Prisma Cloud by Palo Alto Networks Reviews

I work with Palo Alto products, including their firewalls, VM-Series, CM-Series, hardware, and Prisma Cloud by Palo Alto Networks. I recommend Prisma Cloud by Palo Alto Networks primarily for financial services, FSI, and energy companies.

The threat detection feature in Prisma Cloud by Palo Alto Networks integrates with cloud-native controls like AWS GuardDuty and similar services on Azure and GCP. It also brings its own threat intelligence from Unit 42 and supports external intel feeds like VirusTotal. Multi-cloud compliance monitoring leads to a normalized view and can reduce workforce requirements.

The cost of Prisma Cloud by Palo Alto Networks is too high. I would also appreciate the addition of NLP to reduce the learning curve and make configuring queries more user-friendly.

I have been working with Prisma Cloud by Palo Alto Networks since it was called RedLock in 2019.

The initial setup is straightforward. Day zero involves cloud integration following an admin guide. Day one involves policy tuning, customization, and configuring compliance policies like GDPR.

The ROI is challenging to quantify. While there is tangible reduction in workforce needed, exact cost savings cannot be easily measured.

Pricing and licensing are expensive. There are different experiences with ROI, and exact cost benefits are hard to quantify.

If you have a multi-cloud environment, Prisma Cloud by Palo Alto Networks is essential for reducing costs and normalizing outputs. In a single-cloud, limited setup with good automation, you might not need it. I rate the overall solution at seven to seven and a half.

We are running multiple VMs on GCP and use Prisma Cloud to monitor the CICD pipeline for any issues. If there are issues, we raise tickets in Jira. 

Prisma Cloud keeps our servers secure in most cases. We get the most value from the alerts when we have security issues. The runtime protection is also a good thing. We're also exploring the possibility of automating the CICD pipeline. 

We realized the benefits immediately after we integrated or connected our account.  We used to get a lot of false positives, but we took steps to fix that. In most cases, we get help with that. It doesn't take much time to identify the problem.

Prisma covers the full development cycle and helps us a lot. We use it in the development phase and get a good value from it. We catch issues before the production stage.

Prisma Cloud's real-time detection and monitoring of our entire system is the most useful. We also value Prisma's runtime protection and security alerts.

We like Prisma's preventative approach to cloud security. It alerts us about security issues before they become a problem. If our cloud system has outages, our clients may switch to another competing platform. With the preventative approach, we can ensure our servers are always up. 

The UX part of Prisma's user interface could be simplified and the metrics tool should be highlighted more.

I have used Prisma Cloud for three months.

Prisma Cloud is stable. We haven't had any downtime, crashes or lag. 

Prisma Cloud is highly scalable. 

It was easy to deploy and integrate Prisma Cloud. We connected to our account and chose the platforms and environments we have. When we first deployed Prisma Cloud, we didn't know much about it, so it took 30 minutes to an hour. Deployment was a one-person job. It doesn't require any maintenance on our end because it's a cloud platform, so we just receive alerts. 

I rate Prisma Cloud 10 out of 10. The first thing a new user should do is check the documentation and the official YouTube videos. You can always contact their technical support if you have any issues. I don't think they will require technical support because the videos are useful and the documentation is also good. You can also easily integrate and see the reports on the UI. 

Our environment consisted of a cloud-native stack, including Kubernetes, OpenStack, and OpenShift, running alongside additional virtualizations. This hybrid setup required securing both the cloud-native components and the virtualized instances. To address this challenge, we implemented a comprehensive CI/CD pipeline with cloud security in mind. Following vendor code pushes to our environment, we use rigorous scanning and verification procedures to ensure the code's safety before onboarding. Once onboarded, Prisma Cloud provides continuous posture management and security monitoring.

Our current Prisma Cloud deployment utilizes the Registry Scan, Runtime Protection, CI/CD Integration, and Vulnerability Management modules. While we have opted for the Complete Edition, it does not include Posture Management, a feature frequently inquired about by our customers. Currently, Posture Management is only available in the SaaS model, and we are utilizing the on-premise edition, also known as the Complete Version.

We are a system integrator for the telecom sector.

Clients utilizing cloud-native environments often face challenges in scanning and securing their containerized solutions and clusters. Prisma Cloud offers a comprehensive solution, providing end-to-end protection for these clients. 

Prisma Cloud is a crucial component of our clients' security, particularly for their billing environments.

It offers comprehensive security across multi-cloud and hybrid cloud environments. This is particularly valuable for hybrid environments because it unifies all security needs under one platform, simplifying management and providing a more consistent approach.

It helps us take a preventative approach to cloud security. It is a comprehensive solution with a lot of features.

We have improved our clients' organizations by offering unified monitoring that directly connects their SIEM, SOAR, EDR, and XDR within their environment. The benefits are usually seen within six to eight months.

The Prisma Cloud SaaS version's comprehensiveness secures the entire cloud-native development life cycle.

Prisma Cloud delivers comprehensive visibility and control over our client's cloud environment, regardless of complexity or distribution. It provides a complete map of the environment, visualizing traffic flow for enhanced understanding.

The touchpoints in the DevOps process are seamless. We can integrate them with our registry and the CD platform, so there are no challenges during automation.

Integrating with a CI/CD pipeline and incorporating a vulnerability assessment process are highly effective features, especially when combined with runtime protection. This synergy provides a comprehensive view of how our application is performing while it's running, which is immensely valuable.

Prisma Cloud's Complete edition is not a complete suit. Only the SaaS version includes posture management and IDE integration.

The visibility on the SIEM needs to be streamlined so we can get the data without any issues. 

I have been using Prisma Cloud by Palo Alto Networks for two years.

Prisma Cloud is stable.

Prisma Cloud scales well. In addition to our main site, we recently added Prisma Cloud to our disaster recovery site.

We acquired the services of their technical support several times which was helpful.

