Aqua Security: product and architecture
This Aqua Security review examines one of the most established cloud-native security platforms on the market today. Aqua Security has carved out a dominant position in container and Kubernetes security since its founding in 2015, and its platform now spans the full application lifecycle from build to runtime. The company backs Trivy, the most widely adopted open-source vulnerability scanner in the cloud-native ecosystem, which gives it credibility that few competitors can match. For organizations running containerized workloads at scale, Aqua delivers runtime protection, compliance enforcement, and supply chain security in a single platform. This review breaks down what Aqua does well, where it falls short, and who should consider it.
Overview
Aqua Security provides a cloud-native application protection platform (CNAPP) designed for organizations that deploy containers, Kubernetes clusters, serverless functions, and VM-based workloads. The platform addresses security across the entire software development lifecycle: scanning images during CI/CD, enforcing policies at admission, and monitoring runtime behavior in production.
The company operates from a dual-model approach. Its commercial platform targets mid-market and enterprise teams that need centralized policy management, drift prevention, and compliance reporting. Alongside this, Aqua maintains Trivy, a free and open-source scanner that handles vulnerability detection, misconfiguration auditing, secret scanning, and software bill of materials (SBOM) generation. Trivy has become the de facto standard scanner in many DevSecOps pipelines, integrated into GitHub Actions, GitLab CI, and dozens of other tools.
Aqua supports all three major cloud providers (AWS, Azure, GCP), on-premises Kubernetes distributions, and hybrid environments. The platform is API-driven and integrates with SIEM systems, ticketing tools, and container orchestrators natively.
Key Features and Architecture
Aqua Security's architecture divides into several functional layers that map to different stages of the application lifecycle.
Image Scanning and Supply Chain Security. Aqua scans container images for known vulnerabilities (CVEs), embedded secrets, malware, and misconfigurations. It integrates directly into CI/CD pipelines, registries, and IDE plugins. The platform generates SBOMs in both SPDX and CycloneDX formats, which is increasingly required for regulatory compliance. Scanning extends beyond containers to cover infrastructure-as-code templates (Terraform, CloudFormation) and Kubernetes manifests.
Runtime Protection. This is where Aqua differentiates most clearly from scan-only tools. The platform deploys lightweight enforcers (agents) on each host or node that monitor process execution, file system changes, network connections, and system calls in real time. These enforcers can block unauthorized behavior based on pre-defined or auto-generated runtime policies. Drift prevention stops any binary or script not present in the original image from executing, which is a strong defense against supply chain attacks and container escapes.
Kubernetes-Native Security. Aqua provides admission controllers that enforce policies before pods are scheduled. It maps Kubernetes RBAC configurations, detects overly permissive roles, and audits cluster configurations against CIS benchmarks. Network policy visualization helps teams understand east-west traffic flows between services.
Cloud Security Posture Management (CSPM). The platform scans cloud accounts for misconfigurations, excessive permissions, and compliance drift across AWS, Azure, and GCP. It maps findings to frameworks like SOC 2, PCI-DSS, HIPAA, and NIST 800-53.
DTA (Dynamic Threat Analysis). Aqua runs suspicious images in a sandbox environment to detect malicious behavior that static scanning misses, such as crypto miners, reverse shells, and data exfiltration attempts. This sandbox analysis adds a layer of protection against zero-day threats embedded in base images or third-party dependencies.
Ideal Use Cases
Aqua Security fits best in organizations that have moved beyond basic container adoption and need production-grade runtime security. Teams running 50+ microservices across multiple Kubernetes clusters will get the most value from centralized policy management and automated enforcement.
Regulated industries (finance, healthcare, government) benefit from Aqua's built-in compliance frameworks and audit trail capabilities. The platform's ability to generate SBOMs and map vulnerabilities to regulatory standards simplifies compliance reporting significantly.
DevSecOps teams that want to shift security left without slowing developers down will appreciate the CI/CD integration and Trivy-based scanning. The open-source scanner can be adopted first at zero cost, with the commercial platform layered on when runtime protection and centralized governance become necessary.
Aqua is not the right choice for small teams running a handful of containers on a single cluster. The platform's complexity and enterprise pricing make it overkill for simple deployments. Teams focused purely on static scanning can use Trivy alone without the commercial offering.
Pros and Cons
Pros:
- Runtime protection with drift prevention is a genuine differentiator that scan-only tools cannot replicate
- Trivy provides an industry-standard free scanner that serves as a natural on-ramp to the platform
- Deep Kubernetes-native integration with admission control, RBAC analysis, and CIS benchmarking
- Dynamic Threat Analysis sandbox catches malicious behavior that static scanners miss entirely
- Multi-cloud and hybrid support covers AWS, Azure, GCP, and on-premises Kubernetes distributions
- Strong compliance framework mapping for SOC 2, PCI-DSS, HIPAA, and NIST standards
Cons:
- Aqua publishes no prices, so the commercial platform cannot be budgeted without a sales conversation
- Per-workload pricing model can produce unpredictable costs in environments with auto-scaling
- No self-service tier or trial; every evaluation requires engaging the sales team
- Platform complexity demands dedicated security engineering time for proper deployment and policy tuning