Container security with Twistlock and Prisma Cloud

Informatec Digital » Resources » Container security with Twistlock and Prisma Cloud

Container security has become critical for any company working with Kubernetes, Docker, or microservices architectures in the cloud. The challenge is no longer just deploying faster, but doing so without opening doors to attackers who exploit vulnerable images, weak configurations, or excessive permissions.

Twistlock, now integrated into Palo Alto Networks' Prisma Cloud, is a leading solution for protecting containers and cloud-native workloads. The former container security platform has been merged into a comprehensive Cloud Native Application Protection Platform (CNAPP) that covers everything from code-level security to runtime security, including CI/CD, logging, runtime security, and regulatory compliance.

Microservices architectures and the challenge of securing containers

Microservices architectures are inherently dynamic (and the choice between Docker Compose and Kubernetes ) : pods, services, and containers are deployed continuously, versions are updated multiple times a day, and instances are scaled according to load. This model accelerates development but renders traditional security based on static perimeters and occasional manual checks obsolete.

Containers ensure that software behaves the same across different environments (dev, pre-production, on-premises, public cloud), and this very portability makes them a prime target for attackers. A single vulnerable base image can spread to hundreds or thousands of deployments in a matter of minutes.

Modern container security must encompass the entire lifecycle : from image building in the CI/CD pipeline, through log scans, to runtime behavior. If security is only checked before deployment or only during runtime, dangerous gaps will always remain.

Specialized container security tools like Prisma Cloud (formerly Twistlock) cover the host, network, management stack, build pipeline, image layers, and the containerized application itself. The goal is to maintain continuous monitoring that adapts to the ephemeral and ever-changing nature of cloud-native environments.

In parallel, the ecosystem has become filled with complementary solutions such as Wiz, Snyk, Trivy, Anchore, Aqua Security, Sysdig, and Qualys, each with its own focus: vulnerability scanning, compliance, runtime defense, CSPM, etc. Prisma Cloud integrates and extends many of these capabilities into a single platform.

What are container security tools and why does Prisma Cloud stand out?

Container security tools are software solutions specifically designed to address the security challenges of Docker, Kubernetes, Fargate, ECS, AKS, GKE, OpenShift, and other orchestration platforms. They go beyond simple image antivirus: they add context, policies, compliance, and visibility across the entire environment.

In the case of Prisma Cloud Compute (the direct successor to Twistlock) , we're talking about a platform that protects hosts, containers, serverless functions, and, in general, cloud-native workloads. It offers vulnerability management, compliance controls, runtime defense with rules and machine learning, cloud-native firewalls (such as WaaS for web applications and APIs), and granular access control.

Twistlock began as a vulnerability management and compliance solution for the entire container lifecycle, focused on scanning images and preventing insecure components from moving from development to production. Over time, it added continuous monitoring of logs, networks, and runtime, as well as access controls and segmentation.

Following its acquisition by Palo Alto Networks in 2018 , all these capabilities were incorporated into Prisma Cloud, which already covered other areas of cloud security. The result is a CNAPP capable of managing rules on Docker configurations, images, nodes, plugins, and services, integrating with secret managers like CyberArk or HashiCorp, and consuming Kubernetes audit logs to generate actionable alerts.

This integration allows for very granular visibility of dependencies, packages, image layers, and runtime behaviors, both in CI/CD pipelines and in containers running on hosts, container-as-a-service platforms, or hybrid and multicloud environments.

Container scanning: a key element in the security strategy

Container scanning is the first line of defense for detecting vulnerabilities in base images, third-party libraries, and custom code. Integrating scanning into CI/CD pipelines allows you to catch problems before deployment and avoids having to put out fires in production.

Detecting vulnerabilities early saves time and money : it's much cheaper to fix a vulnerable library during the build phase than in a production cluster with dozens of services depending on it. Furthermore, it prevents chaotic rollbacks and unnecessary exposure.

Scanning is also vital for protecting the software supply chain , which increasingly includes external components: public images, third-party packages, artifacts from other teams, etc. Validating that everything included in the image does not contain known CVEs or dangerous configurations is now mandatory.

From a regulatory standpoint, many industries require regular vulnerability scans and evidence that images and containers comply with standards such as GDPR, HIPAA, PCI DSS, or CIS benchmarks. A centralized scanning tool facilitates audits and report generation.

Another advantage is the reduction of the attack surface : scanners detect unnecessary packages, forgotten debugging tools, or components that add no functionality but do increase risk. By eliminating everything superfluous, lighter and much more secure images are obtained.

