8 Platforms • 29 Features • All Data Sourced
EchelonGraph vs. The Market
Honest, sourced comparison of EchelonGraph against Wiz, Orca Security, CrowdStrike Falcon, Prisma Cloud, and FortiCNAPP. Every data point links to an official vendor page.
Toggle vendors and filter by category. Click ↗ on any cell to verify the source.
$0
Free tier available
Free-forever plan — rare among CNAPPs
3-Tier
Agent architecture
Cloud + Network + Kernel
ZK
Zero-knowledge
Data never leaves your VPC
Self-hosted
Air-gapped ready
Helm chart deployment
| Feature | 🛡️EchelonGraph | 🟢Wiz | 🐋Orca Security | 🦅CrowdStrike | 🔺Prisma Cloud | 🏰FortiCNAPP | 🔐Palo Alto Idira | 🌐Versa CSPM |
|---|---|---|---|---|---|---|---|---|
| Architecture | ||||||||
| Deployment Model | SaaS + Self-hosted↗ | SaaS↗ | SaaS↗ | SaaS↗ | SaaS + Self-hosted (Compute Ed.)↗ | SaaS (Fortinet Fabric)↗ | SaaS (Idira platform)↗ | SaaS (VersaONE Universal SASE)↗ |
| Agent Requirement | Agentless (T1) + optional eBPF (T3)↗ | Agentless-first + optional sensor↗ | Agentless (SideScanning™)↗ | Agent required (Falcon sensor)↗ | Agent + Agentless options↗ | Agentless + behavioral agent↗ | Connector-based (300+ integrations)↗ | Agentless↗ |
| eBPF Runtime Protection | ✅ Tier 3 + decrypted L7 (OpenSSL/GnuTLS/Go)↗ | ✅ Wiz Sensor (optional)↗ | ✅ Orca Sensor (optional)↗ | ✅ Falcon sensor (kernel-level)↗ | ✅ Defender agent↗ | Behavioral analytics↗ | n/a — PAM product↗ | ❌↗ |
| Cloud Providers | AWS, GCP, Azure↗ | AWS, GCP, Azure, OCI, Alibaba↗ | AWS, GCP, Azure, OCI, Alibaba↗ | AWS, GCP, Azure↗ | AWS, GCP, Azure, OCI↗ | AWS, GCP, Azure, OCI↗ | Cloud-agnostic identity layer (SaaS, cloud, dev envs)↗ | AWS, GCP, Azure, OCI (500+ rules)↗ |
| Capabilities | ||||||||
| CSPM | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | n/a — PAM product↗ | ✅ (launched May 2026)↗ |
| CWPP | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ❌↗ | ❌↗ |
| DSPM | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ❌↗ | ❌↗ |
| CIEM | ✅ AWS + GCP, read-only↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ✅ PAM-native↗ | Partial (in CSPM)↗ |
| Attack Path Analysis | ✅ Neo4j graph↗ | ✅ Security Graph↗ | ✅ Unified Data Model↗ | ✅↗ | ✅↗ | ✅ Composite Alerts↗ | Identity paths only↗ | ❌↗ |
| IaC Scanning (breadth) | ✅ 3 engines (HCL2 + Trivy + KICS): 1,000+ checks, 15+ formats incl. Ansible/Pulumi/ARM/GDM — AWS/GCP/Azure↗ | ✅ Wiz Code↗ | ✅ Shift Left↗ | ✅↗ | ✅↗ | ✅↗ | ❌↗ | ❌↗ |
| IaC → live-cloud correlation | ✅ Each IaC misconfig linked to the live asset graph — confirms deployed + internet-facing/sensitive↗ | ✅ Code-to-Cloud↗ | ✅↗ | ◐ Limited↗ | ✅ Code Security↗ | ◐↗ | ❌↗ | ❌↗ |
| AI Security Analyst | ✅ RAG-powered (Gemini)↗ | ✅ Wiz AskAI↗ | ✅ Orca AI↗ | ✅ Charlotte AI↗ | ✅ Prisma AI Copilot↗ | ✅ FortiAI↗ | AI-driven analytics (embedded)↗ | ❌↗ |
| AI-SPM (AI Service Posture) | ✅ SageMaker + Bedrock + Vertex AI, read-only↗ | ✅ AI-SPM↗ | ✅ AI Security↗ | Emerging↗ | ✅ AI-SPM↗ | Limited↗ | ❌↗ | ❌↗ |