Positive

I have experience with Trend Micro Cloud One as well. The pricing is what differentiates Trend Micro Cloud One from Prisma Cloud. 

Initially, we deployed Prisma Cloud quickly, focusing solely on the containerized environment. The remaining deployment across the entire environment took two months to complete. From the solution's perspective, the deployment is straightforward. Some customers have complex environments but that has nothing to do with the solution itself.

Three people were required for the deployment.

Prisma Cloud licensing works on credits.

I would rate Prisma Cloud by Palo Alto Networks a seven out of ten.

Maintaining Prisma Cloud is generally straightforward.

We have Prisma Cloud deployed in a single department used for the billing system in our hybrid cloud environment. We have eight users.

While Prisma Cloud Complete offers runtime protection, organizations seeking a comprehensive cloud security solution should implement Prisma Cloud SaaS. 

We use Palo Alto to secure our network.  We are using the PA-820 firewall and all of the Prisma Cloud modules. It helps reduce our vulnerability to hacking and any malicious attacks on the network. With that appliance, we can minimize those things and control what goes in and out 

We have reduced network calls by 80 percent. The benefit of Palo Alto is the ability to create security across multiple levels and protect against hacks and vulnerabilities. You start to see these benefits within one or two days after implementing these devices. 

We are also using a honeypot to detect a target on our site. Once we have the target, we are blacklisting those using the firewall. The solution has reduced our investigation times by about 50 to 75 percent. It minimizes the alerts, so we're seeing fewer.

I like Palo Alto's threat protection and Wi-Fi coverage. It has advanced features like DNS security and sandboxing. The automation capabilities are excellent.

The UI could be improved.

I have been using Palo Alto for almost eight months.

Palo Alto provides good support and doesn't take long to resolve an issue. 

We previously used Cisco ASA. We decided to switch because we wanted to adopt a UTM approach in which all the logs and reports go to a single dashboard. Everything is visible in Panorama, which comes with the Palo Alto appliances. We need to purchase a separate license for Panorama, but it's there. 

There are many competitors, such as FortGate, but Palo Alto is better. FortiGate has some advantages in terms of throughput. You can get better throughput if you enable all the engines in parallel. However, I've heard about Fortinet devices being compromised, but I've never heard of that happening with Palo Alto. 

I rate Palo Alto Prisma Cloud nine out of 10. Everything is neat, clean, and easy to use. However, when you commit changes through the UI, it takes some time to load on every system. 

From a business perspective, our clients use Prisma Cloud by Palo Alto Networks to meet compliance and get more visibility into the cloud.

When people start their cloud journey, they do it per their business needs, but eventually, they reach a point where many infrastructures are created. Still, there aren't enough governance factors, so they buy Prisma Cloud by Palo Alto Networks for compliance from a government perspective. They also want to know how much infrastructure has been created and their exact locations, including their vulnerabilities against threats, and get more visibility into those threats and vulnerabilities.

We work with all models of Prisma Cloud by Palo Alto Networks, including data, container, and IM security.

Our clients are medium and enterprise clients, as the solution would take too much effort for small-sized businesses or clients.

What I found most valuable in Prisma Cloud by Palo Alto Networks is the VAS, such as the web application and API security, primarily because the solution goes in tandem with Kubernetes or the containers. This is why I feel that VAS adds a lot of value, mainly because it gives visibility through the application layer and threat detection features.

Another valuable feature of Prisma Cloud by Palo Alto Networks is the CSPM, simply because it's essential to understand what threats you'll face when starting your cloud journey or in the middle of your cloud journey.

The VAS and the CSPM are the most valuable features because they work in tandem to provide users with the required visibility.

A third valuable functionality you can get from the solution is the ability to investigate and build the correlation between the network, IAM, and other configurations. I saw a new level of maturity in this aspect from Prisma Cloud by Palo Alto Networks, which I didn't see from other solutions or vendors.

The solution also provides security for multi and hybrid-cloud environments. You can do AWS, Azure, etc., and even on-premises; wherever Kubernetes is supported, Prisma Cloud by Palo Alto Networks could support it.

Prisma Cloud by Palo Alto Networks also has a preventative approach to cloud security because it acts as a defense through prevention and banning.

I also saw that the solution is comprehensive in securing the entire development cycle, such as in building, deployment, and running, because it provides a dedicated CCS (Cloud Core Security) functionality, which is leverage.

Prisma Cloud by Palo Alto Networks has done great at the identity or ID, filter, VAS, and CCS levels.

Many more aspects can be covered in the cloud, but not all of them are addressed by Prisma Cloud, which can be one area for improvement.

For example, Prisma Cloud covers computing, network layer, identity and access management, and configuration management. Still, if you're looking for other aspects, such as ones beyond the cloud, the solution may not cover those. It can cover host containers, serverless and embedded apps, and PaaS, or aspects under computing, network connectivity, and identity and configuration management. Data may also be covered, but there is no data governance here in India. Storage may also be included, such as self-service GCS, but I did see that the solution is not very comprehensive, though you may not need all other aspects. Currently, Prisma Cloud only focuses on compute networking, data governance, and IAM, which could be improved.

As for the security automation capabilities of the solution, it is good, but there's still room for improvement because, at times, the access itself is not very consistent. My company has faced certain issues where it would have been better if the whole process, hub, or tool were more straightforward.

I also mentioned that the data governance functionality is not supported here in India, but Palo Alto Networks did not give an explanation about it.

My company also utilized GCP, and it was simpler. However, it did not have the intelligence of Prisma Cloud by Palo Alto Networks. Though Prisma Cloud by Palo Alto Networks provides excellent security, is a pioneer in this space, and knows what it's doing, from a user perspective, it would have been better if it was a little easier to use. Right now, my rating for the solution based on ease of use would be a four out of five or a nine out of ten.

In terms of Prisma Cloud by Palo Alto Networks providing visibility and control regardless of how complex or distributed cloud environments become, it does for complex and distributed environments in the networking aspect. However, this is not true in the identity aspect. The solution only manages Okta, Azure, and AD, but it does not support the most popular Google Workspace, so that is another downside of Prisma Cloud by Palo Alto Networks.

