The Onam blog
New findings, deep dives on cloud attacks, and product updates from the Onam team.
Wiz vs Orca POC: 30 questions to ask in any CNAPP trial
Running a Wiz vs Orca (or any CNAPP) POC? 30 vendor-neutral questions grouped by week: access, coverage, accuracy, prioritisation, remediation and cost.
DSPM implementation checklist: a practical rollout for cloud data
A step-by-step DSPM implementation checklist: inventory every data store, classify it, map who can reach it, and fix exposure in a sensible order.
Data lineage security: why encryption is a property of the flow, not the bucket
Every bucket passes its encryption check, yet the data still lands somewhere unprotected. How data lineage security finds the weak hop in a pipeline.
IaC security scanning: fix the template, or the finding comes back
Console fixes are undone by the next terraform apply. A practical guide to IaC security scanning that traces cloud findings back to the template line.
CI/CD security gates that engineers do not bypass
Security gates that fail every build get switched off. How to design CI/CD security gates around new findings, clear output and an exception path.
AI SAST remediation: what an AI code fix should and should not do
AI can draft fixes for SAST findings, but it should never merge its own code. A practical look at safe AI SAST remediation, with a review checklist.
Cloud access reviews: a checklist that ends in decisions, not spreadsheets
Most cloud access reviews are a spreadsheet nobody answers. A practical checklist for reviewing cloud entitlements, including machine identities.
Wiz alternatives in 2026: 8 cloud security platforms compared
Wiz alternatives in 2026 compared: Orca, Cortex Cloud, Defender for Cloud, CrowdStrike, Tenable, Sysdig and more. Who each fits, how it deploys, pricing.
Best CSPM tools in 2026: 9 compared, with a buyer's checklist
Best CSPM tools in 2026 compared: Wiz, Orca, Defender for Cloud, Cortex Cloud, CrowdStrike, Tenable and more. Who each fits, deployment, how to choose.
Wiz vs Orca vs Prisma Cloud: 7 questions that decide a POC
Wiz vs Orca vs Prisma Cloud (now Cortex Cloud) in 2026: the 7 POC questions that separate them, a copyable scorecard, and where Onam fits and falls short.
Beyond GuardDuty: how three-level behavioral detection catches what rules miss
Cloud threat detection needs three levels: rules for single suspicious events, correlation across several events, and statistical behaviour baselines.
5 AWS misconfigurations that commonly show up on a first scan
Five AWS misconfigurations that commonly show up on a first scan: what they are, why they persist, and how to fix them fast.
CIEM vs IAM Security: what's actually the difference?
They sound identical. They aren't. Here's the practical split between IAM Security and Cloud Infrastructure Entitlement Management — and why you need both.
AI-powered cloud remediation: from finding to a reviewed fix
AI-powered cloud remediation: fix prompts that name the resource, AI code fixes on a review branch, and attack-path stories that explain why a fix matters.
Attack paths vs. misconfigurations: why chained findings are your real cloud risk
CSPM tools surface hundreds of misconfigurations. The ones behind breaches chain together; attack path analysis shows which chains are dangerous.
The FAIR model for cloud security: putting a dollar value on your attack surface
FAIR model for cloud risk: CVSS ranks severity, FAIR asks what a breach of this attack surface would cost. How Onam applies a FAIR-style estimate.
Kubernetes RBAC pitfalls that grant cluster-admin by accident
Kubernetes RBAC pitfalls: a ClusterRoleBinding here, an aggregated role there, and a role that can only create pods can mount the host filesystem. Six patterns to audit.
EPSS over CVSS: prioritising the CVEs attackers actually exploit
CVSS tells you how bad a vulnerability could be. EPSS tells you how likely it is to be exploited in the next 30 days. Guess which one predicts breaches.
Why cloud IAM permissions go unused — and why that matters
Your IAM policies are accumulating unused permissions faster than your team can audit them. Here's what the data shows and how to close the gap.
MITRE ATT&CK for Cloud: mapping real attacks to your posture score
How MITRE ATT&CK for Cloud translates abstract threat techniques into concrete cloud misconfigurations — and how your posture score tracks each one.
How we check thousands of rules without agents: the architecture behind Onam
Agentless cloud security architecture: how Onam scans 7 clouds with read-only posture roles and agentless workload scanning that runs in your account.