Cloud Security — professional stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Container Vulnerability Scanning
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsTrivy/Grype: Free OSS unlimited scans self-hosted. Snyk: Free 200 tests/mo, Team $25/dev/mo (~$100/mo for 4 devs), Business $50/dev/mo. Aqua Advance: $50k/yr (~$4166/mo) unlimited registry. Wiz: $30k/yr (~$2500/mo) 1000 containers.
Kubernetes Runtime Security / Threat Detection
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsFalco OSS: Free unlimited events. Tetragon OSS: Free. Sysdig Team: $30k/yr (~$2500/mo) 10 hosts. Sysdig Enterprise: $50k/yr (~$4166/mo) 100 hosts + $15/host/mo overage. Aqua KubeEnforcer: $30k/yr (~$2500/mo). CrowdStrike: $59.99/host/mo.
Secrets Management for Cloud Workloads
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS: Free self-hosted. Vault HCP: $0.03/hr (~$21.90/mo per cluster) + $0.03/10k txns. AWS Secrets: $0.40/secret/mo + $0.05/10k API, free 30-day. Doppler Team: Free 5 users 100 secrets, Growth $20/user/mo. Akeyless: $30k/yr (~$2500/mo) unlimited.
Cloud KMS / Key Management Service
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS KMS: Free 20k requests/mo then $1/key/mo + $0.03/10k requests. GCP KMS: $1/key-version/mo + $0.03/10k ops, free first 6 keys. Azure Key Vault: $1/key/mo Standard, $5/key/mo Premium HSM. OpenBao OSS: Free self-hosted unlimited.
Cloud Log Management / Cloud SIEM
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsPanther Community: Free self-hosted up to 500GB/mo. Panther SaaS: Free 500GB then $0.10/GB + $0.50/1k alerts. Elastic Cloud Security: $150/mo 8GB/day. Splunk Cloud: $150/GB/mo ingest $2700/mo min. Sentinel: $2.46/GB ingest + retention.
IaC / Misconfiguration Scanning (Terraform/CloudFormation)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCheckov/tfsec/KICS: Free OSS unlimited. Snyk IaC: Free 200 tests/mo, Team $25/dev/mo, Business $50/dev/mo. Prisma Cloud IaC: $50k/yr (~$4166/mo) includes CSPM 1000 resources. Wiz IaC: Bundled $30k/yr (~$2500/mo).
CSPM - Cloud Security Posture Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsProwler/ScoutSuite: Free OSS unlimited accounts. Wiz: $30k/yr (~$2500/mo) 1000 workloads $0.50/workload/mo over. Prisma Cloud Enterprise: $50k/yr (~$4166/mo) 500 resources $0.15/resource/hr over. Orca: $40k/yr (~$3333/mo) 1000 assets.
Certificate Management for Cloud (PKI/ACME)
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitscert-manager + LE: Free unlimited 90-day certs. AWS ACM: Free public certs for AWS resources, Private CA $400/mo per CA + $0.75/cert. Venafi: $25k/yr (~$2083/mo) 1000 certs. Sectigo: $15k/yr (~$1250/mo) unlimited DV.
Cloud Infrastructure Vulnerability Management
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS OSS: Free unlimited self-hosted. Tenable.io: Free 16 assets, Team $100/mo 50 assets, Business $300/mo 200 assets + $1.50/asset over. Qualys VMDR: $40k/yr (~$3333/mo) 1000 assets.
Kubernetes Admission Control & Policy Engine
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsGatekeeper/Kyverno: Free OSS. ARMO Platform: Free 2 clusters 10 nodes, Team $250/mo 5 clusters, Enterprise $800/mo 20 clusters. Styra DAS: $40k/yr (~$3333/mo) 10 clusters. Nirmata: $30k/yr (~$2500/mo) 10 clusters.
Container Registry Security & Scanning
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsHarbor+Trivy: Free OSS unlimited. GitHub Advanced Security: $49/user/mo includes secret+container scan. JFrog Xray: $35k/yr (~$2916/mo) 10k artifacts. ECR Enhanced: $0.09/scan per image + $0.01/GB-month + Inspector $0.01/scan first 30d then tiered.