Prisma Cloud could also be improved by adding Google Workspace as an identity.

I also mentioned previously that the user experience in the solution could be better. It could be easier. For example, Elasticsearch and Chronicle both have SIEMs, and they made it easier for people, both cognitively and intuitively. Prisma Cloud by Palo Alto Networks talks about CWP, CSPM, SIEM, and DNS, for example. Still, if you look at its console, you won't find any of those terms mentioned, so a person who comes from the presentation to the theory to the practical world may not be able to find a correlation. If Prisma Cloud by Palo Alto Networks has some diagram that explains and allows users to understand all these, it becomes easier. Otherwise, it'll be a little steep for somebody to start the journey with this solution. This also means you need some security knowledge before you can even begin using Prisma Cloud by Palo Alto Networks.

The setup process for Defender in the solution also needs improvement as it takes a day or two, but that is not even mentioned in the portal, so many customers think that there is something wrong during the setup, only to eventually realize that it is normal and that it'll be okay in two to three days. Another example is setting up Auto-Defend in Prisma Cloud by Palo Alto Networks, where you'd think your AWS system was malfunctioning when the delay is caused by the logs not being updated faster. There should be documentation that explains the setup process and how many days it usually takes to complete the setup.

It's the same for onboarding, as it could take several days, so if the process could be made easier, that would help the customers. My company has received feedback that customers have generally found it challenging to start using Prisma Cloud by Palo Alto Networks, though it could still depend on the person.

We've worked with and used Prisma Cloud by Palo Alto Networks for over two years.

Prisma Cloud by Palo Alto Networks has mostly been stable. However, there were some instances when it was not as stable, particularly the Defender setup, where it did not work for three days, so my team had to escalate, and then it suddenly worked. The issues usually happen during implementation, but you will not have as many challenges after it is implemented.

Stability-wise, the solution is a six out of ten for me.

Prisma Cloud by Palo Alto Networks is scalable, mainly because it is cloud-based.

My rating for the technical support provided by Prisma Cloud is four out of ten because it takes two to three days before support replies to you, and sometimes, you do not even get a valid or contextual answer. Sometimes, the team does not respond, and you do not even know if you will get a response. The technical support team has not been very friendly.

These are why I cannot give Prisma Cloud support a high rating.

Neutral

The initial deployment process for Prisma Cloud by Palo Alto Networks could be straightforward. Still, it becomes complex because of missing documentation that explains what happens during implementation and onboarding. Not everyone understands what needs to be done, so the process might look complex when it's not very complex.

The process requires you to onboard your account, set up your defenders and applications, and update specs and costs, but the available data could be more intuitive.

Deploying Prisma Cloud could take more than a day because the logs already take one day, plus it also depends on the number of hosts and containers.

My company is a reseller for Palo Alto Networks, so it does the implementation, POC, and setup for customers.

In terms of Prisma Cloud reducing runtime alerts overall for clients, that would be up to the clients or customers. The solution is configured, so if you get a lot of alerts, you have to work towards burning down and making it contextual to your existing setup and what your business requires. From an implementation perspective, my company will set up the defaults, wait, and then work with the customer on how often they want to burn it down and contextualize it to their needs or requirements. Reducing runtime alerts is essentially up to the customers because if the customer gets a lot of alerts and does not spend time to make them contextual, then that customer will continue to get alerts. It is essential to make it contextual to your system if you want to reduce the alerts you receive.

Here is how I would rate Prisma Cloud by Palo Alto Networks: as a pioneer solution, and as it is cloud-based, and considering the security perspective, the solution is an eight out of ten, so the rating is high. However, in terms of setting it up and implementing it from a customer's point of view, Prisma Cloud by Palo Alto Networks becomes a seven out of ten. Not all things often work, and you still have many features you need to explore as a customer. Support for partners or the portal could also be better, where it should give more information, so the rating becomes a five out of ten. Overall, my rating for Prisma Cloud by Palo Alto Networks is a seven out of ten based on experience, but at this point, it could still be the market leader.

My company is a reseller, partner, and implementer of Prisma Cloud by Palo Alto Networks.

We initially wanted something to protect our infrastructure. We acquired Prisma Cloud, so at least our containers are secure because we already installed agents in the containers. Our infrastructure is being monitored by Prisma Cloud. Then, we started with the WAF (web application firewall) service to enable API discovery and to understand what our APs are doing.

We can protect our APIs in case of a DDoS attack. We are currently working on CI/CD integration so that we can enable Slack CLI in our pipelines. Whenever there is a vulnerability, it will automatically be produced into the Prisma cloud.

The most valuable feature of Prisma Cloud is WAF. AWS also provides web application security, but it is outside the VPC. Since the agent is already installed in the container, we can protect it directly from the application side. We have a UI-based view of the request.

If I want to know how many SQL injection attacks happened in a day, I can just make a filter. Instead of typing, I can select the filter and get the details. It's much faster, and it is very easy to find out attacks and discovery from the user's perspective.

A couple of exporting functionalities should be more user-friendly because if I want to export something, I can get a lot of data visible to that particular CSV. There is no filter for what kind of data I want to export. That is something that I have missed as someone from the management side. When we see any CVE issues, proper information, including the path, should be mentioned.

For example, in the case of vulnerable packages or images, whether a base image is vulnerable or the package under the base image is vulnerable should be mentioned. That visibility is sometimes missing there, although not every time. It took me some time to figure out what kind of issue it was trying to resolve.

For example, one issue was that an image should be run with a non-route user. Only the discussion was there, but how to validate and fix that was not there.

I used Prisma Cloud by Palo Alto Networks for around one month in my previous company. I've been using it for the past four months in my current company.

Prisma Cloud is a stable solution.

It is a scalable solution. We have more than 20 people using Prisma Cloud in our organization.

