Aqua Security

What Aqua Security does

Aqua Security is a private, venture-backed cybersecurity company founded in 2015 and headquartered in Ramat Gan, Israel, with US operations in Burlington, Massachusetts and additional R&D centers in Hyderabad and Singapore. It sells a unified Cloud Native Application Protection Platform (CNAPP) that combines agent-based runtime protection with agentless posture management to secure containers, Kubernetes, serverless functions, virtual machines, and increasingly AI workloads across AWS, Azure, Google Cloud, IBM Cloud, and on-premises environments. The platform is built around a proprietary runtime enforcement engine (patented, eBPF-based via Tracee, covering 330+ Linux syscalls) and is anchored by the Trivy open-source vulnerability scanner, which has accumulated more than 100 million annual downloads and over 27,000 GitHub stars, plus related projects Tracee, kube-bench, and kube-hunter. Commercial modules include Cloud Security Posture Management (CSPM), Kubernetes Security Posture Management (KSPM), Cloud Workload Protection Platform (CWPP), Software Supply Chain Security, Dynamic Threat Analysis, Aqua Secure AI for LLM/GenAI protection, and Aqua Compass, an MCP server that enables AI agents to autonomously investigate and remediate runtime incidents.

The company monetizes primarily through quote-based annual enterprise subscriptions to its Aqua Enterprise platform, with consumption-based procurement available via AWS and GCP Marketplaces. Its go-to-market combines product-led growth from open-source adoption with direct enterprise field sales, and it counts more than 500 large enterprise customers, including 41% of the Fortune 100 and 10 of the top 20 global banks, across financial services, federal government, technology, automotive, and consulting verticals. Notable named customers include Audi, JP Morgan Chase, Microsoft, Adobe, PayPal, Nasdaq, EY, NCR, and GitLab. Aqua has raised roughly $325 million in disclosed venture funding from Insight Partners, Lightspeed Venture Partners, ION Crossover Partners, TLV Partners, StepStone Group, Evolution Equity Partners, M12 (Microsoft's venture fund), Acrew Capital, Greenspring Associates, Phoenix Financial, and Capital One Ventures, with angel participation from Shlomo Kramer (co-founder of Check Point, Imperva, and Cato Networks). Cumulative capital has been deployed against acquisitions of CloudSploit (2019), tfsec (2021), and Argon Security (December 2021), and against compliance milestones including FedRAMP High Authorization achieved in January 2025 and AWS Government Competency in 2025. Recent strategic moves include a July 2024 workforce reduction of approximately 10%, a February 2026 leadership transition under new CEO Mike Dube with a strategic refocus on runtime exposure management, and disclosure of a March 2026 supply chain compromise of its Trivy scanner that prompted a CISA Known Exploited Vulnerabilities listing.

Name

Aqua Security

Legal name

Aqua Security Software Ltd.

Website

https://aquasec.com

Company type

Private

Founded year

2015

Operating status

Operating

Headcount range

251–500 employees

Short description

Aqua Security sells a unified CNAPP platform for cloud-native and AI workloads, combining eBPF-based runtime protection with the Trivy open-source scanner to secure containers, Kubernetes, serverless, and VMs for 500+ large enterprises including 41% of the Fortune 100.

Ownership category

akta.pro rank

Product category

Cloud Native Application Protection Platform (CNAPP)

NAICS

Computer Systems Design and Related Services (5415), Computer Systems Design and Related Services (54151), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182)

SIC

Services-Computer Programming Services (7371), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

CNAPP Platforms (Unified CNAPP) (HDADADAA)

akta.pro secondary industry

Cloud-Native Application Protection Platforms (CNAPP) (HDABAHAH)

Keywords

• Cloud native security
• Container security
• Vulnerability management
• Runtime threat detection
• Kubernetes security

Headquarters

HQ city

Ramat Gan

HQ country

Israel

HQ region

Middle East

Offices4 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Enterprise CNAPP Platform Subscription: Full-featured Aqua Cloud Native Application Protection Platform available via subscription for enterprise deployments, with consumption options through AWS Marketplace. Protects containers, Kubernetes, serverless, VMs, and AI workloads across the application lifecycle.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels7 records