Automation of security in CI/CD and defense against zero-day attacks

Integrating security into CI/CD and practices like GitOps is what allows us to truly talk about DevSecOps. Instead of relying on occasional manual reviews, each commit or build automatically triggers image scans, code analysis, IaC review, and policy checks.

Prisma Cloud Compute integrates with tools such as Jenkins, GitHub, GitLab , and other CI providers to reject builds that do not comply with the policy, generate reports for developers, and block the promotion of vulnerable artifacts to higher environments.

Automation is also key to mitigating zero-day vulnerabilities . Even if an image has already passed all checks, new CVEs associated with packages included in that image can appear. With continuous scanning of registry entries and running environments, the platform re-evaluates images as soon as the vulnerability database is updated.

This approach minimizes the exposure window : the organization learns within hours that an image deployed weeks ago has now become problematic, and can prioritize correction based on criticality, internet exposure, data handled, etc.

In terms of reputation, demonstrating regular, automated scanning builds trust with customers, partners, and regulators. Companies that take container security seriously typically stand out in tenders and due diligence processes.

Prisma Cloud Compute (Twistlock): architecture, requirements and deployment

Prisma Cloud is offered in two main deployment options : the Enterprise SaaS edition, hosted and managed by Palo Alto Networks, and the self-hosted Compute edition, which the customer deploys on their own infrastructure (on-premises, cloud or hybrid).

The Compute Edition directly inherits the Twistlock architecture , with a central console that orchestrates policies, collects data and displays global visibility, and Defender agents deployed on hosts, Kubernetes nodes, Fargate, EC2, Windows containers and serverless environments.

Regarding the console's technical requirements , for small environments (fewer than 1000 Defenders and without intensive log scanning) it can be booted with approximately 2 GB of RAM and 2 vCPUs. For large deployments with more than 20,000 Defenders, Palo Alto recommends up to 16 vCPUs, around 50 GB of RAM, and approximately 500 GB of persistent SSD storage.

Defenders has relatively low resource consumption : it can operate with around 256 MB of RAM in basic scenarios and scale up to about 2 GB of RAM and 2 vCPUs when performing log scanning or more intensive workloads. In terms of disk space, it uses about 8 GB per host, increasing to 20 GB if local log analysis is performed.

If scans are integrated into CI , the recommended space is to have at least 1,5 times the size of the largest image to be scanned per executor, in order to be able to download, analyze and generate the necessary artifacts without bottlenecks.

Prisma Cloud performance and large-scale testing

Palo Alto Networks has published Prisma Cloud performance tests in very large environments simulating real-world workloads. One of these scenarios involved Kubernetes clusters totaling 20,000 hosts, a console with 16 vCPUs and 50 GB of memory, and Defenders with 2 vCPUs and 8 GB of RAM running on a container-optimized operating system.

In that environment, 323 images and nearly 200,000 containers were analyzed , with an approximate density of 9,6 containers per host. The console consumed around 1474 MiB of RAM and 8% of the CPU, while each Defender used about 83 MiB of RAM and 1% of the CPU—fairly reasonable figures for a real-time security system.

Individual container scans take an average of 1 to 5 seconds , with an additional 10-15% memory consumption and barely 1% CPU usage during the scan. This makes it feasible to integrate scanning even into demanding pipelines without slowing down the time-to-market for new features.

Beyond CPU and RAM numbers, the real impact is seen in SecOps and DevOps . A Forrester Consulting TEI (Total Economic Impact) study for Prisma Cloud calculated a 264% return on investment, a SecOps efficiency improvement valued in the millions of dollars, and a significant reduction in materially serious security incidents.

Another interesting metric is the reduction in incident resolution time : users report going from analyses that previously took days to investigations that are completed in about 3,3 hours, thanks to unified telemetry and dashboards that centralize logs, alerts and network context, IAM and configuration.

Prisma Cloud security capabilities inherited and expanded from Twistlock

The core of what Twistlock was focused on vulnerability management throughout the entire container lifecycle. Prisma Cloud follows that path and adds extra layers of context and automation to prioritize what to fix first.

The platform establishes a risk prioritization based on known CVEs , severity, exploitability, actual runtime exposure, service criticality, and the existence of remediation paths. It offers remediation guides, layered image analysis, and Top 10 lists of the most critical vulnerabilities for each service.

At the active protection level, Prisma Cloud controls the severity of alerts and blocks, allowing you to adjust for each service and group which behaviors should only generate warnings and which should be blocked during build or at runtime, for example, in response to attempts to execute dangerous commands within a container.

