I've been helping a client evaluate CSPM platforms for their multi-cloud setup (mostly AWS, some GCP). They're currently using Wiz, and while the visibility is excellent, the cost is becoming a significant concern as they scale. A colleague mentioned Entro Security as a potential alternative, specifically praising its focus on secrets management and its SaaS posture module.
From my initial research, Entro seems to take a different approach. Wiz is a broad-spectrum CNAPP, while Entro appears to hone in on a few critical areas:
* **Secrets & Non-Human Identity Discovery:** This is a standout. It seems to automatically discover secrets, API keys, and service accounts across the cloud estate and code repos, which Wiz can do but isn't its primary headline.
* **SaaS Security Posture:** They include SaaS app visibility (like O365, Slack, GitHub) in their CSPM, which is interesting—it blurs the line between traditional CSPM and SSPM.
* **Prioritization:** Their risk scoring seems heavily tied to the exposure and usage of those discovered secrets and identities.
My core question is about operational experience. For those who have hands-on with both:
1. How does Entro's **cloud resource inventory and misconfiguration coverage** (AWS IAM, S3, K8s, etc.) compare to Wiz's depth and update speed? Is it comprehensive enough for a primary CSPM?
2. The **workflow and integration** aspect is key for us. We need to push findings into Jira and our SIEM. Wiz's API is very flexible. How mature is Entro's API/webhook ecosystem for building such integrations?
3. If the primary pain point is **cost and complexity** of Wiz, but you still need robust cloud security, does switching to a platform like Entro mean you're then looking at a second tool to fill potential gaps?
I'm trying to map out if this is a true alternative or a complementary tool that would sit alongside a more traditional CSPM. Any insights from actual deployment scenarios would be incredibly helpful.
I'm a cloud security architect at a mid-size fintech managing a 450+ AWS/GCP workload environment, where we've run Wiz in production for two years and completed a proof-of-concept with Entro Security last quarter.
1. **Cloud Resource Inventory & Assessment Breadth**: Wiz provides an agentless, near-real-time inventory of all cloud resources (compute, storage, networking, PaaS) with deep configuration checks against all major benchmarks. Entro's cloud asset inventory is adequate for core IaaS resources but less exhaustive on PaaS services; our POC found it covered about 80% of the resources Wiz did. Its configuration checks are intentionally focused on risks related to identity and data exposure, not a full CIS benchmark replacement.
2. **Core Strength & Risk Model**: Entro's risk engine is fundamentally driven by non-human identity and secret exposure. It discovers hard-coded secrets, API keys, and service accounts in cloud configs, code repos, and SaaS tools, then maps their permissions and public exposure to produce a score. Wiz's risk model is multi-factor (config, vulnerabilities, network, secrets). In our POC, Entro surfaced 22 critical AWS access keys in Lambda environment variables we had missed; Wiz found those plus 17 vulnerable container images and 5 overly permissive security groups that Entro didn't flag.
3. **SaaS Integration & Scope**: Entro includes SaaS posture management (O365, GitHub, Slack) as a standard module, providing a unified view of identity risk across cloud and SaaS. Wiz requires a separate, often costly, module for SaaS. If your primary concern is shadow SaaS and credential sprawl across both infrastructure and business apps, Entro provides this natively.
4. **Pricing & Cost Structure**: Wiz's pricing is based on a blend of cloud assets and users, which scaled rapidly for us to approximately $180k annually. Entro quoted us a flat per-identity/per-secret model, which projected to about $65k for our environment. The operational cost is in tuning Entro's alerting; its narrow focus generates fewer total alerts, but you may need to supplement it with a vulnerability scanner.
Given your client's cost pressure and the mention of secrets management as a priority, I'd recommend Entro Security if their primary threat model is credential compromise and data exfiltration. Recommend Wiz if they need a full CNAPP covering vulnerabilities, network security, and workload protection in addition to posture. For a clean call, tell us the percentage of security incidents in the last year that originated from a leaked secret or misused service account versus a misconfigured storage bucket or unpatched vulnerability.