I rate the solution's one-on-one technical support session a six out of ten. The support team usually provides only a half an hour session, which sometimes is very little for us when the issues are big. However, their support through email is good. The solution's one-on-one support session should be extended by at least half an hour. Since their one-on-one sessions are based on their availability, I don't get instant assistance when I need it.

Neutral

I have previously worked on different tools like PingSafe. PingSafe is only into cloud security posture management, but Prisma Cloud has everything enabled in it. As a cloud security posture management tool, both the tools have their own advantages and disadvantages.

I can compare only one functionality, which is the CSPM module. For the CSPM module, Prisma Cloud's finding is good because it has access inside a containerized agent. PingSafe was more into the basic CIS benchmark things where we were able to identify the issues. PingSafe was also good, but Prisma Cloud has more advantages and configurations enabled.

The solution's initial setup was pretty straightforward. It's a bit complex for a new person, and some guidance will be required. However, the documentation is quite enough to reduce those things. The initial setup is neither too hard nor too easy.

The DevOps team does the solution's deployment. I was not a part of the deployment process. When I discussed it with them, they told me they had some script or documentation. They started that, and the deployment was completed in a day or two.

We are using cloud protection, virtual protection, and the CI/CD modules of Prisma Cloud by Palo Alto Networks.

The comprehensiveness of the solution for protecting the full cloud-native stack is pretty good. We need to monitor those things. We initially did all the configuration from the container or API side. Now, our work is only to monitor periodically. It has a report functionality on a mail and download basis.

Periodically, we'll receive a mail asking us if we want to work on the weekly summary of our findings. There is a rescan functionality that I can use to rescan and confirm if someone has fixed a vulnerability so that it will not be shown in the results the next time. Prisma Cloud provides comprehensiveness that covers most of the areas.

When we didn't have this tool initially, we had to run around for different open-source tools because there was no one-stop solution. We had to go for different open-source tools for different functions. Prisma Cloud is a one-stop solution that covers multiple things like API security, container security, infrastructure security, AWS cloud security, and CI/CD security. So, it's a complete package for us to look around and figure out the issues in every area.

We did not immediately realize the solution's benefits from the time of deployment. It took an initial one month to understand the functionalities and their uses. After one and a half months, we were able to identify the benefits of using these services.

The solution provides the visibility and control we need. Initially, we did some access analysis to know what kind of permissions these particular agents are running. Then, we got to know and understand the agent's particular privileges.

The solution has reduced runtime alerts by around 15 to 20%. As soon as we use any image, we decide to run the scan and get the finding immediately. We have a time window to figure out the issue.

In case of an incident, Prisma Cloud requires some maintenance. If something happens because of the tool, we have to stop those agents, rerun them, and then check the logs. Sometimes, the services are disrupted when we enable something amid permission issues. So, that part definitely requires some maintenance.

I would recommend Prisma Cloud by Palo Alto Networks to other users. Prisma Cloud is a one-stop solution where you get multiple tools within one tool. That is a great thing because you don't have to run around for different kinds of tools.

Overall, I rate Prisma Cloud by Palo Alto Networks an eight out of ten.

We are using CSPM, IM Security, and Cloud Workload Protection modules.

There are different use cases for Prisma Cloud. Our use case for the CSPM module is to assess compliance with standards such as HIPAA and GDPR, based on our current cloud CSV vendor and configuration. We need to use a CSPM tool to calculate the risk score associated with our current compliance posture.

Some of the reasons we implemented Prisma Cloud were to find the total number of assets in the compliance asset inventory and use the CSPM to assess our workload security. If we have a container environment, we can secure it using cloud workload protection. Additionally, IM Security can help us to determine if our saved credentials are exposed to the public network.

Prisma Cloud provides security for multi- and hybrid-cloud environments. This is the best use case for supporting multi-cloud vendors because, even if we have different cloud service providers, such as AWS, Azure, or GCP, we can manage and view all data in a single, consolidated screen.

All cloud service providers have limitations when it comes to cloud-native stack visibility. Prisma Cloud integrates with all CSPs, switches and correlates the data, and provides complete configuration details for alerts and incidents.

Prisma Cloud's security automation capabilities are effective, allowing us to specify our audit criteria and key configuration audit parameters to detect and automatically remediate misconfigurations. We also have playbooks to automate remediation.

It helps us take a preventative approach to cloud security. We recently received an incident alert for a resource with a security group that allows all ports, which is not a best practice. We will send a notification to the DevOps team and make a change to only allow the necessary ports. We can also automate this process to automatically remove all port access and only allow specific limited ports. Additionally, we can proactively define security keys for our servers and identify and fix vulnerabilities.

We have improved our organization in many ways. The first benefit is that we have from Prisma Cloud a complete asset inventory of all our cloud resources across all CSP vendors. This includes the number of assets and the number of VM instances currently running. This is a valuable use case, as it provides us with visibility into our entire cloud environment. The second benefit is that Prisma Cloud can help us identify misconfigured assets. This is also a valuable use case, as it helps us to ensure that our cloud resources are configured securely. The third benefit is that Prisma Cloud can help us to identify unusual access to our cloud resources. This can be helpful in identifying and responding to security threats. For example, if a user logs into a cloud instance from India and then two hours later logs into the same instance from the US, this could be a sign that the user's account has been compromised. Prisma Cloud can alert us to this type of activity so that we can investigate and take appropriate action.

The comprehensiveness in securing the entire cloud-native development lifecycle is great. We have integrated this solution with our CI/CD pipeline tools, so it scans and validates code in real-time, only allowing legitimate code to be processed further and executed.

It provides us with the visibility and control we need. At first, we may receive many alerts, but once we fine-tune them to generate genuine alerts only for legitimate traffic, our confidence in our security and compliance posture increases.

It also makes it easy to integrate our security with our existing CI/CD pipeline.

Prisma Cloud provides us with a single tool to protect all of our cloud resources and applications without having to manage and reconcile security tools.

