Same-subcategory comparison

Microsoft Defender for CloudvsRapid7 InsightCloudSec

Compare buyer fit, pricing, capability depth, and purchase constraints within one buying category. A higher score is not a universal winner.

Comparison summary

How to choose

These conclusions apply to this subcategory and the buyer conditions shown here. They do not make one product universally better.

Microsoft Defender for Cloud

Consider when

Azure-centered organizations wanting native policy, management-group, automation, and Microsoft security integration
Teams that want a free multicloud baseline before selectively enabling advanced paid CSPM

Check before choosing

Buyers requiring one flat public paid price across every cloud resource type
Teams expecting Foundational CSPM to include graph, attack paths, security explorer, or advanced governance

Full profile

Rapid7 InsightCloudSec

Consider when

Enterprises with AWS, Azure, GCP, OCI, Alibaba Cloud, sovereign partitions, and Kubernetes
Cloud governance programs needing custom policy, exceptions, audit exports, guardrails, and remediation Bots

Check before choosing

Small estates that require a published direct tier below 251 billable resources
Buyers expecting a flat fee unaffected by quarterly resource reconciliation

Full profile

Dimension	Microsoft Defender for Cloud	Rapid7 InsightCloudSec
Pricing and trial	Foundational CSPM 0 · per cloud scope · Foundational CSPM enabled for Azure subscriptions, connected AWS accounts, or connected GCP projects; new Azure subscriptions must opt in starting October 27, 2026 Defender CSPM Amount unverified — check official pricing The zero-price Foundational CSPM offer is exact and retained. Paid Defender CSPM is withheld from numeric offers: the pricing page lists compute, storage, database, and serverless meters and conversion rules, while the August 7 product overview lists only compute, storage, and databases by cloud; the paid amount is hidden in the captured pricing table. Microsoft directs buyers to the calculator, their Azure agreement, sales, or partners. A separate one-year pre-purchase plan offers commit-unit discounts but is a broader Defender for Cloud purchasing vehicle, not a CSPM-only SKU. Azure pay-as-you-go Defender CSPM: Enable Foundational CSPM or paid Defender CSPM on Azure subscriptions and connected AWS or GCP scopes, with usage billed through the Azure agreement. Microsoft sales or Azure partner: Acquire Defender CSPM through Microsoft sales or an Azure partner when agreement-specific pricing, government eligibility, or multicloud scope needs commercial confirmation. One-year Defender Commit Units: Pre-purchase a noncancelable one-year pool usable across publicly available Defender for Cloud plans, including Defender CSPM. Published pool discounts range from 10% to 22% by commit-unit tier, and unused units expire at term end. Full profile	InsightCloudSec $66000 USD · per subscription · per year · Direct 500 resource tier · billed annually · one-year commitment · minimum 251 average billable resources · Trailing-month average of 251-500 defined billable resources during each quarter $93000 USD · per subscription · per year · Direct 750 resource tier · billed annually · one-year commitment · minimum 501 average billable resources · Trailing-month average of 501-750 defined billable resources during each quarter $120000 USD · per subscription · per year · Direct 1,000 resource tier · billed annually · one-year commitment · minimum 751 average billable resources · Trailing-month average of 751-1,000 defined billable resources during each quarter $222000 USD · per subscription · per year · Direct 2,000 resource tier · billed annually · one-year commitment · minimum 1001 average billable resources · Trailing-month average of 1,001-2,000 defined billable resources during each quarter $318000 USD · per subscription · per year · Direct 3,000 resource tier · billed annually · one-year commitment · minimum 2001 average billable resources · Trailing-month average of 2,001-3,000 defined billable resources during each quarter $438000 USD · per subscription · per year · Direct 5,000 resource tier · billed annually · one-year commitment · minimum 3001 average billable resources · Trailing-month average of 3,001-5,000 defined billable resources during each quarter $784000 USD · per subscription · per year · Direct 10,000 resource tier · billed annually · one-year commitment · minimum 5001 average billable resources · Trailing-month average of 5,001-10,000 defined billable resources during each quarter $1043000 USD · per subscription · per year · Direct 15,000 resource tier · billed annually · one-year commitment · minimum 10001 average billable resources · Trailing-month average of 10,001-15,000 defined billable resources during each quarter Direct documentation binds eight numeric annual resource tiers, a one-year contract, annual invoicing, and quarterly reconciliation. The separate AWS Marketplace route binds USD 69,300 to a 12-month 500-asset contract with recurring monthly AWS billing. The marketing page's USD 5,775 monthly reference is not retained as an offer because its commercial state is incomplete. Rapid7 direct subscription: Annual InsightCloudSec contract purchased directly under the published resource-tier model. AWS Marketplace 500-asset contract: Exact-product 12-month Marketplace contract for 500 assets, billed through AWS. Full profile
Best for	Azure-centered organizations wanting native policy, management-group, automation, and Microsoft security integration Teams that want a free multicloud baseline before selectively enabling advanced paid CSPM Enterprises needing attack paths, CIEM, data-aware posture, critical assets, and custom multicloud recommendations	Enterprises with AWS, Azure, GCP, OCI, Alibaba Cloud, sovereign partitions, and Kubernetes Cloud governance programs needing custom policy, exceptions, audit exports, guardrails, and remediation Bots Organizations needing SaaS, self-hosted, or managed self-hosted deployment choices
