Wiz vs Prisma Cloud: named modules, the Security Graph, and runtime on both
Both sell agentless cloud visibility and a runtime path that can block. Compare Wiz Essential, Advanced, Sensor, Code, and Defend with Prisma Cloud Foundations, Advanced, and Compute Edition.
Connect the accounts, then the queue is whichever module the contract actually turned on. On Wiz the agentless path is API connectors into the Security Graph. The runtime path is the Wiz Sensor, an eBPF add-on, plus Wiz Defend for log ingestion. On Prisma Cloud the agentless path is Cloud Security Foundations. Host, container, and serverless runtime security and WAAS are on Cloud Security Advanced, and Compute Edition is the self-hosted package that includes both an agentless and an agent-based approach.
Palo Alto also meters Cortex Cloud Posture Management and Cloud Runtime Security by protected workload. Posture Management is the agentless bundle (CSPM, CIEM, ASPM, DSPM, AI-SPM, ASM, KSPM, CI/CD posture, and agentless workload scanning). Cloud Runtime Security includes that posture set plus cloud workload protection and WAAS. On the pages opened 3 Oct 2026, each product has both an agentless path and a runtime path.
| Primary use case | Security Graph context across misconfigurations, vulnerabilities, identities, exposure, and data, plus a Sensor path that blocks on the host | CNAPP modules: Foundations for agentless posture and scanning, Advanced for runtime and WAAS, or self-hosted Compute Edition |
|---|---|---|
| How a bad day closes | Graph Issues show the combination that reaches exposure or data. With the Sensor deployed, the sensor page says it can block and terminate a malicious process | Posture findings land in the console. Advanced, Compute, or Cloud Runtime Security is the license that includes workload protection. Foundations does not list that runtime set |
| Day-to-day workflow | Cloud connectors, Security Graph Issues, and, when quoted, Sensor, Code, and Defend | Credit-scoped Enterprise modules, or Cortex workload units for Posture and Runtime, or a self-hosted Compute console |
| Deploy | Agentless API connectors for the graph. Sensor is a separate Advanced add-on, not bundled into the Essential workload price | Foundations is the agentless list. Advanced adds host, container, and serverless runtime plus WAAS. Compute Edition is customer-hosted and documents both agentless and agent-based protection |
| License/pricing | 12-month AWS contract sold by Wiz: Essential $24,000 and Advanced $38,000 per 100 workloads. Sensor, Code, and Defend are separate dimensions. See Editions | Prisma credits and Cortex workload units. No public dollar per credit or per workload was on the license pages opened 3 Oct 2026 |
| Who operates it | Cloud security teams on the graph, plus whoever deploys the Sensor where blocking is in scope | Cloud and AppSec teams on the Prisma or Cortex modules the quote enabled, including runtime owners when Advanced, Compute, or Cloud Runtime Security is the license |
We reviewed Wiz’s runtime sensor page and the AWS Marketplace listing sold by Wiz, Prisma Cloud’s license page, Prisma’s Defender architecture page, and Cortex Cloud’s license-plan page, plus one Hacker News thread, on 3 Oct 2026. We did not run either product in a paid tenant, so this is not a hands-on benchmark. Wiz joined Google Cloud after the acquisition closed on 11 March 2026 and states it remains multicloud. Prisma Cloud remains a Palo Alto Networks product, with Cortex Cloud as the workload-metered license beside it.
Wiz
Prisma Cloud
Wiz’s Continuous Vulnerability Assessment post, 1 September 2026, is a re-assessment feature in public preview when new CVEs land. It is not a substitute for the Sensor. Prisma’s module boundary is the license page: Foundations for the agentless set, Advanced for runtime and WAAS, Compute Edition for self-hosted workload protection.
