Everyone's pushing platform-native tools (AWS Security Hub, Defender). They're okay if you like paying for two separate mediocre dashboards and doing double the integration work.
For under 1000 users, you don't need a "comprehensive" suite that bills per node and requires a team to manage. You need visibility without the enterprise circus. My take:
* **Wiz** if budget isn't a primary constraint. Good coverage for both clouds and your k8s clusters. Their agentless approach keeps the ops overhead low.
* **Orca** as a more budget-conscious alternative. Does the core CSPM/CWPP job without the bells and whistles you'll never use.
* **Forget a full CNAPP**, stitch together: **Terrascan/IaC scanning in pipeline, Sysdig for runtime in k8s, and a cloud-agnostic CSPM like Lacework**. More work, but you actually know what each piece does.
The "best practice" of a single vendor pane of glass is for teams that like vendor lock-in and bloated contracts. Fight me.
I run the Grafana observability stack for a mid-sized fintech (~300 users), and we have a hybrid AWS/Azure split that's about 60/40. For cloud security, we've evaluated most major CNAPPs over the last 18 months and currently run one in production.
Here's the breakdown from our evaluations and POCs, focusing on the sub-1000 user scenario:
**Real fit for sub-1000 users**: Wiz and Orca both aim here, but Orca often works for sub-200 user environments. The bigger players like Palo Alto or Microsoft really want 500+ seats to make their sales motion work. Wiz sits in the middle, targeting 200-1000 as their sweet spot.
**Pricing reality**: Wiz quotes came in around $8-12 per user per month for the full platform, and they push hard for that. Orca was about half that, $4-6 per user, but you're buying core CSPM and CWPP, not the kitchen sink. The hidden cost for both is data egress/scanning fees if you exceed baseline API call volumes, which can add 15-20% if your cloud accounts are very active.
**Deployment and ongoing work**: Wiz's agentless setup got us seeing data in about 2 hours. The real lift was tuning the alert policies and building custom Grafana dashboards off their API, which took another 8-10 hours. Orca was similar on setup, but we found its k8s runtime alerts needed more fine-tuning out of the gate to reduce noise.
**Where it breaks or shines**: Wiz clearly wins on breadth and the interconnectivity graph. Seeing a vuln, the exposed asset, and the lateral movement path in one view is powerful. Its limitation is cost creep if you enable every new module. Orca's win is simplicity and a lower sticker price, but its reporting feels more rigid. It didn't handle our Azure DevOps CI/CD scanning as cleanly as Wiz did.
For your situation, I'd recommend Orca if your primary need is solid CSPM and basic CWPP with minimal fuss and you're cost-sensitive. Go with Wiz if you have the budget and want that deeper attack path analysis across both clouds and containers. To decide cleanly, tell us: what's your actual seat count, and is your compliance team driving the purchase or is it engineering/DevOps?
- GG
The whole "stitch together your own tools" thing sounds great until you're the one stitching. Terrascan, Sysdig, Lacework - that's three different APIs, three different alert formats, three different billing cycles. And good luck getting the correlation between IaC findings and runtime alerts to work without building your own middleware. For a team under 1000 users, the ops overhead of maintaining that pipeline probably eats whatever you saved on licensing. I'd rather have one mediocre dashboard I can actually log into than three good ones that never talk to each other.
Show me the data
I get the frustration with big suites, but that "stitch together" approach sounds like a full-time job itself. You mentioned Terrascan, Sysdig, and Lacework. Have you actually run this combo in production for a hybrid setup? I'm worried about the alert fatigue from three different systems, especially during an incident when you need one clear story.
For a smaller team, isn't the integration work between those tools just trading vendor lock-in for DIY lock-in? You'd be building and maintaining that "single pane" yourself.
One step at a time
You're absolutely right about the "three different APIs, three different billing cycles" problem. It's a hidden tax.
I tried a lighter DIY version last year with just Terrascan and a cloud CSPM. Even that simple correlation became a manual, weekly review task that nobody wanted. The time spent building the connectors and normalizing alerts quickly offset the lower sticker price.
A single dashboard you'll actually use is almost always better than three perfect ones you'll avoid.
Docs save time