| Compliance & Pricing | ||||||||
| Pricing Model | Free / $12K·yr / $30K·yr / Custom↗ | Custom quote required↗ | Custom quote required↗ | Custom quote / AWS PAYG↗ | Credit-based (custom)↗ | Custom quote required↗ | Per-identity (custom)↗ | Bundled with SASE (custom)↗ |
| Published entry price / typical ACV | ✅ $0 / $12K / $30K / from $75K·yr — all published↗ | Quote-only — ~$111K median ACV (Vendr)↗ | Quote-only — no public list price↗ | Quote-only / AWS PAYG (per-endpoint·hour)↗ | Credit-based — 100 credits ≈ $9K–$18K·yr↗ | Quote-only — no public list price↗ | Quote-only (per-identity)↗ | Quote-only (bundled with SASE)↗ |
| Free Tier | ✅ Free forever (3 accounts, 500 assets)↗ | ❌ Not listed | ❌ Not listed | ❌ Not listed | ❌ Not listed | ❌ Not listed | ❌ Not listed | ❌ Not listed |
| Transparent Pricing | ✅ Published on website↗ | ❌ Contact sales↗ | ❌ Contact sales↗ | ❌ Contact sales↗ | ❌ Contact sales↗ | ❌ Contact sales↗ | ❌ Contact sales↗ | ❌ Contact sales↗ |
| Predictable TCO (no consumption / overage bills) | ✅ Flat annual — not per-workload / credit metered↗ | ◐ Per-workload annual — bill grows with footprint↗ | ◐ Per-workload / asset — scales with count↗ | ❌ Per-endpoint + AWS PAYG hourly metering↗ | ❌ Credit burn varies with resource mix↗ | ◐ Per-workload / resource-usage subscription↗ | ◐ Per-identity↗ | ◐ Bundled SASE (per-user / bandwidth)↗ |
| Compliance Frameworks | 300+ live-scored + unlimited via custom-framework builder — incl. 5 AI-governance frameworks (EU AI Act, NIST AI-RMF, ISO 42001, MITRE ATLAS, OWASP LLM), still rare among CNAPPs↗ | 100+ (CIS, SOC 2, PCI, HIPAA, GDPR, NIST, etc.)↗ | 100+ (CIS, SOC 2, PCI, HIPAA, GDPR, etc.)↗ | Multiple (CIS, PCI, HIPAA, NIST, etc.)↗ | Multiple (CIS, SOC 2, PCI, HIPAA, etc.)↗ | Multiple (CIS, SOC 2, PCI, HIPAA, etc.)↗ | Audit-ready (frameworks not publicly itemised)↗ | CIS, NIST, ISO 27001, SOC 2, PCI-DSS↗ |
| Real-time compliance re-scoring (≤30s) | ✅ Webhook on every cloud / K8s change↗ | Scheduled scans↗ | Scheduled scans↗ | Scheduled scans↗ | Scheduled scans↗ | Scheduled scans↗ | n/a — PAM product↗ | Continuous monitoring (poll-based, not webhook)↗ |
| EU AI Act controls live (21 obligations) | ✅ 21 obligations (Art 9-17, 19, 26-27, 50, 61, 72, 85/99)↗ | Partial (general AI policies)↗ | ❌↗ | ❌↗ | Partial↗ | ❌↗ | Partial via identity controls↗ | ❌↗ |
| AI-governance frameworks (live-scored) | ✅ 5 scored: EU AI Act, NIST AI-RMF, ISO 42001, MITRE ATLAS, OWASP LLM↗ | AI-SPM — maps to some AI frameworks (not full scored set)↗ | AI-SPM (50+ AI models)↗ | Emerging↗ | AI-SPM (evidence mapping)↗ | Limited↗ | ❌↗ | ❌↗ |
| Differentiators | ||||||||
| Self-Hosted / Air-Gapped | ✅ Helm chart, BYOK, air-gapped↗ | ❌ No self-hosted option listed↗ | ❌ No self-hosted option listed↗ | ❌ No self-hosted option listed↗ | ✅ Compute Edition (self-hosted)↗ | ❌ SaaS (Fortinet Fabric)↗ | Legacy CyberArk on-prem PAM↗ | ❌ No self-hosted option listed↗ |