Editions and pricing
Wiz’s public dollars are the 12-month contract table on the AWS listing sold by Wiz, opened 3 Oct 2026. The same page has 24-month and 36-month tabs. Those dollar rows were not copied here. Prisma’s license page sells credits in increments of 100 and does not print a dollar per credit. Per-VM credit loads from an older guide are not on that page, so they are not used as a current price. Cortex meters protected workloads on an annual subscription with a 90-day average and does not print a dollar either.
| Ownership (3 Oct 2026) | Wiz is a Google company after the acquisition closed 11 March 2026. The brand is Wiz. First-party materials say multicloud support continues. | Prisma Cloud is a Palo Alto Networks product. Enterprise Edition is SaaS. Compute Edition is self-hosted. Cortex Cloud Posture and Runtime are the workload-metered licenses on the Cortex docs. |
|---|---|---|
| How you buy it now | Sales or private offer, and the AWS dimensions below. The listing does not define the feature split between Essential and Advanced beyond “protect 100 cloud workloads.” | Credits for Enterprise plans and modules, or Cortex workload capacity. Compute Edition is its own subscription. |
| Public units (12-month table) | Essential: $24,000 (USD) per 100 cloud workloads. Advanced: $38,000 per 100 cloud workloads. Sensor: $28,000 per 100 sensors, add-on for Advanced. Code: $58,500 per 100 licenses, add-on for Wiz Cloud. Defend: $18,000 per 12 months for 300 GB of logs ingested per month, add-on for Advanced. | No public dollar. Prisma credits are sold in increments of 100. Cortex examples: 1 VM counts as 1 workload, 10 agent-protected managed containers count as 1, 2 PaaS databases count as 1. A Cloud Runtime license includes posture scanning and runtime protection on the same asset. |
| What the invoice covers | The dimension you buy. Sensor and Defend are not included in the Essential or Advanced workload price. Code is an add-on for Wiz Cloud, not for the Advanced row. | Foundations: agentless threat and misconfiguration detection, compliance, workload vulnerability scanning, IaC detection, least privilege. Advanced adds host, container, and serverless runtime security and WAAS. Named add-ons include Data Security, SCA, secrets, and CI/CD. Cortex Posture is the agentless bundle. Cortex Runtime adds cloud workload protection and WAAS. |
A Foundations credit balance is not Advanced runtime coverage. A Wiz Essential pack is not 100 sensors. Match the module name on the quote to the control you expect to run.
How cloud risk is prioritized
| Priority center | Toxic combinations on the Security Graph become Issues: misconfiguration, vulnerability, exposure, identity, and data context together | Findings across the modules on the quote: Foundations posture and code signals, Advanced or Compute runtime signals, or the Cortex Posture and Runtime counters |
|---|---|---|
| Agentless telemetry | API connectors inventory and analyze without a host agent. That is the default graph path | Foundations and Cortex Posture Management are the agentless lists, including workload vulnerability scanning |
| Runtime telemetry | The Sensor feeds live execution into the same graph and, on the sensor page, blocks and terminates processes. Defend is the log-ingestion add-on for Advanced | Advanced, Compute Edition, and Cortex Cloud Runtime Security are the licenses that include workload protection. The Defender architecture page says the agent can stop a compromised container and block an anomalous process or file write |
| Main buying consideration | Do you want graph Issues as the triage object, and is the Sensor on the Advanced quote where you also need a block? | Do you want Foundations only, or Advanced, Compute, or Cortex Runtime where the block has to be in the license? |
Both reduce a raw checklist by adding context. Wiz productizes that context as a Security Graph Issue. Prisma and Cortex productize it as the module you licensed. Runtime blocking is a named module on both sides, not a reason to treat one product as passive.
