From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Tom McKay

itbrew.com

Three trends that steered enterprise cloud in 2022

Supply chain disruptions, data pileups, and the Big Three’s dominance shaped the enterprise cloud market this year.

Eoin Higgins

AWS, Microsoft, and Google each offer different cloud solutions—here’s how they’re competing on the market

Battling over an expanding market for cloud services, the Big Three tech companies are looking for an edge.

Billy Hurley

CIEM tools are more of a ‘plus-one’ than a standalone, says one Gartner analyst.

CIEM tools in demand as organization move to multicloud

Cloud Computing

John McKenny began his mainframe career in 1981, managing printers and reports generated by a powerful, refrigerator-size computer built to process and automate then-paper-based workflows at railway company CSX Technology.

Forty-plus years later, McKenny, now SVP and general manager for BMC Software’s mainframe business, helps clients operate and optimize the same mainframe technology from his railroad days—only the tech is now faster, sleeker, smaller, and AI-equipped.

While it’s tempting to think that virtually all modern enterprise IT workloads live in the cloud, or at least within on-premises hardware conceived and designed within the past 20 years, today’s mainframes still support critical applications in insurance, banking, government, and many other firms handling lots of transactions.

But what does the future of the mainframe look like, as more companies push to the cloud and begin to lose track of old languages (like COBOL) found in the decades-old hardware? We spoke with mainframe engineers like McKenny about how the mainframe is modernizing and opening its giant doors to emerging technologies and emerging enthusiasts.

A mainframe, a large-capacity computer with very high processing power, got its name from “the large cabinet or ‘main frame’ that held the central processing unit (CPU) of early computer systems,” 

,” designed in 1937, is considered the first mainframe computer. While early models had dimensions ranging from 2,000 to 10,000 square feet, says IBM, newer releases throughout the decades have shrunk to a more modest size, perfect for slotting into a data center.

Mainframes enable transactions at blazing speeds. IBM’s latest-gen mainframe system, the z17, released in April 2025, for example, boasts a processing capability of “up to 5 million inference operations per second with less than 1 ms response time.”

The mainframe, by design, has built-in features supporting can’t-fail applications, including redundant hardware components, a workload-balancing structure called 

, and advanced warnings of a faulty part.

“I’ve gotten calls from IBM throughout my career, and they’ve said, ‘Hey, one of your memory modules is failing. We’re on our way to replace it’…and nobody has any idea that that failure occurred,” Steven Perva, an expert mainframe innovation engineer at Ensono, told IT Brew.

Almost a century after their creation, mainframes, given their central role to many businesses, have remained in data centers and taken on new features.

One way to modernize, according to Perva, involves changing the software development approach for mainframes. Perva has been using new extensions to enable tools and capabilities familiar to non-mainframers, such as the AI code editor VS Code, the remote-access management interface SSH, and Microsoft Copilot code explanation.

Before these access methods, applications were (and still are, according to Perva) typically developed via TSO/ISPF command-prompt interfaces, also known as “green-screen” interfaces featuring 

-like green text on a black background. API connectivity, introduced by the z/OS Management Facility tool has enabled new coding options, Perva wrote to us in a follow-up email.

“It’s almost like a kid having a job that says, ‘Hey, we have all these new toys that are coming out. We want you to tell us which ones are fun,’” Perva said.

McKenny, too, has seen developers use similar code tools to write and update an application running on the mainframe. “By developing that in VS Code, they have access to look at and interact with information from the mainframe about that application, to get an explanation of that application, to get some insights as to how it works and all that can be done in a modern interface,” McKenny told IT Brew.

Many mainframes feature COBOL—the “Common Business-Oriented Language” invented in the 1950s. Expertise is currently in 

, as modernization, for some, might mean getting rid of all that COBOL.

Hassan Zamat, SVP at Kyndryl and the global practice leader for core enterprise and its mainframe-as-a-service platform zCloud, uses generative and agentic AI tools to translate legacy code like COBOL into modern programming languages like C# or Java, in addition to recommending architectural improvements.

Modernization could also mean a “hybrid” approach, pulling some on-mainframe functions into virtual mainframe environments in the cloud. A common “hybrid” scenario Perva sees: Orgs will move their development environments off the mainframe. “We see a lot of people who want to automate their testing, and they’re not developing all the time, so it doesn’t make sense for them to have a dedicated, forever-running development environment,” Perva said.

Tools like BMC’s AMI Ops and IBM Z’s AIOps use AI capabilities to monitor for disruption-causing events.