Prisma Cloud provides clear visibility into risks at runtime and across the entire pipeline, showing issues as they are discovered. Our developers are able to correct the issues using just a few tools.

Prisma Cloud has reduced our runtime alerts by 20 percent. It reduced our alert investigation time to ten minutes. It also has saved us between 30 to 40 percent of our costs.

CSPM is the most valuable feature for any organization that runs its workloads in the cloud. CSPM can audit the current cloud configuration, identify misconfigurations, and assess risk.

If a customer is already running their workloads in the cloud and wants to secure them, Defender emails can be used to easily identify potential risks. Additionally, the CI/CD pipeline can be scanned to identify any vulnerabilities in the code that developers have written. When code is uploaded, it will be validated and only legitimate code will be applied to the production application. This means that no vulnerabilities will be present in the code.

CSPM can also be used to scan existing infrastructure for vulnerabilities.

The IM security has room for improvement. I would like more important features added.

I have been using Prisma Cloud by Palo Alto Networks for three years.

Prisma Cloud is stable.

Prisma Cloud is scalable.

The technical support is good.

Positive

The initial deployment was straightforward. All components can be deployed in one day, but the CSPM alone only takes half an hour.

Ten people were required for the deployment.

Prisma Cloud is more expensive than some other solutions, but when we consider all of its use cases, the cost averages out.

I would rate Prisma Cloud by Palo Alto Networks nine out of ten.

In terms of our location, we have different cloud service providers, such as AWS and Azure. The majority are AWS and Azure, where we have integrated Prisma Cloud. In terms of Docker and containers, we have integrated some types of labs and CI/CD parts. Therefore, we currently manage both AWS and Azure, as well as a few GCP parts, within a single console.

We have over 50 users.

Prisma Cloud requires maintenance and the OEM initially notifies us of the priority and schedule for maintenance.

We have cloud security posture management and CWPP.  We are also using Cortex, another Palo Alto product. We needed another cloud security tool to create an additional security layer on our CSPM solution. It's essential to secure our infrastructure against any zero-day attacks. 

We needed a cloud security tool to identify misconfigurations in our cloud infrastructure. We were using AWS Cloud Cover since we only had one cloud provider. We onboarded the SysTrack and were able to find the most configurations. In a short period of time, we detected the issues and got alerts.

Before we implemented Prisma Cloud, we were unable to detect misconfigurations based on the policies that we set up. Prisma has that capability. You can add custom policies, and the tool can handle the reconfiguration. 

You can also get feedback from the customer's side about custom policies that can be added on Prisma. We can see the custom policies contributed by other organizations, which has upskilled my knowledge. The primary benefit is the layer of security added to our other infrastructure. 

We started seeing the benefits immediately once the solution was fully deployed. After about a month, we could start digesting data into the tool. Then, we started enabling all the features that we secured for other organizations. After around two months, we could use the features and see the things we were unable to detect. We were able to set up remediation on the tool. Other teams like the developers and tech ops were able to get the details over Jira since it was integrated with SysTrack. 

Our development lifecycle was already prebuilt, and Prisma has absorbed it. There's nothing that Prisma doesn't cover or that isn't reported to the organization. The developers are able to see best practices for any type of resource. They secured training from the product team, and Palo Alto's developers attended it. They shared their knowledge base so we could make the right decisions about resources before making any changes to the AWS cloud.

Prisma can provide solid visibility even if your cloud infrastructure is complex. It can divide the infrastructure into different parts to give you visibility into vulnerability management, configurations, or workload protection. It doesn't matter how complex your cloud infrastructure is. Prisma can digest it and provide the right guidance.

Prisma was able to quickly integrate and onboard our account. As a fintech company, we need a cloud security tool with modules that can benefit the organization. It has a feature that gives you recurring reports for a specified period. 

The solution is handy for the team that handles the Jira tickets because it enables them to automate the tickets. We had to add them manually in the past, so Prisma has absorbed a significant chunk of their workload. It helps us to discover risks throughout the pipeline using the CWPP features. You can quickly identify a misconfiguration and resolve it. In addition to the features it adds, Prisma has helped us to solve tickets faster.

It creates an alert in under a minute. The software team receives this and notifies the owner of the resource within five minutes and resolves the issue according to the SLA. It helps us resolve zero-day cases. It would cost us a lot of money. Prisma helps us to resolve those issues promptly. 

I like Prisma's ability to integrate with other tools. We can integrate it with Jira so that when Prisma triggers an alert, it opens a ticket in Jira. That was a big selling point for the product. There's a feature called the guest custom template that allows you to trigger alerts in Jira based on the template. That can also be added as a feature on Jira.  

Prisma can work with multiple cloud types and hybrid environments. We use AWS, but Prisma also offers hybrid or multi-cloud features. You can onboard AWS, Azure, GCP, or any other cloud provider. You can do more with Prisma than basic cloud scanning. It can detect and handle misconfiguration on the local network or the cloud. 

The solution can control access and automate some tasks. For example, if any automation needs to be built on any of the API calls, we can have a consolidated page for any processes that need to use the API. You can use the APA. Once you establish console access, you can build automation and integrate it with Prisma.

The CSPM module has so many features for developing a preventative approach that you don't need to look to any others, but the IAC security module lets you store infrastructure as code securely. You can scan an IAC template from a tool like Terraform and compare it with the CSPM modules. 

I have one example of a threat that Prisma proactively prevented. In 2021, Prisma discovered and resolved a Log4J vulnerability shortly after it was introduced. 

It would be nice if Prisma Cloud merged its modules for CSPM and infrastructure as code. It would simplify the pricing and make it easier for customers to evaluate the solution because there are different modules, and you need to add it to your subscription separately. 

Overall, Prisma is continuously improving. They do feature requests by allowing the users to vote on things. If a recommendation receives enough votes, they will add it to the solution. 

We have used Prisma Cloud for two-and-a-half years

Prisma Cloud is stable. I've never experienced any downtime aside from the scheduled maintenance window. 

