Keep your CNAPP. Add what comes after the alert.
NxSCORE works alongside the CNAPP you already run, read-only. It reads what the CNAPP raises, checks what it leaves out, and does the work after the finding with your team.
You will recognise this if
- Your CNAPP raises thousands of alerts, and the work after each one falls on your team.
- Some of its policies are switched off, and nobody is sure which controls that leaves unchecked.
- A finding fixed last quarter is open again, and the CNAPP counts it as new.
- Your CNAPP is changing, and years of decisions live inside it.
What NxSCORE adds to any CNAPP.
The CNAPP finds. NxSCORE and an analyst do what comes after, in every product below, the same way.
| Your CNAPP | NxSCORE adds |
|---|---|
| Checks configuration with the policies switched on | Checks what switched-off or missing policies leave out, and counts a resource failing in both once |
| Raises an alert for each failing resource | Sorts alerts into issues by cause, and gives each a verdict from the account’s own evidence: safe to fix, check first, in use or not checked |
| Recommends a fix | Writes a fix kit your engineers run: check, apply and rollback in one file |
| Closes an alert when it no longer sees it | Counts a finding that returns as back again, and proposes a guardrail so it stops |
| Shows a compliance score | Collects evidence for the requirements no scanner can check, accepted by a second person |
Find your CNAPP.
Each connects the same way: a read-only credential your team creates, entered once and never shown again.
| CNAPP | How it connects |
|---|---|
| Prisma Cloud | In Prisma Cloud, your team creates an access key for a user or service account with the Account Group Read Only role, covering all account groups, and picks your Prisma Cloud stack, the regional address your tenant lives on. |
| Cortex Cloud | Your team creates a read-only API key in Cortex Cloud and enters it once. |
| Wiz | Your team creates a read-only service account in Wiz and enters its credentials once. |
| Orca | Your team creates a read-only API token in Orca and enters it once. |
| Tenable Cloud Security | Your team creates a read-only API key in Tenable Cloud Security and enters it once. |
NxSCORE with Prisma Cloud.
Keep Prisma Cloud as your scanner. NxSCORE reads what it raises, checks what its enabled policies leave out, and does the work after the alert with your team: a verdict, a fix your engineers run, a guardrail so it does not return, and evidence for your auditors.
Prisma CloudYou will recognise it
- Thousands of open alerts, many of them the same policy on different resources.
- Some policies were switched off years ago, and nobody remembers why.
How it connects
In Prisma Cloud, your team creates an access key for a user or service account with the Account Group Read Only role, covering all account groups, and picks your Prisma Cloud stack, the regional address your tenant lives on.
How coverage is worked out
A control counts as covered by Prisma Cloud only when a mapped policy is switched on and an alert rule sends it for that account.
| Cloud accounts | 48 |
|---|---|
| Account groups | 7 |
| Policies enabled | 612 |
| Alert rules | 9 |
| Open alerts | 842 |
| Resolved alerts read, last 90 days | 2,310 |
What it reads
Policies, alert rules, compliance standards, cloud accounts and open findings, once a day. It never changes anything in Prisma Cloud.
NxSCORE with Cortex Cloud.
Whether you started on Cortex Cloud or are moving to it from Prisma Cloud, NxSCORE works the same way: read-only, alongside it, keeping every decision your team makes about a finding, whichever product raised it.
Cortex CloudYou will recognise it
- You are moving from Prisma Cloud to Cortex Cloud, and policies and names are changing on the way.
- Exceptions agreed in the old console have no obvious place to go.
How it connects
Your team creates a read-only API key in Cortex Cloud and enters it once. It is encrypted as soon as it arrives and never shown again.
How coverage is worked out
For each control, NxSCORE looks at whether Cortex Cloud has a policy for it, switched on, and reporting for every account.
| Cloud accounts | 48 |
|---|---|
| Policies enabled | 574 |
| Open findings | 3,874 |
| Already known from Prisma Cloud | 3,102 |
| New to NxSCORE | 685 |
What it reads
Policies, alert rules, compliance standards, cloud accounts and open findings, once a day. It never changes anything in Cortex Cloud.