BMC’s annual mainframe survey, released in September 2025, revealed an emerging interest in the mainframe from younger IT professionals. Around 66% of the more than 1,000 global mainframe practitioners and stakeholders surveyed identified as millennial or Gen Z—an increase from 37% in 2018. Almost all (97%) of this year’s total respondents see the mainframe as a long-term platform or platform for new workloads—like generative AI assistants and even faster fraud detection and credit-risk scoring, McKenny shared as a few examples.

McKenny hopes to retire in the next 10 years or so, he said, leaving a place for a new generation responsible for taking the platform forward. “When you have someone that has a responsibility to develop on, to secure, to manage, to operate this environment for the next 15 or 20 or 25 years of their career, they’re more interested in looking at, ‘Hey, what are some of the new and different ways that we can exploit the power of this platform?’”

A man at a workstation, circa 1970. Behind him is an IBM System/370 mainframe computer. Credit: f8 Imaging/Getty Images

How the mainframe is modernizing, according to today’s IT pros

Mainframe practitioners discuss the “new toys” they’re playing with these days.

Brianna Monsanto

Like a Draw Four card in Uno, Oracle’s monumental deal with OpenAI is expected to shake things up—and not just for Oracle’s reputation, but for the greater tech ecosystem, according to industry experts.

 OpenAI had signed a contract with Oracle, agreeing to purchase $300 billion worth of computing power over approximately five years. The contract is slated to come into effect in 2027.

The Wall Street Journal said the OpenAI–Oracle deal is one of the largest cloud contracts signed to date, requiring 4.5 gigawatts of data center power capacity. Oracle shares jumped more than 35% following news of the deal.

However, Anetac security platform co-founder and CEO Timothy Eades argued the deal is actually not as expensive for Oracle as it seems. That’s because Eades said the arrangement will give the data giant a leg up in the industry’s trek towards deglobalization and 

 65% of governments worldwide will have some form of digital sovereignty by 2028.

Eades said the recent deal positions Oracle well for the AI era, a much-needed move given that the company had “missed out on some really big waves.”

“Part of it’s defensive,” Eades said. “Imagine if they didn’t do it right. I mean, they were left out of the hyperscaler world. Imagine if they weren’t involved in the AI world.”

Eades said that the deal also will award Oracle additional relevancy, transforming its identity beyond a “40-year-old database company.”

“This is a cheap deal…If you look at it in a 10 year time frame, holy cow,” Eades said.

Shishir Shrivastava, a practice director at TEKsystems Global Services, said the deal signifies a wave of consolidation within the AI infrastructure industry, similar to what occurred during the 

 in Intel, announced on Sept. 18, as another indicator of this.

“For the next few years, that’s what we’ll see,” Shrivastava, a former Oracle employee, said. He added that the combination of Oracle’s flagship database product, its enterprise applications, and its infrastructure will allow it to cater to large enterprises.

“With the advent of cloud, all they have to do is just take all of that infrastructure and the muscle in the power and boost it to the cloud so that they can provide that AI optimized ecosystem,” Shrivastava said.

Eades said deals on such a large scale will likely continue moving forward.

“This is just the start of something massive,” he said.

 Some may be wondering what the monumental deal means for the 

. Shrivastava said the recent deal will help catapult Oracle’s reputation in the cloud computing industry to the heights of the hyperscaler trio.

“Sooner or later, you will see that among AWS, and Microsoft, and Google, Oracle’s name will pop up as well quite frequently,” Shrivastava said.

Eades, however, predicts the OpenAI–Oracle deal won’t shake things up too much for the hyperscalers because the industry is currently in the “first innings of AI” and companies likely will establish deals with multiple cloud providers.

“It’s not like musical chairs where everybody’s going to find one at the last minute, and this is your lock to that one chair,” Eades said. “Right now, people are trying to circle around and find the right chair that’s going to be relevant for them on the product suite that they have and the markets that they see.”

 While the $300 billion deal is regarded as a win for Oracle by some, others remain skeptical. Following the news of the agreement and the market’s subsequent reaction, discussions of an oncoming AI bubble burst 

“I don’t think it’s a bubble, but if it is a bubble, then deals like these are put as a risk,” Shrivastava said.

 ratings highlighted the counterparty risk (i.e., the risk that a party will not fulfill its end of the bargain) associated with the deal. Moody’s does not mention OpenAI by name in the report, and disclosed its risk assessment is “subjective at best,” given their lack of financial information on the unnamed party.