Prisma Cloud is scalable. You can add a hundred master accounts more than on the SysTrack Lab.

I rate Palo Alto support nine out of 10. Their product team has been helpful. I just had a conversation with them. They answer all my questions even if it's after hours. When you send them a message, you get a response in a minute or two. 

Positive

We had previously used PingSafe. I feel like switching to Prisma was the right decision. PingSafe lacked multiple features that Prisma has. After we did our PoC with Prisma, we found that these features added value to our cloud infrastructure security. Once we switched, we noticed an improvement at the management level. We also reduced the number of data tickets that we needed to manually create.

In the first phase, we did a PoC, and the initial deployment took around a month. We worked with Palo Alto's customer success and technical teams. We worked closely with them in the first year, but after that, our deployment was highly mature, so we didn't need to bug them so much. All of the implementation steps were provided by email. Two members of our team were involved. 

Prisma is a cloud-based solution, so it requires no maintenance on our side once it's deployed. Maintenance is handled during a scheduled window, and they send us advance notification the day before.  

Prisma costs a little more than our previous solution, but it has more features. Our previous solution lacked the features we expect from a CSPM tool.

We didn't look at anything else once we learned about this product and did a PoC. And once we evaluated Prisma, we discussed it internally with our team and made the decision to book it. 

I rate Prisma Cloud nine out of 10. If you're considering Prisma, I suggest starting with a PoC. Consider all the features and go for the ones that are suitable for your organization and add value. You could adopt the solution blindly, but there are some additional costs for the add-ons. 

I do not personally use it in my organization. I am a consultant, and I support my clients. I understand the environment, and based on that, I suggest they implement Prisma Cloud. My job is to do a technical evaluation of the product and recommend it to my clients. I give my recommendation to the client as an advisor. I tell them about the features and capabilities of Prisma Cloud and how they can utilize it. I also do a price or cost-effectiveness comparison of different products, but in the end, my clients decide whether they want to choose the technology over the cost or vice versa.

There have been multiple use cases of Prisma Cloud. The use cases vary based on a client's requirements. It is not necessary to implement all the features and capabilities of Prisma Cloud, but generally, it is for continuous compliance monitoring. The Cloud Security Posture Management (CSPM) feature identifies vulnerabilities within your IT organization or ITOps environment. The main part is to ensure compliance with industry standards such as GDPR and CIS Benchmarks.  

Vulnerability scanning has been a major problem for clients. Nowadays, clients do not have just one cloud. They are not using just AWS or Azure. They have multiple clouds. For example, the primary site is on Oracle, the disaster recovery site is sitting on AWS, and some of their applications are on Azure, so there are three hybrid cloud environments. We try to identify the best solution that can seamlessly integrate with all three cloud providers. Our clients want a centralized Cloud Security Posture Management solution for monitoring vulnerabilities and threats. This is one of the major use cases for which we recommend the Prisma Cloud CSPM solution to our clients.

Prisma Cloud can seamlessly integrate with all clouds. When you go into a cloud, there are multiple landscapes. Some are Windows machines, and some are Linux machines. There are different APIs, different databases, and different types of environments with microservices, Kubernetes, etc. Prisma Cloud has the capability to integrate with all these. That is the beauty. This seamless integration is very critical in every product.

There are multiple CSPM products in the market. The key feature of Prisma Cloud is seamless integration. They have thousands of in-built APIs. You do not need to do much customization. It can seamlessly integrate with multiple clouds. It can integrate seamlessly with Azure, AWS, Oracle, Alibaba Cloud, etc. This is the main feature and the key selling point of Prisma Cloud. For example, today, the client is using only Azure Cloud, but tomorrow, the requirement might come for AWS or Oracle Cloud. It does not mean that they are going to buy a new product for CSPM. That is the beauty of Prisma Cloud, and this is where Prisma Cloud scores. It integrates seamlessly. It does not mean that other products cannot integrate. They can integrate, but they might not seamlessly integrate, or they might integrate only with AWS and Azure but not with Oracle or Alibaba Cloud. All of my client base is in the GCC region. I have clients in UAE, Saudi Arabia, Qatar, Kuwait, and Oman. Oman has Google Cloud. Saudi Arabia has Alibaba Cloud and Oracle Cloud. UAE has AWS Cloud and Azure Cloud. In Saudi Arabia, there are even private clouds. Prisma Cloud can even integrate with your private cloud. You can integrate your on-premise cloud.

Prisma Cloud can protect the full cloud-native stack. It is great, and it can solve your needs from a security point of view. The whole purpose of Prisma Cloud is to scan vulnerabilities.

Prisma Cloud's security automation capabilities are good. For example, you can define a policy for virtual machines. The policy hits an API and scans all your virtual machines. It can identify a virtual machine that is not supposed to have access to the Internet, but its ports are open. If you have set the rules, it can also remove the access of the port or the VM to access the Internet. This capability is definitely there, but it is based on the defined rules and policies and how you do the configuration.

Prisma Cloud provides good visibility. The dashboard or UI is user-friendly. You get a holistic view of your entire infrastructure. 

Prisma Cloud integrates security into our CI/CD pipeline at the resource,  component, and infrastructure levels, but at the application level, it is limited. For application-level security, you need to do something else. You need to have an additional capability or additional security solution.

It provides a single tool to protect all of our cloud resources and applications, without having to manage and reconcile disparate security and compliance reports.

It provides risk clarity at runtime and across the entire pipeline, showing issues as they are discovered during the build phases. It discovers issues at the scanning level. It also has the capability to rescan. For example, if you have discovered an issue or vulnerability, after resolving it, you can rescan the same resource to identify whether it has been mitigated or not.

Prisma Cloud has reduced runtime alerts by 60% to 70%. It has also reduced alert investigation time by 60% to 70%. With these time savings, you also save money. By preventing any vulnerabilities or threats, you also save your organization's reputation.

