Wiz vs Orca vs Prisma Cloud: the three-year CNAPP bill at 5,000 workloads

Agentless coverage is a scope decision

All three platforms sell agentless scanning of cloud accounts, and all three charge for what they scan rather than for the people who use the findings. Orca calls its method SideScanning and, per Vendr's guide, analyses cloud infrastructure from outside the runtime environment; Orca's own pricing note says unused workload credits can be moved to Orca Sensor when runtime coverage is needed. Wiz is sold as agentless scanning of cloud resources, and Vendr describes it as the agentless alternative to Prisma Cloud. Prisma Cloud is the outlier: its licensing documentation covers a Defender agent on hosts, containers and serverless functions as well as an agentless method, and each resource type draws a different number of credits.

What each one meters

Wiz prices by workload count, and Vendr notes that some contracts anchor to a percentage of annual cloud spend instead. Orca prices by cloud workload under one SKU, with the capabilities included rather than itemised. Prisma Cloud prices in credits, and its documentation sets the weight per resource: half a credit for a host that does not run containers, one credit for an on-demand container such as AWS Fargate or Google Cloud Run, one credit for every six serverless functions, and two credits per Defender for web application and API security.

None of the three publishes a rate. Wiz's pricing page offers three routes, Wiz One, Wiz Go and a la carte, and ends in a quote form; Prisma Cloud's documentation explains the credit weights but not the price of a credit; Orca's note states the model, not the number. The per-unit figures below therefore come from Vendr's contract data, not from a price list.

The modules that arrive as a second quote

Wiz's add-on list is the longest. Vendr separates container security, Kubernetes security, data security posture management, cloud detection and response, and infrastructure-as-code scanning from the core platform, and reports that buyers who bundle them at signature pay less than buyers who add them later. Prisma Cloud's extras are metered through the same credit pool: web application and API security costs two credits per Defender, and serverless coverage costs one credit per six functions, so a programme that starts as posture management can grow into a runtime bill without a new contract.

Orca's pitch is the absence of that list. Its pricing note says one SKU covers CNAPP, application security and runtime, with no add-ons and no surprise upgrades, and that unused workload credits can be shifted between capabilities. That is a packaging claim rather than a price, but it changes the three-year model: the only variable left is the workload count, plus whatever growth the estate adds.

The three-year number at 5,000 workloads

Vendr's dataset gives the cleanest comparison at a stated size. At 5,000 workloads it puts Orca at $200,000 to $400,000 a year and Wiz at $250,000 to $500,000, with Prisma Cloud at $250,000 to $450,000 in the same comparison. Across three years those bands become $600,000 to $1.2 million for Orca, $750,000 to $1.5 million for Wiz and $750,000 to $1.35 million for Prisma Cloud, before the multi-year discounts the same data reports at 15 to 30 percent for Orca and 20 to 35 percent for Wiz.

The medians point the same way. Vendr's median Wiz contract is $158,763 a year across 189 purchases and its median Orca contract is $95,625 across 99 purchases, with buyers saving 22 and 28 percent on average. Those medians mix 500-workload estates with 20,000-workload ones, so they are a sanity check rather than a budget. The 5,000-workload bands are the number to take into a renewal meeting.

Where the meter breaks

Two things move the number after signature. The first is the definition of a workload. Vendr's Wiz guide counts virtual machines, containers, Kubernetes nodes, serverless functions and data stores in the same number, while Prisma Cloud's credit table gives each resource type a different weight, so two platforms quoting 5,000 workloads can be measuring different estates. The second is overage. Vendr reports that exceeding a contracted workload count can trigger rates 15 to 30 percent higher than the negotiated per-unit price, and Prisma Cloud's documentation says exceeding the licence count raises a banner in the console but does not stop the Defenders, so the overage appears on the invoice rather than at deployment.

Prisma Cloud carries a third exposure: credits follow the resource mix, and its documentation notes that Serverless Radar consumes credits even when a deployment does not actively use it, because it is part of cloud discovery and cannot be disabled. An estate that buys a credit pool for its virtual machines and then turns on container and serverless scanning is buying a different pool.

The decision rule

Choose Orca if the estate wants one contract, one workload count and no module negotiation, and the runtime requirement is covered by SideScanning plus a sensor where needed. Choose Wiz if the security team will use the breadth of the module set, because the core platform alone gives up the container, DSPM and CDR coverage that justifies the platform. Choose Prisma Cloud if the estate already runs Palo Alto security products and wants the runtime coverage a Defender agent provides, and model the credit mix before signing rather than after the first container migration.

Whichever wins, fix the workload definition in the contract, price the modules at signature, and ask for the three-year number at the current count plus 30 percent growth. A CNAPP quote that does not name the workload definition is a number without a unit.