Datadog Cloud Security Identity Risks vs Palo Alto Networks Cortex Cloud API Security

Datadog Cloud Security Identity Risks is a cloud infrastructure entitlement management product for finding and reducing identity risks. It scans AWS, Azure, and GCP for lingering administrative privileges, privilege escalation, permission gaps, broad blast radii, and cross-account access. Detections cover users, roles, groups, policies, EC2 instances, and Lambda functions. Access Insights shows which resources an entity can reach and which principals can reach them directly or indirectly. Remediation options include narrower policy suggestions, Datadog Workflows, cloud-console links, Terraform-generated GitHub pull requests, and Jira issues. AWS IAM Access Analyzer can supply unused-access findings for policy recommendations and permission-gap detections. Scanning is agentless, and Datadog says snapshots remain within the customer environment. Standard permission-gap detections cover 90 days; Access Analyzer can use 180- or 360-day periods. CSM Pro costs $10 a month per CSM host, while Enterprise costs $25 a month per host. A 14-day trial covers the product suite.

Palo Alto Networks Cortex Cloud API Security discovers, ranks, and protects APIs across cloud environments. It can find and validate APIs across gateways, workloads, and cloud environments, including shadow, zombie, and unmanaged APIs. Configuration and traffic context inform risk rankings based on severity and potential business impact. Risk insights cover internet exposure, sensitive data transmission, weak authentication, missing encryption, and specification drift. The product describes real-time protection against OWASP API Top 10 threats, including injection, authentication bypass, and data exposure; teams can use monitor or blocking modes. Agentless integrations are listed for AWS API Gateway, Azure APIM, GCP Apigee, and Kong. Linux workload protection uses an agent and is marked Beta. Teams can import OpenAPI specifications to check live traffic for deviations and scan for misconfigurations or vulnerabilities. Azure APIM integration requires the Data Collection add-on and a running Azure APIM service. Cortex CLI scans require an OpenAPI file and Java 11 or later, while Web and API Security requires the Runtime Security add-on. Pricing is on request; the product page offers a demo request.