Not for	Buyers requiring one flat public paid price across every cloud resource type Teams expecting Foundational CSPM to include graph, attack paths, security explorer, or advanced governance Organizations seeking a CSPM purchase that automatically includes Sentinel, Purview, runtime Defender plans, Security Copilot, or managed response	Small estates that require a published direct tier below 251 billable resources Buyers expecting a flat fee unaffected by quarterly resource reconciliation Teams treating documented adjacent CNAPP modules as automatically entitled CSPM features
Source check	99/100	99/100
Key features	Free Foundational CSPM across Azure, AWS, and GCP Multicloud inventory, Microsoft Cloud Security Benchmark, Secure Score, recommendations, and workbooks Paid intelligent cloud security graph, security explorer, and contextual attack paths Native CIEM across Azure, AWS, and GCP Agentless VM vulnerability and secrets scanning plus Kubernetes and container posture	Commercial, government, and China cloud coverage plus OCI, Alibaba Cloud, and Kubernetes Normalized cloud inventory, source documents, tags, applications, and related-resource context Hundreds of Insights, custom checks, compliance packs, custom packs, and scorecards Approval, owner, expiration, notification, and export controls for exemptions Layered resource risk using exposure, business, IAM, attack-path, threat, data, and vulnerability signals
Cons	Current official pages disagree on whether serverless resources appear in the complete Defender CSPM billable scope The captured pricing table suppresses the paid amount and agreement-specific Azure pricing can vary Enabling paid CSPM broadly can meter resources across connected Azure, AWS, and GCP estates after the trial state	Direct and AWS Marketplace 500-level offers differ in amount and quantity terminology Quarterly reconciliation can change effective cost as the monitored resource average changes Active IAM roles and Kubernetes nodes can become opt-in billable resources
Category buying score	80	85Higher category-fit score
Rank	#5	#2
Context	Security & Privacy / Cloud Security Posture Management (CSPM) Software	Security & Privacy / Cloud Security Posture Management (CSPM) Software
Cloud coverage and visibility	84Free multicloud inventory, workbooks, and Secure Score establish baseline visibility, and paid agentless scanning plus the security graph and explorer expand asset and relationship views, subject to connector coverage and resource-type support differences.	89The platform offers normalized cloud inventory with source documents, tags, applications, and related-resource context, which supports broad visibility, but the supplied facts do not enumerate every object type or every cloud account boundary.
Detection and policy depth	80MCSB assessments and standard recommendations run on Foundational CSPM, while paid Defender CSPM enables custom KQL recommendations and deeper agentless and container posture checks, so detection depth scales with the chosen plan and enabled scopes.	88Provides comprehensive custom policy options and standard compliance checks, though base posture options do not automatically include adjacent workload protections.
Risk prioritization and context	86The paid cloud security graph, attack paths, CIEM identity context, data-aware posture, and critical-asset marking supply the primary risk-context layer; without Defender CSPM those contextual signals are not part of the free baseline.	85Maps complex threat pathways and exposure points, but the inclusion of vulnerability and data-specific context relies on adjacent modules.
Remediation operations	79Remediation tools, workflow automation, Logic Apps, REST APIs, and DevOps-related integrations support operational follow-through, but buyers still need to configure scopes, roles, and connected services.	86BotFactory supports automation for policy, lifecycle, notification, ticketing, and guardrails, which enables remediation operations, but the facts do not confirm full native execution for every operational step or target system.
Compliance and governance	82The paid plan adds governance rules, assigning owners, and setting due dates, which are missing from the base benchmark tracking in the free plan.	90Approval, owner, expiration, notification, and export controls for exemptions support compliance governance, and the documented compliance packs and scorecards reinforce that use case, though the exact framework coverage is not fully enumerated.
Integrations and reporting	80Export, workbooks, REST APIs, Event Hubs, Log Analytics, Sentinel, ServiceNow, GitHub, and Azure DevOps provide broad reporting and integration options, but several targets are separate services rather than included capabilities.	82Public API, ServiceNow modules, custom integrations, and multi-tenant organizations support integrations and reporting workflows, but the facts do not establish bidirectional sync quality, latency, or the full reporting catalog.
Support and total cost	62Foundational CSPM at zero cost lowers the entry barrier, but Defender CSPM pay-as-you-go metering lacks a retained public amount, carries serverless-scope ambiguity, and can accumulate separate charges for Logic Apps, exports, Sentinel, and related services, so total cost depends heavily on estate size and connected-service design.	64Pricing is annual and tiered by monitored resources with quarterly reconciliation, and active IAM roles and Kubernetes nodes can be opt-in billable resources, which adds commercial complexity even though no additional license charge is stated for some deployment choices.
Full profile	Full profile	Full profile

Comparison summary

Most material score differences

These are the stored dimension rationales returned with each score. They explain the buyer conditions behind the gap without speculating about hidden model reasoning.