Core offering

Aqua Security provides a Cloud Native Application Protection Platform (CNAPP) that combines agent-based runtime enforcement with agentless posture and vulnerability scanning to protect containers, Kubernetes, serverless functions, and VMs across the application lifecycle. The platform bundles open-source security tools (Trivy for vulnerability scanning, Tracee for runtime detection via eBPF, kube-bench for CIS benchmarking) with commercial capabilities including Dynamic Threat Analysis (sandbox-based zero-day detection), Drift Prevention, software supply chain security, AI workload protection, and Aqua Compass MCP server for autonomous incident response, delivered to enterprises as an annual subscription or via AWS/GCP marketplaces.

Product overview

Aqua Security offers a unified Cloud Native Application Protection Platform (CNAPP) designed to secure the entire application lifecycle from code development through runtime production. The platform combines open-source tools (Aqua Trivy for vulnerability scanning, Tracee for runtime threat detection via eBPF, and Kube-bench for Kubernetes CIS compliance) with commercial modules including CSPM for cloud posture management, KSPM for Kubernetes-specific security, CWPP for workload protection, Software Supply Chain Security, DevSecOps pipeline automation, Container Security, Serverless Security, VM Security, Aqua Dynamic Threat Analysis for sandbox-based analysis, Aqua Secure AI for AI application protection, and Aqua Compass as an MCP server for autonomous incident investigation. The open-source components serve as entry points while the commercial Aqua Enterprise platform provides enterprise-grade centralized management, policy enforcement, and advanced threat protection across hybrid and multi-cloud environments.

Differentiator

Problem solved

Functional benefit

Brands

• Trivy: Open-source vulnerability scanner for container images and applications with over 27,000 GitHub stars and 100 million annual downloads.
• Tracee
• Kube-bench
• Kube-hunter
• Aqua Trivy
• Aqua Secure AI
• Aqua Compass

Products and services

• Aqua Cloud Native Security Platform (CNAPP) A unified Cloud Native Application Protection Platform (CNAPP) that secures containers, Kubernetes, serverless functions, and VMs across the application lifecycle, combining agent-based runtime protection, agentless posture management, vulnerability management, and software supply chain security for enterprise cloud-native deployments.
• Aqua Trivy Standalone comprehensive vulnerability scanner for containers, Kubernetes, filesystems, IaC templates, and cloud resources, available as a free open-source tool and as a premium subscription for enterprise-grade consistency across the SDLC.
• Aqua Tracee Open-source runtime threat detection tool for Linux and Kubernetes that uses extended Berkeley Packet Filter (eBPF) technology to observe system activity from the Linux kernel, collecting security events and identifying suspicious behaviors using behavioral indicators.
• Aqua Kube-bench Open-source Kubernetes compliance tool that checks whether Kubernetes deployments adhere to CIS Kubernetes Benchmarks, used by DevSecOps and platform security teams to validate cluster configurations.
• Aqua Compass Model Context Protocol (MCP) server that enables AI agents to autonomously investigate, contain, and remediate runtime security incidents in containerized environments, allowing security teams to move from alert to action in seconds by leveraging enterprise knowledge bases.
• Aqua Secure AI Integrated product providing full-lifecycle protection for AI applications in cloud-native environments, defending genAI workloads against prompt injection, data leakage, model tampering, and OWASP LLM Top 10 threats with real-time visibility and policy enforcement.
• Aqua Container Security Risk Assessment Standalone runtime-driven container security risk assessment tool that uses anomaly detection to identify the small subset of vulnerabilities actually exploitable in production environments, distinct from broad theoretical vulnerability scanning.

Quantifiable outcome

• 90% reduction in vulnerability research and detection time
• +2 more outcomes

Named customers13 records

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration51 records

AI capability10 records

Feature6 records

Partnerships

Seven partnerships are on record, tiered core.

