Prowler
Prowler is an open-source cloud security platform founded in 2016, offering CSPM across 16 cloud and SaaS providers via 1,700+ automated checks mapped to 70+ compliance frameworks. It monetizes through a freemium Prowler Cloud SaaS, AWS Marketplace distribution, and AI-driven remediation via Lighthouse AI and an MCP Server, serving security and compliance teams globally.
- Company typePrivate
- Founded2016
- HeadquartersPortland, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Prowler does
Prowler is an open-source cloud security platform, founded in 2016 by Toni de la Fuente and Casey Rosenthal and headquartered in Portland, Maine. The company provides cloud security posture management (CSPM) across 16 cloud and SaaS providers — including AWS, Azure, GCP, Kubernetes, Microsoft 365, Google Workspace, GitHub, Vercel, Alibaba Cloud, and Oracle Cloud — via 1,700+ automated security checks mapped to 70+ compliance frameworks (CIS, SOC 2, PCI DSS, HIPAA, ISO 27001, NIST 800-53, DORA, GDPR, NIS2, MITRE ATT&CK, ENS). The platform is built in Python under an Apache 2.0 license and ships as Prowler Cloud (managed SaaS), Prowler CLI (open-source command-line tool), Prowler App (containerized scanner), and Prowler Hub (web portal for check and framework catalog). As of late 2025, Prowler extended the platform with Lighthouse AI (generative-AI remediation engine that produces Terraform, Bicep, CloudFormation, and CLI fixes), an MCP Server for AI-agent access, Attack Path Visualization for exploit-chain prioritization, and a Claude Code plugin for autonomous SecOps workflows.
Prowler's business model is freemium and product-led-growth. The Prowler Cloud platform offers a free tier that requires no credit card, while paid subscription is structured as resource-based pricing at $0.001 per resource per day via AWS Marketplace. Distribution runs through three channels: self-serve sign-up at cloud.prowler.com, AWS Marketplace for enterprise procurement with consolidated billing, and the open-source GitHub repository (14K+ stars, 300+ contributors). The company has reached 45M+ cumulative downloads of the open-source tool and reports an active Slack community and an inaugural Open Cloud Security Conference held in April 2025. It sells primarily to security teams, SecOps professionals, and compliance/audit teams in SMB and enterprise organizations, with documented use cases in financial services driven by EU DORA requirements.
Prowler is privately held and venture-backed, having raised $12.5M in total seed funding led by Decibel VC across two tranches in February 2024 ($6M) and April 2025 ($6.5M extension). The leadership team combines founder expertise with enterprise operators: CEO Toni de la Fuente (former AWS security practitioner), COO Rajiv Taori (ex-AWS, SentinelOne), Head of Product Amit Sharma (ex-Splunk, SentinelOne, Cisco), Head of Customer Success Rosa Rivas (ex-Roche Diagnostics, Unit4), and Co-Founder and Head of Sales David Alles. The company reports 11-50 employees and has not disclosed revenue.
Prowler firmographics
Firmographics- Name
- Prowler
- Legal name
- Prowler
- Website
- https://prowler.com
- Company type
- Private
- Founded year
- 2016
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Prowler is an open-source cloud security platform founded in 2016, offering CSPM across 16 cloud and SaaS providers via 1,700+ automated checks mapped to 70+ compliance frameworks. It monetizes through a freemium Prowler Cloud SaaS, AWS Marketplace distribution, and AI-driven remediation via Lighthouse AI and an MCP Server, serving security and compliance teams globally.
- Ownership category
- akta.pro rank
Prowler industry classification
Industry- Product category
- Cloud Security Posture Management (CSPM)
- NAICS
- Computer Systems Design and Related Services (5415)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Cloud Security Managed Services (CSPM/CWPP/CNAPP) (BPAEADAF)
- akta.pro secondary industries
- Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC) (HDABAHAI), Cloud Security Services (Posture Mgmt, Workload Protection) (BPAKAHAK), Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)
Keywords
Where Prowler is headquartered
LocationHeadquarters
- HQ city
- Portland
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
Prowler business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations
Revenue model
- Prowler Cloud SaaS Platform: Managed cloud security platform with free tier for initial use, providing automated scanning, compliance reporting, and remediation capabilities. Revenue generated from cloud platform subscriptions with resource-based pricing.
- Enterprise Support and Features: Enterprise-grade features, support, and advanced capabilities beyond the free tier, likely including team management, priority support, and enhanced compliance features.
