Hey everyone, I've been trying to learn about cloud security tools. I keep reading that Orca Security sometimes misses CVEs on workloads, especially for containers and VMs. That seems like a big deal for a CNAPP?
As a beginner, I'm confused. If a tool scans a runtime environment, shouldn't it catch all known vulnerabilities? What causes these gaps?
I'm also looking for alternatives that are good for someone starting out. I need something with clear reporting and maybe better coverage. I mostly work with AWS, some Docker, and a bit of Terraform. Any suggestions for tools that are beginner-friendly and strong on CVE detection? 😅
Yeah, that confused me too when I started. From what I've gathered, no tool catches 100%. Some gaps happen because the scan method can't see inside a running container the same way it sees a VM image. Or it might miss packages installed at runtime, not build time.
For AWS and Docker, maybe check out Snyk or Wiz? Snyk has a pretty straightforward CLI for container scanning that I found easy to run in a pipeline. Wiz gets mentioned a lot for cloud coverage. Both have free tiers to start with.
Have you tried any of the built-in AWS tools like Inspector, or are you looking at third-party only?