CloudSploit vs Mondoo CSPM
CloudSploit
github.com
Mondoo CSPM
mondoo.comSide by side
| Figure | CloudSploit | Mondoo CSPM |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | — |
| Plans published | 2 | 2 |
| Spec score · Cloud Security Posture Management Software | 7.9 (#13) | 8.6 (#2) |
| Founded | 2015 | 2020 |
| Headquarters | Boston, Massachusetts, United States and Ramat Gan, Israel | Berlin, Germany |
| License | The GitHub repository lists the project under the GPL-3.0 license. | The cnspec GitHub repository identifies its license as Business Source License 1.1 (BUSL 1.1). |
Plans
In their own words
CloudSploit
CloudSploit is an open-source project for identifying possible misconfigurations and security risks in cloud accounts. It collects account metadata through cloud infrastructure APIs using read-only access, then scans that data for potential issues. Supported accounts include AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure, and GitHub. The project documents a self-hosted version and a commercial version hosted at Aqua Wave. Setup instructions use NodeJS and npm, and Docker build and run commands are also provided. Its CLI can map findings to HIPAA, PCI, and CIS Level 1 and Level 2 requirements, and write results as CSV, JSON, or JUnit XML, or print them to the console. It can return a non-zero status for non-passing results, which can be used in CI/CD workflows. The CLI also includes AWS GovCloud and AWS China options. CloudSploit runs on Linux and the web, is listed under GPL-3.0, and its self-hosted open-source plan costs nothing.
Mondoo CSPM
Mondoo CSPM has no write-up on Specifiction yet; its figures are above.