CloudSploit vs Qualys TotalCloud

CloudSploit is an open-source project for identifying possible misconfigurations and security risks in cloud accounts. It collects account metadata through cloud infrastructure APIs using read-only access, then scans that data for potential issues. Supported accounts include AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure, and GitHub. The project documents a self-hosted version and a commercial version hosted at Aqua Wave. Setup instructions use NodeJS and npm, and Docker build and run commands are also provided. Its CLI can map findings to HIPAA, PCI, and CIS Level 1 and Level 2 requirements, and write results as CSV, JSON, or JUnit XML, or print them to the console. It can return a non-zero status for non-passing results, which can be used in CI/CD workflows. The CLI also includes AWS GovCloud and AWS China options. CloudSploit runs on Linux and the web, is listed under GPL-3.0, and its self-hosted open-source plan costs nothing.

Qualys TotalCloud is a cloud-native application protection platform for multi-cloud and container environments. It covers AWS, Azure, Google Cloud Platform, and Oracle Cloud Infrastructure through a single license, control plane, and TruRisk score. Its security domains include CSPM, CWPP, CIEM, CDR, Kubernetes and container security, IaC, SSPM, DSPM, and AI-SPM. TruRisk prioritizes verified, attackable exposures using exploitability, threat intelligence, asset criticality, and runtime context. FlexScan offers agentless, agent-based, network, and pipeline scanning. QFlow provides more than 300 automated playbooks and integrates with ServiceNow, Jira, SIEM, and SOAR platforms. Qualys says TotalCloud can assess cloud resources, including transient and ephemeral resources, in under 10 minutes. It also manages SaaS security posture for Microsoft 365, Salesforce, Zoom, and Google Workspace. Pre-built policy frameworks include CIS, PCI-DSS, HIPAA, and NIST. A free license with limited API calls for control evaluation is listed; subscription pricing is available on request.