Cortex CloudNxSCORE with Cortex Cloud.
Whether you started on Cortex Cloud or are moving to it from Prisma Cloud, NxSCORE works the same way: read-only, alongside it, keeping every decision your team makes about a finding, whichever product raised it.
You will recognise this if
- You are moving from Prisma Cloud to Cortex Cloud, and policies and names are changing on the way.
- Exceptions agreed in the old console have no obvious place to go.
- For a few months, some accounts are in one product, some in the other, and some in neither.
- Your auditor wants one compliance record, not two that disagree.
What NxSCORE reads from Cortex Cloud, and what it never touches.
Cortex Cloud stays your scanner. NxSCORE reads what it already knows, so it only scans what nothing else covers, and it never changes anything in Cortex Cloud.
| NxSCORE reads | NxSCORE never |
|---|---|
| Policies, and which are switched on | Never changes a policy in Cortex Cloud |
| Alert rules, and which accounts they cover | Never creates or edits a rule |
| Compliance standards and their requirements | Never dismisses or resolves an alert |
| Cloud accounts and how they are grouped | Never writes anything back |
| Open alerts, and 90 days of resolved ones | Never sees your workloads’ data |
How NxSCORE sits beside Cortex Cloud.
Three things happen in the first days. None of them changes your cloud, or your CNAPP.
- 01
Connect Cortex Cloud with a read-only key.
Your team creates a read-only API key in Cortex Cloud and enters it once. It is encrypted as soon as it arrives and never shown again.
NxSCORE reads Cortex Cloud the same way it reads any CNAPP: policies, alert rules, compliance standards, cloud accounts and open findings, once a day, with 90 days of resolved findings on the first sync.
Cortex Cloud, first syncConnectedCloud accounts 48 Policies enabled 574 Open findings 3,874 Already known from Prisma Cloud 3,102 New to NxSCORE 685 - 02
Coverage worked out control by control.
For each control, NxSCORE looks at whether Cortex Cloud has a policy for it, switched on, and reporting for every account.
Where it does not, yet, the NxSCORE scan checks the control. During a migration, that is what stops controls going unchecked between the two products.
Who checked itExample- S3 buckets block public accessCortex Cloud
Cortex Cloud checks it, and an alert rule covers every account.
- EC2 instances require IMDSv2Cortex Cloud and NxSCORE
Both see the same failing setting. One finding, not two.
- Unused IAM roles removed after 90 daysNxSCORE
No Cortex Cloud policy is switched on for it, so the NxSCORE scan checks it.
- Access reviewed each quarterEvidence
No scanner can check it. Your team uploads the review and an analyst accepts it.
- 03
Every account accounted for.
NxSCORE matches the accounts in your cloud organisation with the accounts Cortex Cloud monitors. One that Cortex Cloud has switched off, or never had, is listed by name, and scanned where NxSCORE has its own read-only role.
An account nobody can read is shown as not scanned. It never appears in a report as passing.
AccountsExample- prod-paymentsCovered by your CNAPP
- data-lakeScanned
- sandbox-17CNAPP only, not scanned
- dr-siteAccess denied
Then the work after the alert.
What happens after Cortex Cloud raises it.
This is the part a scanner leaves to your team. With NxSCORE, an analyst does the preparation and your people make the decisions and the changes.
- 04
A verdict before anyone touches it.
Before a fix is suggested, NxSCORE reads how the resource is used: what a security group is attached to, when a key was last used, who created it. The verdict comes with its reason, so your engineers can check it.
Findings are grouped into issues, ordered on the Priorities page, and given an owner from the resource’s tags and a fix-by date from its severity. How a backlog is sorted.
Is it safe to fix?Example- Access key for svc-reportingSafe to fix
Last used 214 days ago.
- sg-payments-edgeCheck first
Attached to two network interfaces behind the load balancer.
- 05
A fix kit your engineers run.
For a safe fix, NxSCORE writes the script, with its check, apply and rollback in one file. Your engineers run it. NxSCORE’s access stays read-only.
A finding closes only when a later assessment, or Cortex Cloud, no longer sees the problem. How fixes are kept safe.
Fix kit: S3 buckets that allow public access- CheckLists every change it would make. Changes nothing.
- ApplyAsks before it acts, in your change window.
- RescanClosed when NxSCORE, or Cortex Cloud, no longer sees it.
- 06
A guardrail, so it does not come back.
When Cortex Cloud raises the same issue again and again, your analyst writes a prevention plan aimed at its source. Your team agrees it and makes the change.
NxSCORE marks the plan verified after 14 days with no new findings from Cortex Cloud or from its own scan.
Prevention planVerified - 07
Evidence for the requirements no scanner can check.
Each requirement is met by checks, evidence or both. Findings from Cortex Cloud count towards the checks. Your team uploads the rest once, and your analyst accepts it.
PCI DSS 4.0.1Example- Settings Cortex Cloud and NxSCORE checkChecks
- Policies, reviews and training recordsEvidence
Questions about NxSCORE with Cortex Cloud.
Does NxSCORE replace Cortex Cloud?
No. NxSCORE works with Cortex Cloud. Cortex Cloud stays your scanner. NxSCORE reads what it finds, checks what it does not, and runs the work after the alert with your team.
Does NxSCORE change anything in Cortex Cloud?
No. It reads policies, alert rules, compliance standards, accounts and alerts with a read-only key. It never dismisses an alert, edits a policy or writes anything back.
Will we see every finding twice?
No. When Cortex Cloud and the NxSCORE scan report the same failing setting on the same account, it is one finding, marked as found by both.
Can NxSCORE read Prisma Cloud and Cortex Cloud during the move?
That is how a migration is meant to run. Findings from both land on the same account and control, decisions already made stay on them, and your team sees what is actually new.
Do our exceptions have to be approved again?
No. An exception keeps its reason, who decided it and its expiry, no more than 12 months away. Your security team reviews one only if its reason changed with the move.
Keep Cortex Cloud. Add the work after the alert.
Connect the CNAPP you have today, Prisma Cloud or Cortex Cloud, and one cloud account. Your analyst shows you what is kept, which controls each product covers, and what the move would leave unchecked.