| Zero-Knowledge Architecture | ✅ AES-256-GCM, BYOK (AWS/GCP/Vault)↗ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Zero Standing Privilege scoring | ✅ CIS-AWS 1.13/1.15/1.16 live↗ | Partial (IAM scanning)↗ | Partial↗ | Partial↗ | Partial↗ | Partial↗ | ✅ Enforced (core product)↗ | ❌↗ |
| Network / Shadow IT Scanning | ✅ Tier 2 (EcheNet)↗ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ SASE-native↗ |
| Live public CVE feed + proprietary score | ✅ Public Pulse feed — EG score (NVD CVSS + EPSS + CISA-KEV + GHSA + 7 vendor feeds), free API↗ | ❌ No public scored-CVE feed / API↗ | ❌ No public CVE feed↗ | ◐ Falcon threat intel (in-product, not a public feed)↗ | ❌ No public CVE feed↗ | ❌ No public CVE feed↗ | ❌↗ | ❌↗ |
| Free external surface scanner | ✅ 23-module public scan (TLS/DNS/secrets/takeover) — no signup, ~30s↗ | ❌ No free public scanner↗ | ❌ No free public scanner↗ | ❌ No free public scanner↗ | ❌ No free public scanner↗ | ❌ No free public scanner↗ | ❌↗ | ❌↗ |
| SBOM Generation | ✅ CycloneDX + SPDX↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ✅↗ | ❌↗ | ❌↗ |
See it in action
Watch the 60-second product demo
A walkthrough of the live attack graph, the 21 EU AI Act obligations scoring live, and the Shadow AI Radar real-time feed. No signup, no email gate.
Watch the demo →📚 Sources & References
Comparisons reflect publicly available information from official vendor websites, AWS Marketplace listings, and third-party pricing aggregators (e.g. Vendr) as of July 2026. Vendor offerings change frequently — verify current capabilities, deployment options, and pricing directly with each vendor. Competitor list-price and ACV figures are indicative market data, not vendor-published rates; contact each vendor for customized quotes.
↗Wiz Product Page↗Wiz CNAPP↗Wiz DSPM↗Wiz Pricing↗Orca Platform↗Orca SideScanning↗Orca Pricing↗CrowdStrike Cloud Security↗CrowdStrike Pricing↗Prisma Cloud Overview↗Prisma Compute Edition↗Prisma Cloud Pricing↗FortiCNAPP↗Fortinet Contact↗EchelonGraph Pricing↗EchelonGraph Architecture↗Palo Alto Idira launch (May 12, 2026)↗Palo Alto Networks Identity Security↗CyberArk Privileged Access Manager↗Versa Networks CSPM launch (May 13, 2026)↗Versa Networks SASE↗Wiz cost data — Vendr median ACV (verified Jul 2026)↗Wiz AI-SPM↗Orca AI-SPM↗EchelonGraph Pulse — live public CVE feed↗EchelonGraph Surface Scanner — free external scan
Why Choose EchelonGraph?
💰
Transparent Pricing
We publish our prices. Free forever (Community), Team at $12,000/yr, Pro at $30,000/yr, Enterprise custom. No mandatory demo call just to see a number.
🏠
Self-Hosted & Air-Gapped
Deploy in your VPC with BYOK encryption. Zero-knowledge architecture means your data never leaves your infrastructure.
🔍
3-Tier Depth
The only platform combining agentless cloud APIs (T1), network/Shadow IT scanning (T2), and eBPF kernel telemetry (T3) in one product.