Moody’s report also acknowledged Oracle’s high debt standing and how it could impact the company following the pending deal: “Oracle’s AI infrastructure business has tremendous potential in our view, but we note that this exponential growth and the already high debt burden at Oracle could result in an extended period of high leverage and negative cash flow.”

Correction 09/26/2025: Shishir Shrivastava's title has been corrected to "practice director."

What the Oracle–OpenAI deal means for the greater industry

One CEO calls the agreement between Oracle and OpenAI a “cheap deal.”

When you use Amazon Web Services (AWS) services, AWS Identity and Access Management (IAM) stays busy behind the scenes.

At AWS’s annual re:Inforce conference, AWS CISO Amy Herzog 

 now handles 1.2 billion API calls per second worldwide. For reference, IAM handled around 400 million API calls at the same rate in 2021.

“This is like foundational glue to make AWS work,” Karen Haberkorn, AWS director of product management for identity, told IT Brew.

 Haberkorn broke down capabilities currently available in IAM Access Analyzer. One of the tool’s main features is an external access analyzer, which allows customers to see which AWS resources can be accessed outside of their organization.

“The customer knows what’s important [and] what access is intended, but the tool lets them see where those paths exist,” Haberkorn said.

Another capability in its toolset is its unused access analyzer which, as the name implies, identifies unused permissions, roles, and keys within an organization.

 an internal access analyzer capability in IAM Access Analyzer that uses automated reasoning to analyze policy types—including service control policies and resource control policies—and identify which roles or users have access to S3 buckets, Amazon DynamoDB tables, or Amazon Relational Database Service snapshots.

Haberkorn said that AWS’s recent expansion to IAM is significant because most tools in the industry tend to focus on the access users already have rather than the access they could potentially have.

“We’re able to answer that harder question of who could access it because we use this capability that we like to call provable security. It uses a mathematical science called automated reasoning to literally construct a proof… about whether that access path is possible to traverse,” Haberkorn said.

Haberkorn said the combination of the three capabilities is a “powerful combo.”

 enforcement for root users across all AWS account types, which Haberkorn said is exciting because of the login process’s ability to mitigate attacks.

“Stopping that up front, long before someone’s deep in the stack, is a really powerful security principle I would say, and one that AWS has taken seriously from the very beginning,” Haberkorn said.

AWS IAM’s next focus will be on GenAI, specifically around how it works with agents, Haberkorn said.

“We already have identified the features we already have that are applicable to building an AI agent and we’re looking at how [we can] make it just easier for an AI agent builder to bring this stuff together for them so they don’t have to go hunting around for all the separate features in AWS,” Haberkorn said.

A hand with a digital security padlock in it's palm depicting data loss prevention

How AWS IAM stays busy behind the scenes

Karen Haberkorn says the combination of AWS’s recently announced IAM and older capabilities are a “powerful combo.”

The sky is the limit—unless you’re Microsoft, in which case, it is a booming business line that has solidified its place as a top cloud giant over the years.

When talking about cloud hyperscalers in the industry, Azure is a name that is hard to ignore. According to 

, Azure had a global market share of 22% in Q1 2025. In the same period, AWS had a global market share of 29%, while Google Cloud had 12%.

To understand how Azure secured a spot as one of the 

, IT Brew caught up with cloud computing experts to learn about some of the core decisions made in the cloud giant’s early days that positioned it for success.

Mark Russinovich, Azure CTO and technical fellow, told IT Brew that the story behind Azure began in 2006 when Dave Cutler, known for his key role in the development of Windows NT, set off on a project to create a platform for the emerging “software-plus-service era.” The internal project was known as Project Red Dog.

“This team with Dave, under [then Microsoft Chief Software Architect] Ray Ozzie, started to look around the company and talk to different teams that had services, including teams like Hotmail and the Windows Live team, about what they needed to make it easier for them to run services,” Russinovich said.

Azure, formerly Windows Azure, was officially announced in 2008 at the Professional Developers Conference and made its commercial debut in 2010. Brand-naming agency Lexicon claims to have come up with the name Azure, which means sky blue, to reflect Microsoft’s “new attitude” and the “open-ended and flexible nature” of the platform.

“As far as the name Azure, marketing picked that,” Russinovich said. “I thought it was an odd pick at the time because Azure is the color of the sky with no clouds in it, which is the opposite of cloud.”