NxSCORE with Wiz.
Wiz shows what is wrong across your cloud. NxSCORE works alongside it on what happens next: an issue sorted by cause, a verdict with its evidence, a fix your engineers run, a guardrail so it stays fixed, and the evidence your auditors ask for.
WizYou will recognise it
- Wiz issues get triaged, and the same ones are back after the next deployment.
- The owner of a finding is not always the person who can change the resource.
How it connects
Your team creates a read-only service account in Wiz and enters its credentials once. They are encrypted as soon as they arrive and never shown again.
How coverage is worked out
For each control, NxSCORE looks at whether Wiz checks it, and for which accounts.
| Cloud accounts | 48 |
|---|---|
| Open issues | 1,920 |
| Resolved issues read, last 90 days | 4,416 |
| Of those, came back after a fix | 512 |
What it reads
Policies, alert rules, compliance standards, cloud accounts and open findings, once a day. It never changes anything in Wiz.
Your scanner stays. The work after the alert is shared.
NxSCORE with Orca.
Orca finds the risks across your cloud estate. NxSCORE works alongside it on what happens after an alert: sorted by cause, a verdict with its evidence, a fix your engineers run, a guardrail so it stays fixed, and the evidence your auditors ask for.
Orca SecurityYou will recognise it
- Orca raises the alerts, and the same ones are back after the next release.
- Nobody can say which open alerts already have a decision behind them.
How it connects
Your team creates a read-only API token in Orca and enters it once. It is encrypted as soon as it arrives and never shown again.
How coverage is worked out
For each control, NxSCORE looks at whether Orca checks it, and for which accounts.
| Cloud accounts | 48 |
|---|---|
| Open alerts | 2,140 |
| Resolved alerts read, last 90 days | 3,620 |
| Of those, came back after a fix | 408 |
What it reads
Policies, alert rules, compliance standards, cloud accounts and open findings, once a day. It never changes anything in Orca.
NxSCORE with Tenable Cloud Security.
Tenable Cloud Security shows what is exposed and who has too much access. NxSCORE works alongside it on what happens next: a verdict with its evidence, a fix your engineers run, a guardrail so it stays fixed, and the evidence your auditors ask for.
Tenable Cloud SecurityYou will recognise it
- The findings are clear, but turning them into changes is slow.
- Excess permissions are flagged, and nobody wants to remove one in case it breaks a job.
How it connects
Your team creates a read-only API key in Tenable Cloud Security and enters it once. It is encrypted as soon as it arrives and never shown again.
How coverage is worked out
For each control, NxSCORE looks at whether Tenable Cloud Security checks it, and for which accounts.
| Cloud accounts | 48 |
|---|---|
| Open findings | 1,310 |
| Resolved findings read, last 90 days | 2,870 |
| Of those, came back after a fix | 296 |
What it reads
Policies, alert rules, compliance standards, cloud accounts and open findings, once a day. It never changes anything in Tenable Cloud Security.
Questions about NxSCORE and your CNAPP.
Does NxSCORE replace our CNAPP?
No. NxSCORE works alongside it, read-only. Your CNAPP stays your scanner; NxSCORE reads what it raises, checks what its policies leave out, and does the work after the alert with your team.
Can we use NxSCORE without a CNAPP?
Yes. NxSCORE scans your cloud accounts read-only on its own. With a CNAPP connected, it also reads the CNAPP’s findings and shows which controls the CNAPP does not cover.
What happens if we change CNAPP?
Findings are kept by account and control, so decisions, exceptions and evidence stay where they are, whichever CNAPP raises the finding. During the move, NxSCORE checks whatever neither product covers yet.
Connect your CNAPP and one account.
After the first assessment, your analyst shows you which controls your CNAPP covers, what it leaves out, and how your open alerts sort into a short list of issues.