Picture a 300-person company in Bengaluru that runs a payments app. The backend of its app runs on servers in Amazon's data centres. Its staff use email from Microsoft, keep their customer records in Salesforce and store their code on GitHub. For this company, the old security questions were: is the firewall set up right, and is the server patched? Now the questions are new ones:
- Is this storage bucket, a folder of files in the cloud, accidentally open to the whole internet?
- Does this container, a packaged piece of the app, carry a library with a known security flaw?
- Which of the 2,000 settings in Salesforce lets an outsider read customer records?
The cloud provider secures the building and the machines. The customer is responsible for everything it puts inside. The industry calls this split the shared responsibility model. (More on the cloud itself in Market Segment 5.1, Cloud infrastructure and web hosting providers, in Industry Vertical 5, Cloud providers and OS makers.) A whole industry sells the tools that show a company what its own part of the cloud is doing. Its buyers are the security and cloud teams of companies like the payments company.
The shared responsibility model. The cloud provider secures the building and the machines. The customer secures everything it puts inside: the programs it runs, the settings of its cloud accounts and its data. The tools in this Market Segment show a company what its own part is doing.
This Market Segment covers only a few companies, and the reason is worth stating up front. The companies that lead cloud security are mostly not here. Wiz is not covered in this Market Segment. CrowdStrike sells cloud security as one part of a larger platform. (More on it in Market Segment 4.4, Endpoint security and device management.) Palo Alto Networks, with Prisma Cloud, is in the same position. It is one of three large network-security companies covered mainly in Market Segment 4.5 that also appear here. The other companies here are the specialists: their whole product is watching a cloud or a SaaS application from the inside.
Every company named here has posted software engineering jobs in India. Famous companies that don't actively hire software engineers in India are left out.
This Market Segment has two sides:
The cloud side: the programs a company runs in the cloud, and the settings of the cloud accounts they run in.
The SaaS side: the business software a company rents over the internet, like Salesforce, and its settings.
Watching what runs in the cloud
The cloud side. Take the payments company from the start of this Market Segment. Its app runs in the cloud as workloads, the industry's word for the programs a company runs there. They come in three forms:
- containers, usually run together by Kubernetes, the most common software for managing many containers
- virtual machines
- serverless functions, small pieces of code the cloud runs only when called
Two kinds of product watch these. Runtime protection watches the workloads while they run, and stops attacks. Cloud security posture management checks the settings of the cloud accounts for mistakes, like the open storage bucket. The product that does both at once has a long name: cloud-native application protection platform. Two of its makers have small engineering teams in India. (Checking code and containers before they go live is covered in Market Segment 4.7, Application and API security.)
Sysdiggrew out of the open-source tools for watching containers. It sells runtime protection and posture management for Kubernetes, and has a team in Bengaluru.
Aqua Securityfrom Tel Aviv, sells the same platform. It is better known for giving away two of the most used security tools in the cloud world. Trivy scans for known security flaws, and kube-bench checks a Kubernetes setup against security best practice. Aqua has engineers in Hyderabad.
CoreStackwhich started in Chennai, sells a product that keeps a company's accounts on several clouds in line with its rules. Its security module checks the settings across AWS, Microsoft Azure and Google Cloud.
Banyan Cloudfrom San Jose with engineers in Bengaluru, is a small start-up selling cloud security posture management.
Watching the apps a company rents
The SaaS side. Back to the payments company from the start of this Market Segment. It subscribes to business software over the internet, called software as a service, or SaaS: Salesforce, Workday, Microsoft 365 and GitHub. Each app has its own permissions, its own settings, and its own connections to other apps, called integrations. A wrongly set SaaS app leaks data as badly as a wrongly set server. This side is newer, and one company in this Market Segment works on it.
AppOmnibuilt the product that checks those settings all the time, called SaaS security posture management. It has engineers in Bengaluru.
Two kinds of watching. On the cloud side, runtime protection watches the programs a company runs, and posture management checks the settings of its cloud accounts, sold by companies such as Sysdig, Aqua Security, CoreStack and Banyan Cloud. On the SaaS side, SaaS security posture management, from AppOmni, checks the permissions, settings and integrations of the business software the company rents.
You're reading as a guest. Sign in free to follow links for five minutes, once an hour.
Sign in
Cloud security inside bigger platforms
The larger platforms. Zscaler, Palo Alto Networks and Netskope all sell cloud security posture management and workload protection as part of their larger platforms. In fact, most of the cloud-security engineering done in India by the companies in Industry Vertical 4 happens inside these three. They are here as a reminder that this Market Segment is smaller than its subject. (More on them in Market Segment 4.5, Network security, firewalls and SASE.)
The AI application as a SaaS app.
The newest thing a company subscribes to is an AI service. The newest mistake in the settings is an AI agent that has access to everything. AppOmni's posture management now covers AI applications as well as SaaS. The workload platforms are extending to the systems that run AI models. (More on those systems in Market Segment 9.2, MLOps and LLMOps platforms, in Industry Vertical 9, AI labs and model platforms.) Both are early, and only a few companies in this Market Segment work on them.
So the payments company from the start of this Market Segment needs two kinds of watching. One watches the programs it runs in the cloud and the settings of its cloud accounts. The other watches the settings of the business software it rents.