Detection and policy depth

8 pts

Microsoft Defender for Cloud · 80/100: MCSB assessments and standard recommendations run on Foundational CSPM, while paid Defender CSPM enables custom KQL recommendations and deeper agentless and container posture checks, so detection depth scales with the chosen plan and enabled scopes.
Rapid7 InsightCloudSec · 88/100: Provides comprehensive custom policy options and standard compliance checks, though base posture options do not automatically include adjacent workload protections.

Compliance and governance

8 pts

Microsoft Defender for Cloud · 82/100: The paid plan adds governance rules, assigning owners, and setting due dates, which are missing from the base benchmark tracking in the free plan.
Rapid7 InsightCloudSec · 90/100: Approval, owner, expiration, notification, and export controls for exemptions support compliance governance, and the documented compliance packs and scorecards reinforce that use case, though the exact framework coverage is not fully enumerated.

Remediation operations

7 pts

Microsoft Defender for Cloud · 79/100: Remediation tools, workflow automation, Logic Apps, REST APIs, and DevOps-related integrations support operational follow-through, but buyers still need to configure scopes, roles, and connected services.
Rapid7 InsightCloudSec · 86/100: BotFactory supports automation for policy, lifecycle, notification, ticketing, and guardrails, which enables remediation operations, but the facts do not confirm full native execution for every operational step or target system.

Research basis

This page uses stored product facts, official evidence, and category scoring rationales. It is not an account-based hands-on test, and third-party user ratings are not folded into the category buying score.

Microsoft Defender for Cloud: Fact confidence: 99% · Fact checked: 2026-08-10
Rapid7 InsightCloudSec: Fact confidence: 99% · Fact checked: 2026-08-10

More tools

Cloud Security Posture Management (CSPM) Software

Add more tools from the same subcategory to this comparison. The page keeps up to 6 tools.

Palo Alto Networks Prisma Cloud

Prisma Cloud is a SaaS CNAPP whose CSPM entitlement combines agentless multicloud inventory, configuration and compliance policy, IAM context, attack-path analysis, threat correlation, remediation guidance, automation, and enterprise integrations.

Rapid7 InsightCloudSec

Rapid7 InsightCloudSec is a cloud security platform with agentless multicloud inventory, CSPM policy checks, compliance governance, attack paths, contextual risk scoring, no-code remediation bots, APIs, and optional adjacent CNAPP capabilities.

85Compared

Wiz Cloud Security Platform

Wiz Cloud Security Platform delivers CSPM through Wiz Cloud, using agentless cloud API connections, the Wiz Security Graph, configuration rules, compliance frameworks, attack-path context, remediation workflows, and a broad integration ecosystem.

Orca Security Platform

Orca Security Platform delivers CSPM inside an agentless-first CNAPP, using cloud API and SideScanning data, a unified asset and relationship model, configuration controls, compliance frameworks, attack paths, automation, remediation guidance, and enterprise integrations.

Microsoft Defender for Cloud

Microsoft Defender for Cloud provides free Foundational CSPM and paid Defender CSPM plans, combining multicloud inventory, secure score, policy assessment, compliance, a cloud security graph, attack paths, data and identity context, governance, and workflow automation.

80Compared

Qualys TotalCloud

Qualys TotalCloud delivers CSPM through the Qualys Enterprise TruRisk Platform, with connectors for AWS, Azure, GCP, and OCI, centralized inventory, continuous controls, compliance governance, attack-path context, remediation, and enterprise workflow integrations.

Tenable Cloud Security

Tenable Cloud Security is Tenable's current CNAPP domain for agentless cloud inventory, CSPM, compliance, identity-aware risk analysis, attack paths, remediation, and developer guardrails across AWS, Azure, GCP, OCI, and Kubernetes. It is sold through quote-based standalone or Tenable One Cloud Exposure routes using billable cloud-resource scope rather than a public monetary rate.

AWS Security Hub

AWS Security Hub is a unified cloud security service whose Essentials plan combines Security Hub CSPM, Amazon Inspector vulnerability management, security-focused inventory, contextual exposure analytics, and response workflows under resource-unit pricing.

Sysdig Secure

Sysdig Secure delivers CSPM inside its broader CNAPP through agentless cloud connections, Kubernetes posture checks, dynamic inventory, graph search, custom posture controls, compliance governance, IaC remediation, and CSPM APIs.

#10

Lacework FortiCNAPP

Lacework FortiCNAPP is Fortinet's SaaS CNAPP whose cloud-security tiers all include CSPM and KSPM resource discovery, configuration management, custom policies, compliance reporting, and secrets detection, with advanced risk, attack-path, CIEM, workload, DSPM, and code-security capabilities gated or separately licensed.

More comparisons