It has a feature for customized security policy. I implement it in banking, health insurance, and other sectors, and every organization has its own customized policies and procedures. In Prisma Cloud, you can customize policies, and based on that, you can do monitoring. 

It has multiple capabilities, such as threat detection and remediation. You can even orchestrate. For example, you can set a rule that a specific set of users need to have XYZ access. If any user is identified as having an additional level of privilege, which he or she is not supposed to have, Prisma Cloud can scan and identify it. If you have set the policy, it can also do mitigation. It can remove the access accordingly.

One major observation is that it is not possible to implement Prisma Cloud on-premises. This is the limitation. Prisma Cloud itself is on a cloud. It is sitting on AWS and Google Cloud. It is a SaaS solution, but some of my clients have a local regulatory requirement, and they want to install it locally on their premises. That capability is not there, but government entities and ministries want to have Prisma Cloud installed locally.

It is stable. It is a leading product.

It is a SaaS-based application, so we need not to worry about scalability. It is their responsibility. They have to ensure its scalability and high availability.

From what I know, their support is good enough. They meet the SLAs. They have been good so far. That could be because they are new in the GCC market, and someone from Europe or the UK might have different feedback. 

I did not use any similar solution previously.

We provide consultancy. We do the implementation but with the support of the vendor. It is not just about buying the product. It is about how you design and configure it. We ensure that the implementation is done as per the defined design.

The key point for a successful product implementation is how you configure it and what is your use case. Every client has different requirements and different use cases. It depends on how you drive it. You need to define the use cases, the policies, and the procedures, and you need to ensure they are aligned with your business objective. You may have the best product in the world, but if you do not know how to configure it based on your use cases and your environment, it will not work for you. You will have vulnerabilities in your environment even after you have invested millions.

The vendor takes care of the implementation, and we validate and guide them with the implementation.

In terms of maintenance, it is not a set-it-and-forget-it solution. It is based on your IT environment. Generally, small organizations do not use a CSPM solution. It is used by mid to large organizations. In such organizations, there are multiple changes in the IT resources. The environment is agile. Every day you add something or change something, and you need to ensure that it is integrated with Prisma Cloud. It is an ongoing operational activity.

We evaluated multiple products. Zscaler was one of them.

My clients are quite happy with this solution. Some of my clients are also based in the UK and Europe. So far, it has been good. It met their expectations. Their use cases are met, and they are able to monitor all their infrastructure. It has been good so far, and it worked for all the generic or standard use cases. That does not mean that it is going to solve all the use cases for all customers. If you want to go for a CSPM solution, you need to do a technical evaluation.

If you are looking into implementing a CSPM solution, I would advise first understanding your existing cloud landscape or your on-premise landscape. Understand your local regulatory requirements and local laws. After that, define the use cases. Define what exactly you are looking for and then go to market and evaluate different products. You can check whether there is an integration with AWS, Oracle, Alibaba, or any other cloud. If your regulatory requirements are that you cannot host your solution outside your country or you need to have it on-premises in your data center, not someone else's data center, you have to choose accordingly. You cannot go for Prisma Cloud. If you do not have any such regulatory requirements, you can go with Prisma Cloud or any other solution. 

You should also understand your future landscape in terms of:

• Over the next five or ten years, how do you want to grow? 
• What is your current IT strategy? 
• How are you evolving? 
• What would be your technology? 
• Would there be any major digital transformation? 
• How seamlessly can it integrate? 

You need to consider multiple parameters. It is also about money. It should also meet your financial budget.

Overall, I would rate Prisma Cloud a seven out of ten.

We use it for visibility, compliance, and governance. It is the official CSPM solution for our bank.

The only module we are using is the compliance module.

In Prisma Cloud, we were able to create frameworks using the RQL language, frameworks that are modeled after our Archer security baselines. Archer is the tool that we used to track all exceptions and security baselines. With Prisma Cloud we have been able to create custom baselines, based on the Archer framework that we have, and not just go off of CIS or NIST frameworks. 

We have also been able to generate reports for teams using the automated scripting tools that Prisma Cloud provides. On a weekly basis, we share those reports with the teams that are impacted. They go back and remediate their findings as needed, or we fine-tune the Prisma Cloud compliance language as needed if there is any ambiguity in there. 

Over the course of a few weeks, the teams remediate these issues and our compliance percentage goes up. Our compliance percentage for production environments was 95 percent. We then made some new acquisitions and they were at 40 or 50 percent, which was very bad. When we brought them under our company's umbrella, we gave them these reports, and they improved their compliance percentage. That has been helping us hugely.

Also, it does a good job of providing a view of our overall posture. Our confidence in our security and compliance posture was what I would describe as a "head in the sand" type of situation before. People would say, "Ah, we should be okay." But once we started digging into stuff and started putting our Archer baselines into the Prisma Cloud queries, that's when we realized that things looked poorer than we had imagined or assumed. This has been a wake-up call for our organization, and everybody has taken notice that we really have a hard job ahead of us.

In addition, with this solution we are seeing a single pane of glass to protect all of our cloud resources and appliances. We are seeing multiple occurrences with multiple platforms under one roof. That has really helped to simplify things.

Prisma Cloud does have some good investigation built into it. When an alert is generated, it does a good job at correlation, not the greatest in the world, but it gives you a good starting point. So it has helped us work on those alerts or investigate them more easily. It reduces our investigation time by 40 to 50 percent because it does all the initial investigation and puts all the findings together. You don't have to manually log into a lot of different accounts or tools to find out that information.

Financially, the only way I can think of that the solution has improved things is in our compliance structure. We spend less time after audits by putting in the effort beforehand. Recently, we have had a lot of good wins where audits have not been able to find a lot of issues. In the past, they used to find 15 or 16 findings, and now, they're able to find only one or two. When you have fewer audit findings, you have fewer man-hours dedicated to dealing with them. We are able to move those man-hours into our actual work rather than just audit work. We have been able to achieve some productivity there. I would estimate it has saved us 5 to 10 percent, in terms of money.

