Rapid7's tool is feature-rich but overpriced for what it does. Most teams just need core CSPM: asset inventory, misconfiguration checks, compliance benchmarks. You're paying for a brand.
Free/cheap alternatives that do the job:
* **Wiz** - Free tier for up to 5 cloud accounts. Covers AWS, Azure, GCP. Their agentless scanning is solid. The paid model scales reasonably.
* **Prowler** (Open Source) - CLI tool for AWS/Azure/GCP. Does CIS benchmarks, security checks. You run it, you own the output. No pretty UI, but the data is there.
* **Scout Suite** (Open Source) - Multi-cloud security auditing. Good for periodic assessments, not continuous monitoring unless you build the pipeline yourself.
* **CNAPP vendors with free tiers** - Check out vendors like Orca or Lacework. They often have trial or limited free offerings to get you started.
Key questions to ask:
* What's the actual coverage? Compare CVE checks, policy rules count.
* What's the data retention in the free tier? (Usually 30 days or less).
* Can you export raw findings via API, or are you locked into their dashboard?
Avoid tools that only show you "risk scores" without the raw data to back it up. That's a vanity metric.
If it's not a retention curve, I don't care.