Wade Wegner, a director of technical evangelism for Azure from 2010 to 2012, told IT Brew that Azure was immediately attractive to Microsoft’s “loyal base,” which included .NET developers. However, outside of that, things looked slightly different, partly because of Amazon Web Services’s (AWS) 

“The broader developer ecosystem actually was centered and flocking around what AWS was doing and it was hard for us, especially early days, given we had such a very specific platform as a service approach to building for the cloud,” Wegner, now a chief ecosystem and growth officer at DigitalOcean, said.

Karthik Ranganathan, founder and co-CEO of Yugabyte, an open-source distributed SQL database company, added that Microsoft’s later entrance into the cloud market ultimately became a focal point for industry onlookers in Azure’s early days. Ranganathan worked as a software design engineer at Microsoft between 2005 and 2007.

“The critics would point out that this gap is going to be very tough to bridge because Amazon’s running away with it, or so to speak,” he said.

Still, several decisions made along the years helped propel the cloud giant as a serious contender in the cloud race. For starters, Russinovich said the company’s move to release Azure Virtual Machines, an infrastructure-as-a-service (IaaS) offering, in 2012 “unlocked a lot of business.”

“What we found was, there were customers that wanted that kind of convenience of what the platform could do for them but a lot of enterprises had existing software that they wanted to just migrate into a cloud platform, and not having an IaaS capability meant that they couldn’t use Azure,” Russinovich said.

Russinovich added that Microsoft’s growing support of open-source, 2018 acquisition of 

, and strong relationship with enterprises also shaped Azure’s trajectory.

“We had this long history of relationships and understanding what enterprises wanted,” Russinovich said. “So, we could bring that to the design of our platform from a security, reliability, operation, [and] support perspective.”

Others, like Cockroach Labs Senior Director of Global Alliances Cassie Zimmerman, credit current Microsoft CEO Satya Nadella, who took on the role in 2014, as another big driver behind Azure’s trajectory. (Cockroach Labs is an Azure database partner.)

“He was really the one who came in and declared Microsoft as this cloud-first, mobile-first company,” Zimmerman said. She pointed to Azure’s rebrand from Windows Azure to Microsoft Azure shortly after Nadella took the reins as a reflection of that shift.

Today, Russinovich said Azure is in the “AI era.” Recent decisions at the company actively reflect this. Microsoft has partnered with OpenAI since 2019 and has pumped 

, the tech company announced that it recently added xAI’s Grok 3 models to the Azure AI Foundry, along with several updates to the unified application platform.

Ranganathan said Microsoft’s early wager on AI has ultimately paid off.

“I’m sure they diversified into a lot of bets and this was the bet that really started taking off in the market,” Ranganathan said.

Beyond AI, Ranganathan said industry onlookers may be waiting for the cloud giant to “round out” its offering for those that fall outside of its enterprise audience.

“Its origins were so much in the enterprise stack…that some of the workflows and some of the ways that developers consume it, it’s complicated,” Ranganathan said. “It works great for large enterprises. It’s difficult for a startup sometimes.”

A Microsoft building peeking through trees.

How Azure rose to the ranks as a cloud giant

“I thought it was an odd pick at the time because Azure is the color of the sky with no clouds in it, which is the opposite of cloud,” Microsoft Azure CTO and technical fellow tells IT Brew.

The European Union’s (EU) desire for cloud sovereignty has seemingly been reignited as geopolitical tensions push organizations to reevaluate the region’s reliance on the US for its digital infrastructure needs.

 it had launched a new European parent company and three subsidiaries incorporated in Germany for its European Sovereign Cloud offering. The parent company will be “locally controlled” and led by EU citizens. AWS European Sovereign Cloud is expected to roll out by the end of the year.

“There will be zero operational control outside of EU borders; the AWS European Sovereign Cloud will be operated entirely by residents of Europe,” the tech giant wrote in a blog post. “Only AWS employees, residing in the EU, will control day-to-day operations, including access to data centers, technical support, and customer service for the AWS European Sovereign Cloud.”

The move joins several efforts by hyperscalers to bolster sovereign cloud solutions for customers. In May, Google Cloud 

 several enhancements to its sovereign cloud offerings, including a new solution that conducts “recurring security testing of customer applications to validate sovereignty postures.” The month prior, Microsoft 

 to increase its European data center capacity by 40% in the next two years.

 Johan David Michels, a researcher at the Queen Mary University of London, told IT Brew via email that concerns among European customers revolve around the US’s ability to access data stored in the cloud and the country’s ability to halt access to cloud providers completely. Michels said these concerns span as far back as 2013 when Edward Snowden, a former National Security Agency (NSA) contractor, leaked confidential information on the government’s surveillance programs. Documents revealed by Snowden showed that the NSA 

 on EU officials in Brussels, Belgium, and the US.

