Datadog Cloud Security Identity Risks vs Tenable One Cloud Security

Datadog Cloud Security Identity Risks is a cloud infrastructure entitlement management product for finding and reducing identity risks. It scans AWS, Azure, and GCP for lingering administrative privileges, privilege escalation, permission gaps, broad blast radii, and cross-account access. Detections cover users, roles, groups, policies, EC2 instances, and Lambda functions. Access Insights shows which resources an entity can reach and which principals can reach them directly or indirectly. Remediation options include narrower policy suggestions, Datadog Workflows, cloud-console links, Terraform-generated GitHub pull requests, and Jira issues. AWS IAM Access Analyzer can supply unused-access findings for policy recommendations and permission-gap detections. Scanning is agentless, and Datadog says snapshots remain within the customer environment. Standard permission-gap detections cover 90 days; Access Analyzer can use 180- or 360-day periods. CSM Pro costs $10 a month per CSM host, while Enterprise costs $25 a month per host. A 14-day trial covers the product suite.

Tenable One Cloud Security, described in the product details as Tenable One Cloud Exposure, is a CNAPP for finding and reducing risk across multi-cloud and hybrid environments. It discovers cloud compute, identity, and data assets, then maps access and exposure paths. Risk prioritization covers misconfigurations, excessive permissions, vulnerabilities, and exposed sensitive data. Infrastructure-as-code scanning checks Terraform, CloudFormation, and Kubernetes manifests for misconfigurations, compliance gaps, and policy violations. The platform integrates with AWS, Azure, and GCP, plus services such as AWS Control Tower and Entra ID. Identity integrations include Google Workspace, Okta, OneLogin, and Ping Identity; workflow connections include Jira, Slack, Microsoft Teams, email, ticketing, notification, and SIEM tools. It checks against CIS, NIST, and PCI DSS frameworks and provides guided remediation. Tenable says optional in-account scanning keeps scan data in the customer cloud. The paid product has no free plan or trial. Pricing is customized by billable cloud resources and is available standalone or as part of Tenable One.