truth to identify high- or medium-severity threats inside our organization.

Another feature is the automation. It has certain types of policies that can identify network-based threats, such as unusual port or protocol activities. It has tremendous machine-learning capabilities to identify patterns.

When it comes to automation and machine learning, it still needs some more work because sometimes they can give false positives.

In addition, since cloud services are coming up with new features and solutions, Prisma should also keep up with the same level of security. For example, at the previous AWS Summit, numerous services were introduced. Our businesses wanted to develop some of the services with the features in our cloud, but Prisma hasn't come up with any new APIs. Prisma needs to keep up with quick changes as soon as any cloud platform comes up with a new invention.

And one of the main backlogs in their development is in the area of integration. For example, we have ServiceNow in place for ticket management, and Prisma Cloud is supposed to send closure emails for incidents. But from time to time, it fails to do so. We have several other mismatches between Prisma Cloud and ServiceNow. So we have had to focus on incident management.

Integrations with third-party vendors, such as ServiceNow, Slack, and other ticketing tools that Prisma supports have full automation, but there are still some bugs to fix. We see failures from time to time. When our team fixes vulnerabilities or threats, they still see the incidents in place, which makes them liable to pay for SLA failures. Those kinds of things can be avoided if we have fully fledged event management integration with those tools.

They also need to increase their log retention periods to allow further investigation. Sometimes it takes time to check with asset owners and do deep investigations. Because we have numerous accounts, it can take time for asset owners to investigate each and every alert. The log retention period is one of the cons. 

I have been using Prisma Cloud by Palo Alto Networks for more than a year. I started in my role as a cloud security engineer about two and a half years ago, and Prisma Cloud is one of the CSPM solutions that we use.

I use Prisma Cloud every day. It is one of the primary tools I need to monitor and manage the security of our cloud environment. I use it very extensively and my team members use it for identifying threats and managing them with the asset owners.

In terms of performance, they have cloud releases of security features during the first week of every month. Whenever they release new policies, all of a sudden it starts to throw multiple alerts within our console. It is a bit annoying for the DevOps team, but from a security perspective, it is a useful process. But a pre-announcement or pre-testing of the alerts would be a better way for them to do this, instead of creating 50 or 100-plus alerts for our DevOps. We are suggesting better pre-testing of new policies.

It is pretty scalable. When we deploy new AWS accounts within our organization, it applies the same security posture policies to those accounts as well. We can see the security postures it recommends whenever we onboard any new accounts with our organization. The scalability is very good with the management it provides for any accounts we onboard.

Palo Alto Networks is one of the fastest-growing security products in our organization.

From time to time we experience delays in support for critical scenarios. They do have engineering teams at the backend that work with the policies. I understand that. But I'm expecting a more responsive service on their side because sometimes it can even take a week to get a response back from the engineering team.

When we go through the toll-free number to submit a case, they suggest that they are working on it, but sometimes they don't give solutions for such cases for some time.

Positive

We used AWS native security, which is Security Hub. They have their own benchmarks which we leveraged. But we wanted to see more variables with the policies to have a stricter and more secure cloud environment so we moved to Prisma Cloud.

We have been customers of Palo Alto Networks for a very long time because they have several security products, including firewalls that we use in our organization.

The deployment was very straightforward. We were able to onboard IAM policies from our AWS master account to our console with a few clicks. We were able to see that Prisma had started to onboard and ingest for alerts and asset variations within our inventory.

We have a security architect and Palo Alto has a security architect. We deployed it together with the support of a Palo Alto engineer.

When we started using Prima Cloud a year ago, we had 7,000-plus alerts. We went through many of the policies that resulted in numerous false positives and we went through the RQL (Resource Query Language) queries that were not applicable to our environment and that created false positives from their side. We reported them with the details via their case submission. They checked on them and they modified some of the alerts as a result of our request. They are progressing with their changes. We have reduced to 500-plus alerts in the past eight months and we are in good shape in terms of security posture.

Overall, I would rate Prisma Cloud at seven out of 10. It has the scalability and easy onboarding where we can onboard an organization with a few clicks and the integration part will take care of the rest. I appreciate that. But the log retention and integration with third-party solutions need improvement.

We are running multiple VMs on GCP and use Prisma Cloud to monitor the CICD pipeline for any issues. If there are issues, we raise tickets in Jira. 

Prisma Cloud keeps our servers secure in most cases. We get the most value from the alerts when we have security issues. The runtime protection is also a good thing. We're also exploring the possibility of automating the CICD pipeline. 

We realized the benefits immediately after we integrated or connected our account.  We used to get a lot of false positives, but we took steps to fix that. In most cases, we get help with that. It doesn't take much time to identify the problem.

Prisma covers the full development cycle and helps us a lot. We use it in the development phase and get a good value from it. We catch issues before the production stage.

Prisma Cloud's real-time detection and monitoring of our entire system is the most useful. We also value Prisma's runtime protection and security alerts.

We like Prisma's preventative approach to cloud security. It alerts us about security issues before they become a problem. If our cloud system has outages, our clients may switch to another competing platform. With the preventative approach, we can ensure our servers are always up. 