• AkamaicoreStrategic or Co-development Partner · 5 August 2025Strategic partnership to secure AI in the enterprise combining Aqua's runtime security with Akamai's Firewall for AI. Protects genAI workloads by preventing prompt injection, data leakage, model tampering with real-time visibility and policy enforcement.
• Red HatcoreTechnology or IntegrationAqua Security provides native security across Red Hat OpenShift container platform with full lifecycle security controls including image scanning, secrets management, and runtime security at scale.
• VMware TanzucoreTechnology or IntegrationNative security across VMware Tanzu Application Service and Kubernetes Grid with comprehensive cloud native security platform protecting software supply chain, detecting risks, and stopping runtime attacks.
• AWScoreTechnology or IntegrationAdvanced APN member and Container Competency technology partner providing highly-integrated security controls for AWS services including ECS, EKS, Fargate, Lambda, and ECR.
• Google Cloud PlatformcoreTechnology or IntegrationProtection for cloud native workloads on Google Kubernetes Engine (GKE) from development to production, deployable as Kubernetes App from GCP Marketplace.
• Microsoft AzurecoreTechnology or IntegrationComplete security for Azure Container Workloads including AKS, Azure Container Instances, and Azure Functions with full lifecycle protection.
• IBMcoreTechnology or IntegrationProtection for containerized workloads on IBM LinuxONE and IBM Z mainframes with leading container and Kubernetes security controls from development to production.

Scale indicators5 records

Recent moves7 records

Expansion highlights6 records

Direct peers

• Wiz: Wiz is the leading direct CNAPP competitor, offering an agentless cloud security platform covering CSPM, CWPP, CIEM, and container security. It directly contests Aqua in enterprise evaluations, particularly for posture management and multi-cloud visibility.
• Lacework: Lacework is a CNAPP specialist focused on behavioral anomaly detection for cloud workloads. Following strategic changes in 2023-2024, it competes more narrowly with Aqua in cloud workload protection and behavioral runtime analytics for AWS-centric customers.
• Sysdig: Sysdig is a direct competitor in container and Kubernetes security, with a Falco-based open-source runtime detection engine and a CNAPP platform. It directly overlaps Aqua in container runtime protection and is commonly seen alongside Aqua on enterprise shortlists.
• Orca Security: Orca offers an agentless CNAPP platform emphasizing side-scanning for cloud workloads. Aqua has a documented technology partnership with Orca, but Orca is also a competitor for CNAPP deals prioritizing agentless posture and vulnerability coverage.

Broad incumbents

• Palo Alto Networks (Prisma Cloud): Prisma Cloud is Palo Alto Networks' CNAPP offering, combining CSPM, CWPP, IaC scanning, and CIEM. As a broad incumbent with a large installed network-security base, it competes with Aqua across enterprise accounts and bundles CNAPP into broader platform deals.
• CrowdStrike: CrowdStrike expanded from endpoint into cloud security via Falcon Cloud Security, offering agent-based runtime and posture management. Its single-agent architecture and massive enterprise footprint make it a direct competitor in modern CNAPP deals, particularly where buyers favor consolidation.
• Tenable: Tenable is a vulnerability-management incumbent that expanded into cloud security (Tenable Cloud Security, formerly Accurics). It competes with Aqua in vulnerability prioritization and CSPM, and is commonly evaluated in enterprise VM consolidation deals.
• Microsoft Defender for Cloud: Defender for Cloud is Microsoft's hyperscaler-native CSPM/CWPP offering, deeply integrated with Azure and increasingly extending to AWS/GCP. It is the default CNAPP option for Microsoft-heavy enterprises and a constant competitor in joint Microsoft-Aqua deals.

Emerging players

• Snyk: Snyk is a developer security platform with container and IaC scanning that overlaps Aqua's code-to-cloud capabilities. While Snyk's core is SAST/SCA, its container and infrastructure-as-code modules increasingly compete with Aqua in shift-left segments.
• Checkov (Bridgecrew): Bridgecrew (now part of Palo Alto's Prisma Cloud) created Checkov, an open-source IaC scanner that overlaps Aqua Trivy's IaC and tfsec (acquired by Aqua) capabilities. It represents the IaC scanning competitive lane within CNAPP.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/AquaSecTeam
• GitHubgithub.com/aquasecurity
• Facebookfacebook.com/AquaSecTeam
• LinkedInlinkedin.com/company/aquasecteam
• Instagraminstagram.com/aquaseclife

Compliance8 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles7 records

Subsidiaries2 records

Funding overview

Funding rounds8 records

Investors12 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A3 records

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Aqua Security