The most valuable feature is the option to add custom queries using the RQL language that they supply so that we can customize the compliance frameworks to what we need to look for.

The comprehensive view that it offers, the compliance percentage based on a framework for a particular account or a particular environment, is extremely useful. We can give those reports to the individual application teams so that they can remediate the findings. It also helps that we can give them read-only access, so we don't even get involved. They log in on their own and can pull a report, based on our instructions, and then do the remediation themselves. It helps us not be the middleman and not waste our time just generating reports for the application teams.

Also, Prisma Cloud provides security for multi and hybrid-cloud environments. We started off using it for our AWS environments, but now Azure and GCP are starting to come into play. We haven't started using those yet, we have just started initial discussions with them, but it has already been decided that Prisma Cloud would be the CSPM even for our Azure and GCP environments.

One definite area for improvement is the auto-remediation or the CWP area. 

The second one is the RQL language. It is still not very flexible and does not cover a lot of use cases. The RQL language could be dramatically improved to add more options. The cloud is adding more and more complexity in terms of number of services or the number of options for each service, especially when it comes to security options like encryption at rest and encryption in transit. And there is the issue of the interlinking of these services. One cloud service uses another cloud service, like CloudFront in front of a load balancer. These interactions are creating numerous new combinations and the RQL language really needs enhancement to handle those queries. 

We ourselves have put in a lot of enhancement requests to Palo Alto, looking at these corner cases, so they can look into those and improve them.

I have been using Prisma Cloud by Palo Alto Networks for about two years.

Prisma Cloud is a little slow, but it is fairly stable.

It is a scalable solution. No matter how many accounts you add, it still can scale. Even the reports that we set up run pretty quickly. They have done a good job of making their platform scalable.

We have been acquiring companies quite a bit recently so we will be using Prisma Cloud heavily. This is our only company-approved CSPM tool. Even though we have some of the native tools in use, like Security Hub from AWS, or Azure Security Center, now called Defender for Cloud in Azure, the official CSPM is Prisma Cloud. It is the center of attraction for us so it is being used by everybody. In the future, we will be adding more accounts as needed until a decision is made on Wiz. We still have a good amount of time left in our Prisma Cloud contract, so we are not looking to switch to Wiz anytime soon.

Technical support is excellent. We have a dedicated account manager from Prisma Cloud who has an office hours session every Monday, and he also attends our standup calls. If Prisma Cloud has any new improvements or any updates that we might be interested in, he brings them up on those calls. We also have a weekly knowledge-sharing session where Prisma Cloud's personnel come in and make a 30-minute presentation and address the enhancement requests that we put in. They'll tell us what updates have happened, what improvements have happened, et cetera.

Positive

The initial setup was straightforward. It was done by one of our team leads, who is a cloud security fellow. He used to be a senior cyber security engineer. It took him three months of full-time work to set up those compliance frameworks, the custom RQL queries based on our Archer baseline, and then, import all the accounts. The importing of the accounts is pretty straightforward. They provide an API or you can even import manually. That's not at all a problem.

We have 10 to 15 users in the solution. Four or five of us are from cloud security proper, and we have administrative rights. Our cloud operations team, seven or eight people, looks at the alerts and investigates and resolves them. They engage us if they need any assistance because they're not very cloud aware yet. And we have a few pilot users who are from the application teams, and they have a read-only role. They generate a report for themselves. Many people still want spoon-feeding and say, "Can you generate a report for us or give us a screenshot of this and that?" We do that occasionally, but we are trying to move away from that process.

For maintenance, there are only two of us, and one of us is doing it full-time, more or less. The other one is more of a standby. We are documenting the procedures. We do weekly maintenance in Prisma Cloud, where we make sure the users are onboarded, there are no stale users, and take care of the general upkeep of the tool. The idea is that, in the future, we'll probably get a junior engineer for that role, while the senior engineer can perform enhancements or more advanced configurations.

When it comes to protecting the full cloud-native stack, Prisma Cloud is fairly okay. Compared to other tools out there, I don't think it is an extremely good product, but it's a reasonably okay product to work with. I've used Wiz in the past, and Wiz does a better job on full native-cloud security.

For example, there is the auto-remediation feature in Wiz, which Prisma Cloud eventually caught up to. Wiz also has agentless scanning that Prisma Cloud is, again, catching up to. There is also Terraform code scanning for CI/CD pipelines that Wiz came up with, ISC code scanning, et cetera. Those are some of the excellent features of Wiz.

Wiz also offers granular compliance frameworks in the sense that you could write your own compliance queries and make them part of a framework. Prisma Cloud's RQL is not that flexible. We are still running into some issues in some corner cases where there are no RQL queries available.

Prisma Cloud's security automation capabilities are very basic. Prisma Cloud is primarily a CSPM, not a CWPP. Even Wiz does not offer that many automation capabilities; they were coming out just at the end of the last year. But compared to other products that I have worked with, which are purely CWPP, Prisma Cloud would not even come close.

I would rate Prisma Cloud at about six out of 10 for helping to take a preventative approach to cloud security. It gets the job done. Our company has invested money in it, so we can't move away from it for another two or three years. But we are already piloting Wiz to see if we like it. Once the contract with Prisma Cloud is up, we will probably jump to Wiz. That's the idea within the company.

If I were to rate Prisma Cloud from one to 10, I would maybe rate it at six, while Wiz would be a nine.

We have started using some of the modules for securing the entire cloud-native development cycle across build, deploy, and run, but we have not really operationalized them. They're in the initial phases. It's not the maturity of Prisma Cloud that's in question, it's about the maturity of our company as a whole. Our company was not really tuned to CI/CD, secure DevOps, and the like, so we are slowly starting to integrate that. We haven't seen the results yet, but I would say it's very promising on that front at this time.

My advice would be to compare other products and understand what you want to do before you purchase or implement it.