The UX part of Prisma's user interface could be simplified and the metrics tool should be highlighted more.

I have used Prisma Cloud for three months.

Prisma Cloud is stable. We haven't had any downtime, crashes or lag. 

Prisma Cloud is highly scalable. 

It was easy to deploy and integrate Prisma Cloud. We connected to our account and chose the platforms and environments we have. When we first deployed Prisma Cloud, we didn't know much about it, so it took 30 minutes to an hour. Deployment was a one-person job. It doesn't require any maintenance on our end because it's a cloud platform, so we just receive alerts. 

I rate Prisma Cloud 10 out of 10. The first thing a new user should do is check the documentation and the official YouTube videos. You can always contact their technical support if you have any issues. I don't think they will require technical support because the videos are useful and the documentation is also good. You can also easily integrate and see the reports on the UI. 

We use the compliance and vulnerability management modules. We are a bank and have certain controls in place. My business unit is cloud-only, and we need to enforce controls, and for audit purposes, we need to collect evidence of control enforcement. We have a number of controls around cloud resources. We configure Prisma to enforce those controls pretty automatically. Prisma generates evidence of the controls that we can present to auditors when we are audited. If we didn't solve this problem, we could lose our license.

It's hard for me to say how Prisma has improved our organization because it was implemented before I joined. But given the number of security controls that have been automated with Prisma, we have managed to achieve a fair amount of manual cost reduction for our control testers. And the automation and integration capabilities of Prisma have allowed us to save a lot of engineer time on evidence. Without Prisma, we would have to do all these things manually. Overall, it results in a huge FTE reduction.

With the number of controls that need to be tested, we would be talking about a team of around 100 people. With the Australian salaries, Prisma is probably saving us $1,000,000 to $2,000,000 a year.

The framework to configure controls is pretty good; it's pretty sophisticated. We can implement a fair amount of testing for a fair number of controls.

It's vulnerability management is quite good, and its integration functionality is something that we have found to be pretty capable.

We also use Twistlock for container security, which is good.

And Prisma Cloud's security automation capabilities are quite good. We use the periodic scanners, and we feed Prisma filings into our control evidence management system. They tick all the boxes for us.

One thing that is missing is Cloud Run runtime security—serverless. That would be great to have in the tool. It's not that easy to have Cloud Run in specific environments.

We have also found that Google Security Command Center has a little bit better coverage for GCP because it's native. That's why we pay for both tools. But ideally, we should only need one tool. Prisma Cloud's coverage of GCP is okay, but a little better coverage would be better.

Our cloud environment is complex, and Prisma doesn't cover all aspects of it. We don't rely on Prisma for any kind of security discovery. We just rely on it as a control-test and automation tool.

We get a few alerts in Prisma, and it allows us to trace any violations back to the source. It's a pretty straightforward interface.

Another thing that we have found useful with Prisma is its Jira integration. When our integration finds a new alert, it creates a ticket in Jira, so it's fully visible and tracked, appearing in all the dashboards.

I joined this branch of the bank six months ago, and Prisma is my portfolio now.

It's stable enough. I can't remember any outages of Prisma Cloud.

It's a SaaS service and is licensed both for our team and for the enterprise. On our side, there are 1,000-plus user licenses. We have five or six integration points, so in that regard, it's not humongous.

We are growing extremely quickly, and Prisma Cloud provides all the required services without any need for us to do anything to scale. It's pretty elastic. We'll probably grow by 10 times in the next couple of years. So far, I don't have any doubts that Prisma will support us.

I've never dealt with their technical support. Prisma Cloud just works.

Our bank itself is huge and uses all sorts of solutions. My business unit is quite young, it's only three years old, and I don't think there were any solutions in this space.

Deploying it was pretty straightforward compared to other tools. We implemented a fair number of compliance rules pretty quickly. I recently participated in some integration activities, and integration-wise, it was very straightforward.

As for maintenance on our side, there really isn't any. We periodically need to review the controls being tested and the control automation, to make sure that they're aligned with changes in the controls. Other than that, it's pretty maintenance-free.

We have managed to save a fair amount of money and effort in hiring manual testers. That's what automation does for us.

I wouldn't mind if it were cheaper. We are spending a fair amount of money on Prisma Cloud. It's probably okay, but, funnily enough, banks don't have money. Periodically, we have cycles of cost-cutting, so if we could save on Prisma Cloud, that would be great.

We don't use Prisma for build and deploy, we use another set of tools. Right now, we are doing our internal due diligence to figure out if we can replace all of those with a single tool, whether it's Prisma or any other tool. We don't know at the moment.

It's very hard to attribute any kind of runtime alert reduction to Prisma Cloud as we use a whole zoo of tools. Prisma is just one piece of the puzzle. We don't have too many runtime alerts thanks to the joint work between our build tools, deployment prevention security tools, and Prisma.

While it's a good tool, you need to be mindful of serverless because serverless runtime security is tricky and, unfortunately, Prisma doesn't do too much there. Other than that, it's a good tool.