Onam Database Security

Onam Database Security is a posture and benchmark service for teams responsible for databases spread across several clouds and self-hosted environments. It is best suited to security and compliance groups that need configuration findings tied to data sensitivity and identity access. Its broad coverage is compelling, but the Pro bill grows with every protected resource.

Overview

Onam discovers database resources in AWS, Azure, GCP, OCI, IBM Cloud, Alibaba and Kubernetes through read-only APIs. Supported services include RDS, Aurora, Azure SQL, Cloud SQL, DynamoDB, Redshift and OCI DB Systems, alongside other databases. Cloud checks use provider control-plane APIs, while optional engine assessments require a customer-provisioned read-only database account. That makes an initial posture review less intrusive, with a separate setup requirement for deeper benchmark coverage.

Findings are combined with DSPM data classification and CIEM identity context, so teams can prioritize sensitive databases and identify the principals able to access them. Checks cover encryption, public accessibility, backup retention, deletion protection, audit configuration, snapshot exposure and privileged database grants. Onam says it retains credential references rather than plaintext cloud credentials and encrypts stored configurations and findings with AES-256 at rest.

Key features

CIS benchmarks cover PostgreSQL, MySQL, MariaDB, MSSQL, Oracle, IBM Db2, MongoDB and Cassandra. Onam maps findings to 78 compliance frameworks and produces PDF and CSV auditor exports with linked evidence, useful when a security review must become an audit package rather than a dashboard exercise.

Email and Slack notifications and REST API access are included with Pro. Enterprise adds webhooks, SIEM integration and a Terraform provider. The combination of privilege analysis, data classification and remediation guidance gives risk teams more context than a configuration-only scanner, although engine-level checks depend on maintaining the read-only database connection.

Pricing

Free

The Free plan costs nothing, billed forever. It covers one cloud account and up to 500 resources, with core CSPM rules for Critical and High findings, CIS benchmark coverage, 30-day finding history and community support. It is a sensible pilot or fit for a small estate; the account and resource caps, shorter history and lack of paid support constrain larger operations.

Pro

Pro costs $22 a month, billed per resource each month: a platform fee plus $22 per resource. It removes the account limit, includes all 29 engines, all 78 compliance frameworks and one year of finding history, with email support responding in under 24 hours. This is the practical tier for multi-cloud teams, but resource-based billing makes the total materially dependent on estate size.

Enterprise

Enterprise uses custom pricing on an annual contract. It includes everything in Pro, plus multi-tenant support, SSO and SAML 2.0, an on-premises deployment option, a contractual 99.9% uptime SLA and priority support in under four hours with a customer success manager. Choose it when deployment control, tenant separation or formal service commitments matter.

A 14-day trial is available. Free and Pro use SaaS deployment; Enterprise can be SaaS or on premises.

Platforms

Onam is offered through an API, web interface and self-hosted deployment options. Its hybrid deployment coverage suits organizations combining cloud databases with privately operated systems, while agentless discovery keeps cloud collection on read-only provider APIs.

Who it's for

Choose Onam for security teams overseeing databases across multiple cloud providers, mixed managed and self-hosted estates, or compliance programs that need evidence linked to actual access and data sensitivity. It is less suitable when you only need a single-engine benchmark, have more than 500 resources but cannot justify per-resource Pro billing, or require on-premises deployment without an Enterprise contract.

Pros and cons

Pros

Cross-cloud discovery spans seven named providers plus Kubernetes, reducing the need for separate inventory tools.

Data-classification and identity context help prioritize exposed sensitive databases and the principals reaching them.

Eight major database engine families receive CIS benchmark coverage.

Framework mapping and linked PDF/CSV evidence support audit preparation.

Free access is permanent rather than a time-limited evaluation, within one account and 500-resource limits.

Cons

Pro combines a platform fee with a $22-per-resource monthly charge, so large estates can become expensive.

Engine-level assessments require customers to provision and maintain a read-only database account.

The Free plan limits history to 30 days and support to the community.

SSO, on-premises deployment, SLA coverage and faster support require Enterprise custom pricing.

Alternatives

Browse the Database Vulnerability Scanners list when you want to compare a wider field.

Qualys External Attack Surface Management is a better fit for external attack-surface work, with a 30-day no-cost CSAM and EASM period rather than a permanent free tier.

Defensia Database Security suits a small Linux or self-hosted deployment that can live with one server, 2,000 events per month, three days of retention and monitor-only Free mode.

Free SQL Server Compliance Benchmark Tool is the focused choice for a free Windows utility with more than 80 SQL Server checks and PDF benchmark output.

Rapid7 Surface Command is an alternative for unified internal and external asset discovery and attack-surface visibility.

Trellix Data Loss Prevention is aimed at enterprise DLP across endpoints, email, web, networks and storage, managed on premises or as SaaS.

Oracle Cloud Infrastructure Secret Management is the narrower free option for tenancy-level secret storage and version controls.

DataSunrise is a paid database-security alternative with individually calculated custom pricing.

DBX is suited to free, local database introspection with unlimited schema inspection and topology scoring.

Verdict

Onam is a strong choice for multi-cloud security teams that want database posture, CIS benchmarks, data sensitivity and access relationships in one workflow. Its main reason to look elsewhere is economic and operational: Pro’s per-resource pricing and the setup needed for engine checks are harder to justify for small, single-engine or very large estates.