Michels said the concerns have continued to proliferate due to the Trump administration’s “forceful and at times unpredictable” foreign policy. He referenced reports alleging Microsoft 

 the email of International Criminal Court (ICC) Chief Prosecutor Karim Khan following Trump-imposed sanctions as an example of this. Microsoft has 

“This has led many European customers to question whether their data are really safe in a US hyperscaler’s cloud,” Michels wrote.

Alexandre Ferreira Gomes, research fellow at independent think tank and diplomatic academy Clingendael, told IT Brew that the push for cloud sovereignty in the EU began relatively recently and is part of the greater push for economic sovereignty by the union, driven by several factors including Russia’s invasion of Ukraine and a desire to decrease dependency on the US and China for tech.

“Over the past two to three years, we have been assessing dependencies and vulnerabilities on others, and then we come to realize that we are not sovereign in terms of being able to make choices, and that’s very clear when you look at the technology overall,” Ferreira Gomes said.

Michels wrote that European and US cloud providers have taken note of the concerns of customers and are working to address them.

“European cloud providers argue that they can offer similar functionality to US hyperscalers, without being subject to foreign jurisdiction,” Michels wrote. “US hyperscalers offer technical features (such as customer-side encryption and confidential computing) to protect data from foreign government access, while promising to challenge US orders that conflict with European law before US courts, if necessary.”

The push for sovereignty has led some companies, including unconventional ones, to take matters into their own hands. In 2022, Schwarz Group, owner of the Lidl supermarket chain, made its EU compliant German cloud business STACKIT available to the public.

“Our service offering means that we are paving the way in Germany for a European cloud solution that will strengthen the digital sovereignty and competitiveness of our economy,” Christian Müller, CIO of Schwarz IT, said in a 

A draft penned by the EU detailing the region’s international digital strategy 

 wrote it is “unrealistic” for it to decouple from dominant players like the US, adding that “cooperation” would remain important across the technology value chain. However, Ferreira Gomes argues that decoupling was never the end goal.

“The idea is not that we decouple from [the] US…but it’s just the idea of being aware of where we cannot be as dependent as we are today,” Ferreira Gomes said.

For cloud computing, Michels said customers will be more thoughtful with where they store their cloud environments down the line.

“In future, I expect that we will see European customers thinking more carefully about which data belong in which IT environment,” Michels wrote. “This includes multi-cloud deployments that combine US hyperscale cloud with European sovereign cloud services.”

Cloud hovering over an employee working on a laptop. Credit: Anna Kim

Why cloud sovereignty is top of mind for Europe

“The idea is not that we decouple from [the] US…it’s just the idea of being aware of where we cannot be as dependent as we are today,” one research fellow says.

Handing over the keys to the new driver in the family? Daunting. Handing over the keys to cloud instances at your company to a new hire? Perhaps just as daunting.

A new employee’s first day is a big deal for everyone, and especially for the IT department, which is responsible for setting up the appropriate permissions and access controls for all of the organization’s cloud-based applications. It’s a massive responsibility, given the 

 if those same permissions are not properly supervised. A 

 found that 23% of cloud identities, both human and non-human, have “critical” or “high severity” excessive permissions.

Jay Martin, CISO at IT solutions and services provider Blue Mantis, told IT Brew that the industry is in a “fairly immature state” when it comes to handling cloud permissions and that having a standardized process around it is critical.

“The last thing you want to do is onboard an administrative assistant on the HR side into your financial system,” Martin said. “So, there’s practices that need to be set up in advance.”

 Neeraj Methi, VP of cybersecurity solutions at Myriad360, told IT Brew that organizations should avoid just letting anybody have the ability to create and renege on cloud-related permissions and implement a formalized process instead.

“Define a process, open tickets, and have a trail behind everything which is being requested and denied, so that you have an idea where all these access are,” Methi said.

Kurt Seifried, chief innovation officer at the Cloud Security Alliance, added that organizations should remember that vendors are constantly adding capabilities that could shake up how things are done.

“Your cloud vendor, especially somebody like Amazon, Microsoft, Google, or Zoom even, [is] constantly adding features and security,” Seifried said. “You gotta keep up with that.”

