What is agentless cloud security?
Agentless cloud security assesses cloud infrastructure and workloads without installing any software on them. Configuration is read through cloud provider APIs with read-only credentials, and workload contents are inspected by analysing point-in-time volume snapshots out-of-band, so nothing runs on the systems being scanned.
Why agentless became the default
Agent rollouts are where security programmes stall. Every agent needs a package, a supported-platform matrix, a rollout plan, an exception list for the machines it breaks, a version upgrade treadmill, and a renewed argument with the platform team every quarter.
Six months in, a typical programme sits at partial coverage — and the uncovered remainder is disproportionately the legacy estate that most needs scanning. Worse, nobody can say with confidence which systems are uncovered, so the security posture report describes a subset of reality while reading like the whole.
Agentless inverts this. Coverage is complete from the first scan because there is nothing to install.
How agentless workload scanning works
Configuration assessment is straightforward — read the provider's APIs. Workload inspection is the interesting part:
- The platform assumes a read-only role and enumerates volumes attached to each workload.
- A snapshot is created using the cloud provider's native snapshot primitive.
- A short-lived scan worker mounts and analyses the snapshot — inside the customer's own account, orchestrated by native services such as AWS Step Functions, Azure Logic Apps or GCP Workflows.
- Structured results — package inventory, configuration signals, findings — are relayed out. Raw disk contents never leave the environment.
- The snapshot is deleted, and a reconciler sweeps orphaned artefacts so a failed scan cannot leave storage accruing cost.
A capacity manager throttles concurrent snapshots per cloud so scanning never competes with production for quota or IOPS.
What agentless sees
- Complete package and OS inventory from the real installed software, not a manifest
- Vulnerabilities matched against what is actually present
- Host configuration — users, keys, services, hardening state
- Secrets and credentials sitting on disk
- Malware and known-bad artefacts at rest
What agentless cannot see
Honest limitations matter here, because vendors routinely gloss over them:
- Live process execution. Snapshot scanning is point-in-time. A process that spawns and exits between scans is invisible.
- In-memory-only activity. Fileless techniques that never touch disk leave no snapshot artefact.
- Real-time blocking. Agentless observes; it does not intercept a syscall and stop it.
Much of the first gap is covered without agents by reading cloud-native audit and flow logs — CloudTrail, VPC Flow Logs, Azure Activity Log — which yields behavioural detection on the control plane and network without touching the workload. What genuinely requires an agent is host-level runtime prevention.
Choosing
| Agentless | Agent-based | |
|---|---|---|
| Coverage | Complete on day one | Whatever gets deployed |
| Deployment | None | Package, rollout, maintenance |
| Performance impact | None | CPU, memory, occasional instability |
| Runtime process telemetry | No | Yes |
| Real-time blocking | No | Yes |
| Point-in-time vs continuous | Point-in-time | Continuous |
Most mature programmes use agentless as the universal baseline, add log-based detection for behaviour, and deploy agents only on the narrow set of workloads that genuinely need runtime prevention. Starting with agents and hoping for coverage is the pattern that fails.
Next steps
Frequently asked questions
What is agentless cloud security?
Security assessment that requires no software installed on the systems being scanned. Configuration is read through cloud provider APIs, and workload contents are inspected by analysing point-in-time volume snapshots out-of-band.
Is agentless security less effective than agent-based?
For coverage, configuration assessment and vulnerability detection, agentless is generally more effective because it reaches 100% of workloads immediately. Agents retain a genuine advantage for continuous runtime process telemetry and real-time blocking, which snapshot scanning cannot provide.
Does agentless scanning send my data to the vendor?
It should not. In a well-designed implementation, snapshot analysis runs inside your own cloud account and only structured findings — package lists, configuration signals, finding records — are transmitted. Raw disk images and file contents never leave your environment. This is worth verifying explicitly during evaluation.
Does snapshot scanning increase cloud costs?
Marginally and briefly. Snapshots are incremental and point-in-time, and should be deleted as soon as analysis completes. A reconciler that sweeps orphaned snapshots matters, because a failed scan that leaves snapshots behind will quietly accrue storage cost.