This list of questions, with suggested vendors and products, is how I quickly evaluate the technical maturity of companies and projects, which has been developed since 2016 across working with 100+ companies. Any section where a customer does not have a specific solution, can be used to generate a Gap Analysis and then into a project plan.
- SOC 2 Type 2
- ISO 27001
- PCI DSS (payment processors)
- NYDFS (financial services)
- HITRUST / HIPAA (healthcare)
- NIST SP 800-53 / FISMA / FedRAMP (US Gov)
- FIPS 140-2 (cryptography)
- GDPR (EU)
- AWS
- Microsoft Azure
- Google GCP
- VMware
- AWS ALB (L7) / NLB (L4)
- Azure Standard Load Balancer (L7) / Gateway Load Balancer (L4)
- GCP ALB (L7) / NLB (L4)
- F5 Load Balancer
AWS Lambda, Azure Functions, GCP Cloud Run
AWS Fargate (EKS or ECS), AWS EKS (K8S), AWS ECS (Docker), Azure AKS (K8S), GCP GKE (K8S)
Red Hat OpenShift, VMware Tanzu, Rancher
AWS EC2 VMs, Azure VM, GCP VM, VMware vSphere
Chainguard, SecureChain, Aikido, Rapidfort, Docker Hub
Amazon Linux, Windows Server, RHEL, Ubuntu, Debian, Arch Linux
VMware CloudHealth, CloudQuery, NCCGroup / aws-inventory, DuoSecurity / cloudmapper
VMware CloudHealth, AWS Trusted Advisor, CloudDyn, Cloudcheckr
Okta, Microsoft Entra ID (formerly AD), GCP Workspace, OneLogin, Ping Identity, Jumpcloud, Cisco Duo, SailPoint
Teleport, HashiCorp Boundary, Pomerium, Loft
Github SaaS, Github on-prem, Gitlab SaaS, Gitlab on-prem, CircleCI, TravisCI, Atlassian Bitbucket
Github Actions, Gitlab Pipelines, Atlassian Bamboo, Jenkins
K8S - Helm
VMs - Ansible, Puppet, Chef, Salt
HashiCorp Vault, Thycotic Secret Server, CyberArk Secrets Manager, AWS Secrets Manager, Ansible Vault, Puppet Hiera, Chef Data Bags
Cloud - HashiCorp Terraform, AWS CloudFormation, Azure Resource Manager, GCP Deployment Manager
Prometheus + Grafana, ELK, SignalFX, DataDog, New Relic, Nagios
Prometheus + Grafana, ELK, SignalFX, DataDog, New Relic, Nagios
Splunk, ELK, AWS CloudWatch, AWS Athena, DataDog, New Relic, SumoLogic
Splunk, ElasticSearch, AWS Security Manager, AWS Athena, DataDog, New Relic, SumoLogic, Panther
PagerDuty, OpsGenie, VictorOps
Enterprise - Wiz, Tenable, Qualys, Ox Security, Orca Security, CrowdStrike, Trend Micro, Sysdig, SentinelOne, Check Point CloudGuard
Open-source - Prowler, Cloud Custodian, Cloudsploit, nccgroup/ScoutSuite, duo-labs/cloudmapper, checkmarx/KICS
- https://www.wiz.io/academy/cloud-security/cnapp-vs-cspm
- https://www.wiz.io/academy/cloud-security/oss-cspm-tools
- https://www.sentinelone.com/cybersecurity-101/cloud-security/open-source-cspm/
- https://www.sentinelone.com/cybersecurity-101/cloud-security/cloud-security-best-practices/
Enterprise - Wiz, OPA (Open Policy Agent), Fugue, Pulimi CrossGuard, Checkov, Black Duck, Trend Micro Cloud One, CheckPoint CloudGuard, Tenable Cloud Security
Open-source - OPA, aquasecurity/trivy, Conftest, tflint, cloudposse/atmos
- https://www.wiz.io/academy/application-security/iac-scanning
- https://spacelift.io/blog/policy-as-code-tools
- https://www.sentinelone.com/cybersecurity-101/cloud-security/iac-scanning-tools/
- https://checkmarx.com/learn/infrastructure-as-a-code/what-is-iac-security/
Enterprise - Wiz, GitHub Secret Scanning, HashiCorp Vault Radar, SentinelOne, Aikido, Check Point Spectral
Open-source - TruffleHog, gitguardian/ggshield, GitLeaks, awslabs/git-secrets, aquasecurity/trivy, yelp/detect-secrets, deepfence/SecretScanner, mongodb/kingfisher
- https://www.sentinelone.com/cybersecurity-101/cloud-security/secret-scanning-tools/
- https://blog.gitguardian.com/secret-scanning-tools/
- https://appsecsanta.com/secret-scanning-tools/best-open-source-secret-scanning-tools
- https://www.aikido.dev/blog/top-secret-scanning-tools
- https://checkmarx.com/learn/secrets-detection/finding-an-effective-secrets-scanning-tool-key-considerations/
Enterprise - Wiz, Snyk, Veracode, Checkmarx, Ox Security, Datadog Code Security, Black Duck
Open-source - Semgrep, GitHub CodeQL, SonarQube
- https://www.wiz.io/academy/application-security/top-open-source-sast-tools
- https://www.sentinelone.com/cybersecurity-101/cybersecurity/application-security-standards/
- https://www.sentinelone.com/cybersecurity-101/cybersecurity/application-security-vulnerability-management/
- https://orca.security/resources/blog/open-source-application-security-tools/
- https://checkmarx.com/learn/sast/open-source-vs-premium-sast-tools/
- https://www.latio.com/#best-SAST-tools
Enterprise - Wiz, AquaSec, Aikido, Ox Security
Open-source - aquasecurity/trivy, anchore/grype, quay/clair
- https://www.aquasec.com/cloud-native-academy/container-security/container-security/
- https://www.wiz.io/academy/container-security/open-source-container-security-tools
- https://www.sentinelone.com/cybersecurity-101/cloud-security/container-security-solutions/
- https://www.runxbuild.com/blog/container-security-software/
- https://www.wiz.io/academy/container-security/container-security-scanning
- https://www.wiz.io/academy/container-security/what-is-container-security
- https://www.sentinelone.com/cybersecurity-101/cloud-security/what-is-container-security/
- https://www.aikido.dev/blog/container-security-guide
- https://www.aikido.dev/blog/container-security-best-practices
- https://www.sysdig.com/learn-cloud-native/what-is-container-security
Open-source - Harbor
Enterprise - Wiz, Ox Security, AquaSec, Orca Security
Open-source - Kyverno, open-policy-agent/gatekeeper, Kubernetes ValidatingAdmissionPolicy (CEL), aquasecurity/kube-bench, kubescape
- https://www.wiz.io/academy/container-security/top-kubernetes-security-tools
- https://github.com/ksoclabs/awesome-kubernetes-security
- https://www.sentinelone.com/cybersecurity-101/cloud-security/open-source-kubernetes-security-tools/
Enterprise - Sysdig Falco
Open-source - Falco
Enterprise - Wiz, Tines, Torq, Blinkops, Swimlane, Azure Sentinel, Splunk SOAR, Sumo Logic Cloud SOAR