Where runtime sits on the quote
| Agentless path | Security Graph from cloud connectors. No host agent required for that inventory | Foundations, and Cortex Cloud Posture Management, including agentless workload scanning |
|---|---|---|
| Runtime path | Wiz Sensor, eBPF, sold as 100 sensors for $28,000 (USD) on a 12-month Advanced add-on. The sensor page says it detects and blocks file-integrity changes, image drift, and malicious processes, and can terminate a process. Wiz Defend is a separate $18,000 dimension for 300 GB of logs per month | Cloud Security Advanced: host, container, and serverless runtime security plus WAAS. Compute Edition: self-hosted, agentless and agent-based. Cortex Cloud Runtime Security: posture plus cloud workload protection and WAAS. Defender, on its architecture page, enforces the block and fails open if it does not answer the container start within 60 seconds |
| Edition boundary | Essential or Advanced workload packs versus Sensor, Code, and Defend dimensions. Code is 100 licenses for $58,500 (USD) as an add-on for Wiz Cloud on the same 12-month table | Enterprise SaaS versus Compute Edition. Inside Enterprise, Foundations versus Advanced. On Cortex, Posture versus Runtime, with spillover rules when both are purchased |
| Who writes the next step | Cloud owners on graph Issues. Runtime owners when the Sensor is deployed | Posture owners on Foundations or Cortex Posture. Runtime owners when Advanced, Compute, or Cloud Runtime Security is licensed |
If the open work is a block on a host or container, check that the Sensor is on the Wiz quote or that Advanced, Compute, or Cortex Runtime is on the Palo Alto quote. If the open work is an agentless inventory, Foundations or the Security Graph is the documented default. One of those choices does not mean the other product lacks the second path.
Where they overlap
Both are commercial CNAPP platforms with agentless cloud visibility, vulnerability and misconfiguration findings, identity context, and a runtime license that goes beyond the agentless scan. Both publish code-to-cloud module names: Wiz Code on one side, IaC, SCA, secrets, and CI/CD on the Prisma and Cortex lists. An RFP that only says “best CNAPP” will get adjacent demos. The remaining split is which named module is on the contract: Wiz Essential or Advanced plus Sensor, Code, or Defend, versus Prisma Foundations, Advanced, or Compute, versus Cortex Posture or Runtime.
Broader platform shortlists sit on cloud security platforms. Posture-only tools stay on CSPM tools.
When to use both
Two full CNAPP platforms on the same accounts double the triage. A narrower split is Wiz as the Security Graph system of record and a Prisma Compute or Cortex Runtime license used only where an existing Palo Alto agent install already blocks. If one team owns both queues, pick the module names you will staff.
Choose Wiz when graph Issues are the triage object and you will quote Sensor, Code, and Defend as their own dimensions, including the 12-month prices above. Choose Prisma Cloud or Cortex Cloud when the license you will operate is Foundations, Advanced, Compute Edition, Cloud Posture Management, or Cloud Runtime Security. Both sides have an agentless path and a runtime path. The contract names which one you get.
FAQs
Is Prisma Cloud Compute the same as Prisma Cloud Enterprise?
No. Enterprise Edition is the SaaS CNAPP, with Foundations and Advanced plans. Compute Edition is self-hosted workload protection and, on the license page, includes both an agentless and an agent-based approach. Cortex Cloud Posture and Cloud Runtime Security are a separate workload meter on the Cortex docs.
Does Wiz require an agent for CNAPP coverage?
No for the Security Graph. The Wiz Sensor is the runtime path. It is an add-on for Advanced at $28,000 per 100 sensors for 12 months, and the sensor page says it can block and terminate processes. It is not included in the Essential workload price.
Do both publish list prices for the full platform?
Wiz publishes the five 12-month dimensions in Editions. The feature difference between Essential and Advanced is not spelled out on that table. Prisma credits and Cortex workload units had no public dollar on the pages opened 3 Oct 2026. Per-VM credit loads from an older guide are not repeated.
Is this a hands-on bake-off?
No. The comparison uses first-party docs, the Wiz Marketplace table, the Prisma and Cortex license pages, and one community comment. We did not install either product in a paid lab tenant.
Does Google owning Wiz change multicloud support?
As of the 11 March 2026 close, Wiz first-party materials state the product remains multicloud across major public clouds. Confirm roadmap and contract language on your renewal if that constraint is material.
