Best Kubernetes security tool for a 200-user shop on AWS EKS

We are in the process of consolidating our container security posture for a significant EKS footprint (around 200 developers, multiple clusters across staging/prod). The primary goal is to enforce compliance guardrails, provide vulnerability management across the CI/CD pipeline and runtime, and have clear audit trails for SOC2. We've narrowed the evaluation to Aqua Security, but I'm seeking concrete, operational feedback from teams at a similar scale.

Our core requirements are:

* **Infrastructure-as-Code Native:** The tool must be deployable and configurable via Terraform or Helm with values files, not just a web UI. We need to manage policy-as-code.
* **Runtime Protection with Low Friction:** Need to understand the performance overhead and operational complexity of their enforcers. Do they use eBPF or a sidecar model? What's the failure mode if the agent is saturated?
* **AWS EKS Integration Depth:** How well does it handle IAM roles for service accounts (IRSA), integrate with AWS Security Hub, and manage ECR scanning natively?
* **Compliance Mapping:** The ability to map findings directly to specific SOC2 controls or CIS benchmarks is a hard requirement for our compliance team.

Specifically, I'd like to understand the following from your experience:

* **Deployment & Management:** How stable is the cluster-side component (scanner, enforcer) deployment? Did you encounter any conflicts with other DaemonSets (e.g., logging agents, service meshes)?
* **Policy Management:** How granular and flexible is the policy engine? Can you share an example of a custom policy you wrote, perhaps to block a specific outbound connection or enforce a resource limit?
* **Operational Overhead:** What is the ongoing maintenance burden? This includes updating vulnerability databases, tuning false positives, and managing alert fatigue.
* **Cost Structure Nuances:** At our scale, the per-node or per-image pricing models can diverge significantly. Any unexpected cost drivers we should be aware of?

To frame the discussion, here's a snippet of how we are currently provisioning a similar tool via Terraform, which we'd expect to replicate for Aqua:

```hcl
# Example of our desired pattern - not Aqua-specific
resource "helm_release" "security_agent" {
name = "container-security"
repository = "https://helm.aquasec.com"
chart = "scanner"
namespace = "aqua"

set {
name = "controller.serviceAccount.annotations.eks\.amazonaws\.com/role-arn"
value = module.iam_assumable_role_aqua.iam_role_arn
}

set {
name = "config.registry"
value = var.ecr_registry_url
}

# Policy-as-code: loading a custom rule bundle from a ConfigMap
set {
name = "controller.policyBundleConfigMap"
value = kubernetes_config_map.policy_bundle.metadata[0].name
}
}
```

The focus is on long-term operational sustainability, not just initial feature checks. Any insights on scaling the console, API reliability, or integration into an incident response workflow would be particularly valuable.