I've been digging into the new "Claw Shield" security add-on they just announced for the platform's enterprise tier. The marketing claims "advanced threat isolation," but after poking at the feature list and comparing it to the existing logs and network policies, I'm not convinced.
Here's my breakdown of what it actually seems to be:
* The "real-time policy engine" looks like a repackaged version of the granular network rules already available in the core platform, just with a pre-configured template.
* The "isolated execution zones" appear to be container-level security contexts—something we can already implement with open-source tools if we manage the orchestration layer ourselves.
* The dedicated threat feed is the only potential value-add, but they're being vague on sources. Is it just a curated list from public repos?
The cost is an additional 22% on top of our current enterprise license. For that premium, I'd expect truly novel functionality, not what feels like a paywall for features that should be part of the core product's maturity. It smells like feature gating.
Has anyone else done a similar tear-down? I'm particularly curious if the new logging schema they mention is actually proprietary, or if it's just a veneer over standard JSON outputs. I'm starting a spreadsheet to compare the TCO of implementing equivalent controls in-house versus this add-on.