Once an employee is successfully provisioned, the fun doesn’t stop there. Seifried told IT Brew that there are many mistakes that can be made around access permissions once set. For example, for employees who are no longer with the company, Seifried’s “lockout procedure” for Google accounts used to mean suspending the account, changing the password, and un-suspending it to hand over access to managers. That changed after he realized former employees could potentially still access the account through credentials saved on Google’s account recovery feature.

“Lessons were learned,” Seifried said.

Martin added that organizations should be mindful of appropriately adjusting cloud instance access when employees switch roles in their company, an area he said customers tend to do poorly in.

 Some companies have begun to automate the process around cloud provisioning. Methi told IT Brew that it could help bolster productivity as users are able to access cloud credentials faster and eliminate room for human error.

“If you’re doing it manually, how effective could [you] be [at] keeping track of it?” Methi said, adding that the task could become a “nightmare” for some organizations.

Karthik Ranganathan, co-founder and co-CEO of Yugabyte, an open-source distributed SQL database company, told IT Brew that the cloud provisioning process at his company is mostly automated. Ranganathan said that Yugabyte is able to constantly update its processes around onboarding and has made it a significantly shorter experience for new hires.

“Now we’re talking hours,” Ranganathan said. “So, employee starts on Monday. By Monday afternoon, we’re sending them email. They have Slack. They have everything.”

Regardless if a company chooses to partly or fully automate the cloud provisioning process, Martin said it is always important to have a formal process in place.

“You can automate as much of this as you want with technology, but the first step really is to make sure that that process is vetted, that process is documented, that you have the proper workflow,” Martin said.

What to consider when handing new employees the keys to the cloud

“The last thing you want to do is onboard an administrative assistant on the HR side into your financial system,” one CISO tells IT Brew.

Life is full of big choices: choosing between oat and almond milk at the coffee shop, deciding if it is finally time to replace the kitchen sponge, and of course, selecting a good cloud-native application protection platform (CNAPP) for your business.

CNAPPs are security solutions that protect cloud applications throughout their entire life cycle. Wiz VP of Product Marketing Jiong Liu told IT Brew that the “broad acronym,” coined by Gartner, involves everything that has to do with protecting innovation occurring in the cloud.

“When we think about CNAPP, it really is those three key legs of the stool: proactive security, preventive security, and reactive security,” Liu said.

IT Brew caught up with several cloud computing experts to discuss what companies should consider when vetting out a CNAPP solution.

Aaron Rose, security architect manager at Check Point Software, said there are many things to consider when shopping around for CNAPP solutions. For starters, ensuring that selected solutions have adequate integration capabilities for unified 

. It’s for this reason that Check Point and Wiz engaged in a 

 to provide CNAPP solutions to enterprises earlier this year.

“Even if you have different solutions, maybe even from different companies, you’ve got to make sure that they’re integrated in some way [and] that they work together because cybersecurity can’t actually be effective in a silo,” Rose said.

Jason Rader, VP and CISO at Insight Enterprises, stressed the value of seeking out solutions with native integration functionality.

“A native integration means that they speak the same protocol language and they can basically work [alongside] each other, and that is definitely a point that we pay a lot of attention to,” Rader said.

Rose said companies should also make sure that the CNAPP solutions they have their eyes on are able to secure everything they need, especially if they operate in a 

“Ideally, you don’t have a different CNAPP solution for each cloud,” Rose said. “That isn’t really scalable.”

 Rose said cloud providers often claim to offer CNAPP capabilities to some degree. However, he warned these tools can come off as “builder grade” because their speciality isn’t cybersecurity.

“It’s like when you’re building a house and you have the option [of using] the builder grade, generic stuff. Does it accomplish what you needed to do? At a very base level, yes,” Rose said. “Is it the best solution possible for this? Not necessarily.”

However, Rader told IT Brew that Google’s 

 of Wiz earlier this year may indicate otherwise.

“Now, a hyperscaler owns what I would consider the best platform,” Rader said.

During the search for a CNAPP platform, agent-based and agentless security solutions may catch your attention. Gil Geron, co-founder and CEO at Orca Security, said to avoid falling down rabbit hole discussions of which is better. Instead, he advises companies to focus on what they want their solution to accomplish.

“It’s almost like asking if you want air conditioning in your car or not…That’s not a question about the car,” Geron said. “The question about the car is how it drives, how comfortable I am in the car, [and] how efficient it is. These are the questions I’m asking.”

A lock symbol in front of a computer motherboard

The buyer’s guide to choosing the right CNAPP solution 

Orca Security CEO Gil Geron tells IT Brew that companies should focus on the value a CNAPP solution can provide them versus whether or not it is agent-based or agentless.