- AWS Marketplace Distribution: Available through AWS Marketplace enabling consolidated billing for AWS customers, with pricing at $0.001 per resource per day.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Free Tier - Prowler Cloud |
| Subscription | Pay-as-you-go | Resource-based pricing via AWS Marketplace |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels7 records
Prowler product offering
Product offeringCore offering
Prowler operates an open-source cloud security platform that runs 1,700+ automated security checks across AWS, Azure, GCP, Kubernetes, Microsoft 365, Google Workspace, GitHub and 16 total cloud and SaaS providers, with findings mapped to 70+ compliance frameworks. The company monetizes via Prowler Cloud, a managed SaaS layer built on the open-source engine, and adds AI-powered remediation through Lighthouse AI, an MCP Server for agent integration, and a Claude Code plugin that automates the full find-to-fix loop.
Product overview
Prowler is an open-source cloud security platform built around a core engine and multiple integrated modules. The primary offerings are Prowler Cloud (the managed SaaS platform), Prowler CLI (the open-source command-line tool), and Prowler App (containerized scanner). On top of the core scanning engine, Prowler layers AI-powered remediation via Lighthouse AI, an MCP Server for agent integration, and a Claude Code plugin for autonomous SecOps workflows. Prowler Hub serves as the companion web portal for browsing checks and compliance mappings. The platform supports 16+ cloud and SaaS providers including AWS, Azure, GCP, Kubernetes, Microsoft 365, GitHub, and Vercel, delivering 1,700+ security checks mapped to 70+ compliance frameworks. Findings can be remediated manually, via Lighthouse AI-generated IaC/CLI fixes, or automated end-to-end through the Claude Code plugin which opens fix pull requests and re-scans to verify closure.
Differentiator
Problem solved
Functional benefit
Products and services
- Prowler Cloud Managed SaaS platform for continuous cloud security posture management across AWS, Azure, GCP, Kubernetes, and 16 total providers with 1,700+ automated security checks, attack path visualization, and compliance reporting mapped to 70+ frameworks.
- Prowler CLI Open-source command-line interface for running security scans locally, in CI/CD pipelines, or from cloud shells, supporting the same check catalog as Prowler Cloud with JSON, CSV, HTML, JUnit, and OCSF output formats.
- Prowler App Containerized Prowler scanner for local installations, CI/CD integration, and in-cluster Kubernetes CronJob deployments of scheduled cloud security scans.
- Prowler Hub Companion web portal to Prowler Cloud and CLI providing a searchable catalog of all security checks, their open-source logic, compliance framework mappings, and remediation guidance.
- Lighthouse AI AI-powered remediation engine in Prowler Cloud that generates fixes for security findings as infrastructure-as-code (Terraform, Bicep, CloudFormation), CLI commands, or guided manual steps, supporting multiple LLM backends.
- Prowler MCP Server Model Context Protocol server enabling AI assistants and agents to interact with Prowler Cloud programmatically, exposing findings, resources, attack paths, check catalog, compliance frameworks, and scan operations.
- Prowler Plugin for Claude Code Claude Code plugin bundling the MCP server and compliance-triage skill, enabling autonomous cloud security workflows that prioritize findings by blast radius, open fix pull requests, and re-scan to confirm remediation.
Quantifiable outcome
- 10x cost efficiency versus black-box commercial CSPM tools
- +3 more outcomes
Companies that use Prowler
Customer profileSegments5 records
Ideal customer profiles3 records
Prowler technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration13 records
AI capability9 records
Feature6 records
Prowler partnerships and signals
Strategic signalPartnerships
Two partnerships are on record, tiered minor.
- Total Cyber-SecminorComprehensive security consulting and implementation services firm. Total Cyber-Sec provides professional services for implementing Prowler and building security programs around it.
- FullStack PlatformsminorEnd-to-end DevSecOps and cloud security automation specialists. FullStack Platforms provides implementation services integrating Prowler into customer DevSecOps workflows.
Scale indicators8 records
Recent moves6 records
Expansion highlights6 records
Prowler competitors and assessment
Company assessmentDirect peers
- Wiz: Wiz is the leading CNAPP platform offering agentless cloud security posture management, workload protection, and identity security across AWS, Azure, GCP, and Kubernetes. It is the most direct competitor to Prowler in CSPM, with substantially greater scale and funding.
- Orca Security: Orca Security provides agentless cloud security and compliance posture management across multi-cloud environments, with SideScanning technology that maps vulnerabilities, misconfigurations, and attack paths. Directly comparable to Prowler on CSPM scope and target buyer.
- Lacework: Lacework offers automated cloud security posture management and threat detection across AWS, Azure, GCP, and Kubernetes via its Polygraph data platform. Competes with Prowler in CSPM and compliance auditing for cloud-native workloads.
