Prisma CloudNxSCORE with Prisma Cloud.
Keep Prisma Cloud as your scanner. NxSCORE reads what it raises, checks what its enabled policies leave out, and does the work after the alert with your team: a verdict, a fix your engineers run, a guardrail so it does not return, and evidence for your auditors.
You will recognise this if
- Thousands of open alerts, many of them the same policy on different resources.
- Some policies were switched off years ago, and nobody remembers why.
- Alert rules cover some account groups and not others.
- The compliance report in the console is not what your auditor asked for.
What NxSCORE reads from Prisma Cloud, and what it never touches.
Prisma Cloud stays your scanner. NxSCORE reads what it already knows, so it only scans what nothing else covers, and it never changes anything in Prisma Cloud.
| NxSCORE reads | NxSCORE never |
|---|---|
| Policies, and which are switched on | Never changes a policy in Prisma Cloud |
| Alert rules, and which accounts they cover | Never creates or edits a rule |
| Compliance standards and their requirements | Never dismisses or resolves an alert |
| Cloud accounts and how they are grouped | Never writes anything back |
| Open alerts, and 90 days of resolved ones | Never sees your workloads’ data |
How NxSCORE sits beside Prisma Cloud.
Three things happen in the first days. None of them changes your cloud, or your CNAPP.
- 01
Connect Prisma Cloud with a read-only key.
In Prisma Cloud, your team creates an access key for a user or service account with the Account Group Read Only role, covering all account groups, and picks your Prisma Cloud stack, the regional address your tenant lives on.
The secret is encrypted as soon as it arrives and never shown again. NxSCORE then reads once a day, and on the first sync it also reads the last 90 days of resolved alerts.
Prisma Cloud, first syncConnectedCloud accounts 48 Account groups 7 Policies enabled 612 Alert rules 9 Open alerts 842 Resolved alerts read, last 90 days 2,310 - 02
Coverage worked out control by control.
A control counts as covered by Prisma Cloud only when a mapped policy is switched on and an alert rule sends it for that account.
If the policy is off or missing, the NxSCORE scan checks the control. If the alert rule is limited to some regions or tags, NxSCORE checks the rest.
Who checked itExample- S3 buckets block public accessPrisma Cloud
Prisma Cloud checks it, and an alert rule covers every account.
- EC2 instances require IMDSv2Prisma Cloud and NxSCORE
Both see the same failing setting. One finding, not two.
- Unused IAM roles removed after 90 daysNxSCORE
No Prisma Cloud policy is switched on for it, so the NxSCORE scan checks it.
- Access reviewed each quarterEvidence
No scanner can check it. Your team uploads the review and an analyst accepts it.
- 03
Every account accounted for.
NxSCORE matches the accounts in your cloud organisation with the accounts Prisma Cloud monitors. One that Prisma Cloud has switched off, or never had, is listed by name, and scanned where NxSCORE has its own read-only role.
An account nobody can read is shown as not scanned. It never appears in a report as passing.
AccountsExample- prod-paymentsCovered by your CNAPP
- data-lakeScanned
- sandbox-17CNAPP only, not scanned
- dr-siteAccess denied
Then the work after the alert.
What happens after Prisma Cloud raises it.
This is the part a scanner leaves to your team. With NxSCORE, an analyst does the preparation and your people make the decisions and the changes.
- 04
A verdict before anyone touches it.
Before a fix is suggested, NxSCORE reads how the resource is used: what a security group is attached to, when a key was last used, who created it. The verdict comes with its reason, so your engineers can check it.
Findings are grouped into issues, ordered on the Priorities page, and given an owner from the resource’s tags and a fix-by date from its severity. How a backlog is sorted.
Is it safe to fix?Example- Access key for svc-reportingSafe to fix
Last used 214 days ago.
- sg-payments-edgeCheck first
Attached to two network interfaces behind the load balancer.
- 05
A fix kit your engineers run.
For a safe fix, NxSCORE writes the script, with its check, apply and rollback in one file. Your engineers run it. NxSCORE’s access stays read-only.
A finding closes only when a later assessment, or Prisma Cloud, no longer sees the problem. How fixes are kept safe.
Fix kit: S3 buckets that allow public access- CheckLists every change it would make. Changes nothing.
- ApplyAsks before it acts, in your change window.
- RescanClosed when NxSCORE, or Prisma Cloud, no longer sees it.
- 06
A guardrail, so it does not come back.
When Prisma Cloud raises the same issue again and again, your analyst writes a prevention plan aimed at its source. Your team agrees it and makes the change.
NxSCORE marks the plan verified after 14 days with no new findings from Prisma Cloud or from its own scan.
Prevention planVerified - 07
Evidence for the requirements no scanner can check.
Each requirement is met by checks, evidence or both. Findings from Prisma Cloud count towards the checks. Your team uploads the rest once, and your analyst accepts it.
PCI DSS 4.0.1Example- Settings Prisma Cloud and NxSCORE checkChecks
- Policies, reviews and training recordsEvidence
Questions about NxSCORE with Prisma Cloud.
Does NxSCORE replace Prisma Cloud?
No. NxSCORE works with Prisma Cloud. Prisma Cloud stays your scanner. NxSCORE reads what it finds, checks what it does not, and runs the work after the alert with your team.
Does NxSCORE change anything in Prisma Cloud?
No. It reads policies, alert rules, compliance standards, accounts and alerts with a read-only key. It never dismisses an alert, edits a policy or writes anything back.
Will we see every finding twice?
No. When Prisma Cloud and the NxSCORE scan report the same failing setting on the same account, it is one finding, marked as found by both.
What role does the Prisma Cloud key need?
Account Group Read Only, covering all account groups. NxSCORE needs to see every account Prisma Cloud monitors, and nothing more.
Our Prisma Cloud tenant is in India. Is that supported?
Yes. You pick your Prisma Cloud stack when connecting, and the India stack is one of them, alongside the US, EU, UK, Singapore, Australia, Canada, Japan and France stacks.
We are moving to Cortex Cloud. What happens to the decisions we made here?
They stay in NxSCORE, on the account and the control, whichever tool raised the finding. The CNAPP migration page explains how the switch works.
Keep Prisma Cloud. Add the work after the alert.
Connect Prisma Cloud and one cloud account. After the first assessment, your analyst shows you which controls Prisma Cloud covers, what it leaves out, and how your open alerts sort into a short list of issues.