"Please Install This Software on Every Machine"
Traditionally, to secure a server, you installed a security agent — a piece of software running inside the operating system that watched for threats and reported back to a central console.
This approach has real problems at cloud scale:
- Operational friction: DevOps teams resist agents because they consume CPU and RAM, can crash production applications, and require their own update and patching lifecycle.
- Coverage gaps (Shadow IT): If a developer spins up a new VM but the agent installation script fails silently, that server is completely invisible to security. It becomes a shadow asset — a machine your security team doesn't know exists.
- Ephemeral workloads: Containers and serverless functions may live for seconds or minutes. Installing an agent inside a container that lives for 30 seconds is impractical.
The Agentless Revolution
Tools like Wiz and Orca Security changed the industry by proving you don't need to install anything inside a workload to see everything about it. Instead of asking the OS for information, they ask the cloud provider's API directly.
The key insight: the cloud control plane already knows everything about your infrastructure — disk contents, network topology, IAM permissions, running processes. Agentless CSPM taps into that knowledge without touching your workloads.
| Dimension | Agent-Based | Agentless |
|---|---|---|
| Coverage | Only installed machines | All cloud assets, automatically |
| Performance impact | CPU/RAM overhead on host | Zero impact on workload |
| Deployment effort | High (per-machine install) | Low (one cloud API integration) |
| Real-time detection | Yes (process-level) | Near-real-time (minutes lag) |
| Ephemeral workloads | Poor | Poor (a container or function that lives only seconds can vanish before the next snapshot cycle) |
| Secrets in files | Requires agent access | Yes, via disk snapshot |
Senior insight: The industry is converging on CNAPP (Cloud-Native Application Protection Platform), which combines agentless CSPM for broad posture visibility with lightweight runtime agents for real-time threat detection. Neither approach alone is sufficient for a mature security program.