- Aqua Security: Aqua Security provides cloud-native application protection covering workloads, containers, and infrastructure-as-code scanning across AWS, Azure, GCP, and Kubernetes. Overlaps with Prowler on cloud security posture and Kubernetes scanning, particularly for DevSecOps buyers.
- Sysdig: Sysdig delivers cloud security and monitoring built on Falco, covering CSPM, runtime threat detection, and container/Kubernetes security across AWS, Azure, and GCP. Directly competes with Prowler in cloud security posture and Kubernetes scanning for cloud-native buyers.
- Tenable Cloud Security (formerly Ermetic): Tenable Cloud Security (acquired from Ermetic) provides agentless CSPM, CIEM, and Kubernetes security posture management. Directly comparable to Prowler on multi-cloud posture, identity, and compliance use cases, now backed by Tenable's broader vulnerability management portfolio.
Broad incumbents
- Palo Alto Prisma Cloud: Prisma Cloud is Palo Alto Networks' CNAPP platform covering CSPM, CWPP, CIEM, and code security across all major cloud providers. As a broad incumbent with multi-billion-dollar scale, it competes with Prowler across nearly every CSPM use case but as part of a much larger security portfolio.
- CrowdStrike Falcon Cloud Security: CrowdStrike bundles CSPM, CWPP, CIEM, and runtime protection into Falcon Cloud Security as part of its broader endpoint and workload security platform. A broad incumbent competitor to Prowler, particularly for buyers consolidating security vendors onto a single agent platform.
- Microsoft Defender for Cloud: Microsoft Defender for Cloud provides CSPM and workload protection natively across Azure, AWS, GCP, and hybrid environments, often bundled with Azure subscriptions. Competes directly with Prowler on multi-cloud posture management and is a structural threat given its inclusion in Azure enterprise agreements.
- Check Point CloudGuard: Check Point CloudGuard offers CSPM, workload protection, and network security across AWS, Azure, GCP, and Kubernetes as part of Check Point's broader security platform. A broad incumbent competitor to Prowler for buyers seeking consolidated cloud security from an established vendor.
Market position
Strengths5 records
Competitive moat6 records
Key risks5 records
Key highlights7 records
Customer concentration
Prowler social profiles
Digital presenceProwler compliance and trust
Trust signalCompliance12 records
Prowler financial estimates
Financial estimateRevenue estimate
Valuation estimate
Prowler leadership team
Management profileNumber of profiles
Profiles5 records
Prowler funding detail
Funding detailFunding overview
Funding rounds2 records
Investors3 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Prowler M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Prowler
What does Prowler do?
Prowler operates an open-source cloud security platform that runs 1,700+ automated security checks across AWS, Azure, GCP, Kubernetes, Microsoft 365, Google Workspace, GitHub and 16 total cloud and SaaS providers, with findings mapped to 70+ compliance frameworks. The company monetizes via Prowler Cloud, a managed SaaS layer built on the open-source engine, and adds AI-powered remediation through Lighthouse AI, an MCP Server for agent integration, and a Claude Code plugin that automates the full find-to-fix loop.
Is Prowler a public or private company?
Prowler is a private company. It is classified as venture growth investor backed and is currently operating.
When was Prowler founded?
Prowler was founded in 2016. It employs 11 to 50 people.
Where is Prowler based?
Prowler is headquartered in Portland, United States, in the North America region.
How does Prowler make money?
Three revenue lines are on record. Prowler Cloud SaaS Platform is the primary driver. The others are enterprise Support and Features and AWS Marketplace Distribution.
Who are Prowler's main competitors?
Direct peers on record are Wiz, Orca Security, Lacework, Aqua Security, Sysdig and Tenable Cloud Security (formerly Ermetic). Broad incumbents are Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Microsoft Defender for Cloud and Check Point CloudGuard.
Does Prowler have an API?
Yes. Prowler offers a public REST API that allows developers to programmatically access scan findings, compliance reports, and manage providers. The API is available at api.prowler.com/api/v1/docs and supports fetching reports to feed GRC platforms and ticketing systems. Users can generate API keys from their Prowler Cloud profile to authenticate. Developer documentation is at api.prowler.com/api/v1/docs.
What industry is Prowler in?
Prowler's product category is Cloud Security Posture Management (CSPM). Its primary akta.pro industry code is BPAEADAF, Cloud Security Managed Services (CSPM/CWPP/CNAPP), with a secondary code of HDABAHAI, Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC). Its NAICS code is 5415 and its SIC code is 7372.