Looking for Advice on Agentless Security Scanning for Azure VMs and Containers

If budget is not an issue, you might want to consider checking out wiz.io; they offer comprehensive solutions that might meet your needs.

Going agentless has its perks, especially for vulnerability scanning; I’ve replaced agents with solutions like Qualys. I personally prefer Palo Alto's tools because they’ve proven to catch issues where agents fail or miss things entirely. However, I wouldn't recommend going agentless for everything. It's not suitable for real-time protection needs like Defender or Crowdstrike, and patching can be tricky without agents, especially if you're dealing with database consistency.

I switched to an agentless approach a couple of years ago, and it did eliminate the performance problems and reboot conflicts associated with agents. However, we hit a snag with ownership issues—no one was taking responsibility for the findings. The cloud team thought it was an on-prem issue, while the identity team felt it fell under infrastructure. In the end, it’s less about the scanning method and more about having clear ownership to handle the findings. I'd choose actionable insights with accountable follow-through over perfect coverage any day. Discovery is easy, but making sure issues get addressed is what really matters.

I think agentless solutions can work well if you manage expectations. You’ll gain better performance and simplify operations, but you might sacrifice some in-depth visibility. A combination of snapshot-based VM scanning and control plane signals for identities and containers can provide a lot of coverage without the need for agents. Tools like Orca do well with this kind of agentless cloud security and offer unified visibility across your environment, helping you avoid the hassle of reboot coordination during provisioning. Just remember, while it’s great for scaling and patch management, you might still need some agents for deep kernel-level detections or live responses.

The problem often isn’t about how well you can detect issues, but rather the fragmentation in policies and processes. Consistent enforcement and a systematic approach to your security policies can avoid a lot of confusion and 'drift'. If your teams treat policy management as a top priority with clear ownership and shared insights, you’ll see much better results than if it's treated as an afterthought for each feature. That way, your operations will run more smoothly and you’ll have less chaos during incidents.

Defender for Cloud does offer some agentless capabilities, but you’ll still need some agents for comprehensive monitoring. It’s effective for inventory and compliance management, but when it comes to runtime details and nuances, it tends to fall short. For your needs, I think Orca could be the ideal fit, providing the visibility and control you’re looking for without overwhelming you with agents.