Cloud Network Firewall / FWaaS
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitspfSense/OPNsense: Free OSS + EC2 ~$20/mo t3.medium. AWS Network Firewall: $0.395/hr per endpoint (~$304/mo) + $0.065/GB processed + $0.065/GB domain list. Azure FW Basic: $0.70/hr (~$511/mo) + data. Palo Alto VM: $1.50/hr (~$1095/mo) BYOL + $50k/yr license.
Cloud WAF - Web Application Firewall
Controls and protects your APIs — quotas, abuse prevention, and firewalls. Important once you have real traffic or many clients.Pricing & free-tier limitsModSecurity OSS: Free. Cloudflare Free: Free 5 rules, Pro $20/mo unlimited rules, Business $200/mo. AWS WAF: $5/web ACL/mo + $1/rule/mo + $0.60/1M requests. Cloudflare Ent: $5000/mo min. Akamai: $30k/yr (~$2500/mo) per property.
Cloud Identity & SSO / IdP for Cloud Access
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsKeycloak OSS: Free unlimited self-hosted. AWS IAM Identity Center: Free for AWS. Auth0: Free 25k MAU, Essentials $35/mo 1k MAU + $0.15/MAU over. Okta: $8-12/user/mo workforce $30k/yr min. Entra ID P2: $9/user/mo.
Cloud Compliance Automation & Audit
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsProwler/InSpec: Free OSS. Vanta Starter: $10k/yr (~$833/mo) 1 framework 20 employees. Vanta Scale: $30k/yr (~$2500/mo) SOC2+ISO27001 unlimited. Drata Starter: $10k/yr (~$833/mo), Growth $20k/yr, Enterprise $35k/yr. Secureframe: $12k/yr starter.
Image Signing & Supply Chain Attestation (Sigstore/Cosign)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsCosign/Sigstore: Free OSS public infra unlimited. Chainguard Enforce: Free 10 containers, Team $500/mo 50 images, Enterprise $35k/yr (~$2916/mo) unlimited+SBOM. Docker Scout: Free 3 repos, Team $15/user/mo. JFrog: $35k/yr (~$2916/mo).
Runtime Container Network Policy / Service Mesh Security
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsCilium/Istio/Linkerd OSS: Free unlimited. Cilium Enterprise: $30k/yr (~$2500/mo) 100 nodes $0.10/node/hr over. Calico Cloud Free: Free 1 cluster, Team $300/mo 5 clusters, Ent $1000/mo 20 clusters. Gloo Mesh Ent: $50k/yr (~$4166/mo).
Cloud DNS Security & Filtering
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsPi-hole OSS: Free self-hosted. Cloudflare Gateway Free: Free 50 users, Team $7/user/mo, Ent $10/user/mo. Route53 Firewall: $0.60/rule group/million queries + $0.002/query. Cisco Umbrella: $30k/yr (~$2500/mo) 500 users $5/user/mo.
Cloud Workload Protection Platform (CWPP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFalco/Osquery/Wazuh: Free OSS unlimited agents. CrowdStrike Go: $59.99/host/mo ($300/mo min 5 hosts). Pro $99.99/host/mo, Enterprise $149.99/host/mo. Aqua Ent: $50k/yr (~$4166/mo) 100 workloads + $35/workload/mo overage.
CIEM - Cloud Infrastructure Entitlement Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCloudsplaining/Cartography: Free OSS. Sonrai Dig: Free 1 account. Wiz CIEM: $30k/yr (~$2500/mo) 1000 identities $0.25/identity/mo over. Tenable CIEM: $40k/yr (~$3333/mo) 2000 identities. Entra Permissions: $7.50/identity/mo.
Cloud DDoS Protection
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCloudflare Free: Free unmetered L3/L4 DDoS. AWS Shield Standard: Free. AWS Shield Advanced: $3000/mo per org + $0.05/GB over + $0.10/1M WAF req. Cloudflare Pro: $20/mo, Business $200/mo. Magic Transit: $5000/mo minimum.
Cloud API Security Gateway
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsKrakenD/APISIX OSS: Free unlimited self-hosted. AWS API Gateway: $3.50/1M HTTP requests + $0.09/hr custom domain. Kong Plus: $250/mo 7.5M requests, Ent $40k/yr (~$3333/mo). Salt Security: $45k/yr (~$3750/mo).
SASE / ZTNA for Cloud Access
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNetmaker/OpenZiti/Headscale: Free OSS self-hosted. Tailscale Teams: Free 50 devices, Premium $6/user/mo. Cloudflare Access: Free 50 users, Team $7/user/mo, Ent $14/user/mo. Zscaler ZPA: $70k/yr (~$5833/mo) 500 users $10/user/mo. Prisma Access: $12/user/mo min 200 users $28800/yr.
Policy as Code Engine Hosting (OPA/Kyverno)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsOPA/Kyverno/Conftest: Free OSS unlimited policies. Styra Free: Free 1 env 100 decisions/sec, Team $500/mo 5 envs, Ent $40k/yr (~$3333/mo). Spacelift: Free 1 seat, Team $149/mo, Ent $2000/mo. Nirmata Ent: $30k/yr (~$2500/mo).
Cloud Asset Inventory / Attack Surface Management
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsCartography/CloudQuery: Free OSS unlimited assets self-hosted. JupiterOne Free: Free 100 assets, Team $200/mo 500 assets. Wiz: $30k/yr (~$2500/mo) 1000 assets EASM incl. Cortex Xpanse: $60k/yr (~$5000/mo) 1M IPs scanned + $0.05/IP over.
Cloud Data Loss Prevention (DLP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenDLP OSS: Free. AWS Macie: Free 30d then $5/GB S3 scanned + $1/1k sensitive objects. GCP DLP: $3/GB inspected, $6/GB de-identify. Nightfall: Free 1k scans, Growth $200/mo 5k scans. Purview DLP: $10/user/mo E5.
Microsegmentation for Cloud Workloads
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCilium/Calico OSS: Free unlimited policies. Calico Cloud Team $300/mo 5 clusters. Illumio CloudSecure Free 100 workloads, Ent $80k/yr (~$6666/mo) 500 workloads $13/workload/mo over. Guardicore Centra: $70k/yr (~$5833/mo) 500 agents.
Cloud HSM - Hardware Security Module
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSoftHSM OSS: Free dev not FIPS for prod. AWS CloudHSM: $1.88/hr per HSM (~$1373/mo) + instance + $1.45/hr backup. Azure Dedicated HSM: $2.513/hr (~$1834/mo) per HSM. Thales DPoD: $3.50/hr (~$2555/mo) per partition. GCP Cloud HSM: $5/key/mo HSM-backed.
CNAPP - Unified Cloud Native Application Protection Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOSS bundle: Free self-hosted unlimited. Wiz CNAPP: $30k/yr (~$2500/mo) base 100 workloads + CSPM+CIEM+CWPP+Registry. Prisma Cloud Ent CNAPP: $50k/yr (~$4166/mo) 500 resources + $0.10/resource/hr. Orca: $40k/yr (~$3333/mo) 1000 assets CNAPP full. Sysdig CNAPP: $50k/yr (~$4166/mo).
Cloud Security Orchestration & Automated Response (SOAR)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsShuffle/StackStorm OSS: Free unlimited self-hosted. Tines Starter: Free 1000 actions/mo, Team $300/mo 10k actions, Business $1200/mo. Torq Free: Free 1000 steps/mo, Growth $5000/yr 25k steps. Cortex XSOAR: $60k/yr (~$5000/mo) 10 analysts. Splunk SOAR: $50k/yr (~$4166/mo).
How this professional cloud security checklist works.
Each requirement below is something a professional cloud security build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.