The accuracy of vulnerability detection is enhanced by over 30 upstream sources feeding the CVEs and alerts database. This reduces false positives and helps teams focus on what truly matters, instead of wasting time sifting through noise.

Furthermore, Prisma Cloud integrates vulnerability management across the board : it scans code repositories, container logs, CI/CD pipelines, and runtime environments. This avoids the common problem of having isolated tools that don't communicate with each other.

Prisma Cloud as CNAPP: beyond container security

Today, Prisma Cloud is a complete CNAPP platform that goes far beyond Twistlock. It includes modules for cloud security posture management (CSPM), workload protection (CWP), rights management (CIEM), network security, data security, and controls over infrastructure as code and CI/CD pipelines.

In CSPM, the solution reviews configurations across AWS , Azure, GCP, OCI, and Alibaba Cloud , detecting excessive permissions, exposed resources, misconfigured services, and deviations from frameworks such as CIS, PCI, or internal company benchmarks. Remediation can be manual or automated.

In the CWP domain, Prisma Cloud protects hosts, containers, and serverless functions with vulnerability management, process monitoring, network defense, file integrity control, and behavior rules that can be based on signatures, dynamic analysis, and machine learning.

The CIEM module focuses on cloud rights and identities , identifying overprivileged credentials, unused roles, exposed keys, or cross-account access that can lead to dangerous lateral movements after an initial breach.

The network security component includes anomaly detection capabilities , attack path analysis, tag-based segmentation, and integration with next-generation Palo Alto firewalls (PAN-OS, Strata Cloud Manager, Panorama), enabling consistent policies between the traditional network world and Kubernetes.

Native security for Kubernetes and containers with Prisma Cloud

One of Prisma Cloud's strengths is its native Kubernetes protection . It integrates with the control plane to provide direct visibility into containers, pods, and namespaces, and enforces dynamic, tag-based policies instead of rigid IP addresses.

The solution can be coordinated with standard kubectl, CNI chaining, and Helm chart annotations to propagate security metadata with each deployment. This makes it easy to automatically apply network, runtime, and compliance rules based on context (environment, equipment, criticality, internet exposure, etc.).

Prisma Cloud can also ingest Kubernetes audit logs to detect suspicious events, unexpected role changes, the creation of service accounts with dangerous privileges, or modifications to sensitive objects. All this information is then converted into alerts and dashboards in a single console.

Regarding WAAS (Web Application and API Security) , the module protects web applications and APIs running on Kubernetes or containers against typical OWASP Top 10 attacks (injection, XSS, broken access control, etc.), as well as more advanced exploitation attempts. It can operate in alert-only mode or active blocking mode.

By combining these capabilities with Palo Alto firewalls , organizations can unify visibility and control from the network level to the application load, using the same sources of truth for centralized identities, labels, and policies.

Security status, vulnerabilities and compliance at Prisma Cloud

Like any complex software, Prisma Cloud has had vulnerabilities that Palo Alto Networks has proactively addressed. Past examples include local privilege escalation flaws, cross-site scripting (XSS) in the web console, and incorrect cryptographic verifications, with CVEs such as CVE-2021-3042 and CVE-2021-3033 receiving high CVSS scores.

The company maintains an active vulnerability response program , even assigning its own identifiers (PRISMA) when a public CVE is not yet available. Patches are distributed quickly, especially for the SaaS edition, which is continuously updated without customer intervention.

In terms of encryption and data protection , Prisma Cloud stores log and telemetry metadata in encrypted services such as RDS or Redshift managed in the cloud, complying with best practices for data security in transit and at rest.

Regarding authentication, robust methods such as SAML are supported to integrate Compute Edition with corporate identity providers, facilitating SSO and applying MFA policies or centralized session management.

The platform also helps organizations meet compliance standards by offering predefined checks, exportable reports, dashboards organized by regulation, and the ability to create custom controls. This is crucial in sectors such as finance, healthcare, and public administration.

Technical requirements, support and compatibility

Prisma Cloud's licensing model is based on credits that customers consume according to the modules and workloads they want to protect (Enterprise Edition, Compute Edition, etc.). This allows costs to be tailored to each organization's needs, although it also adds some complexity to sizing and budgeting.

Operating system compatibility is broad : the self-hosted Compute console runs on x86_64 Linux distributions, while Defenders supports a wide variety of Linux hosts on x86_64 and ARM64, Windows containers, and common versions of Docker Engine and container runtimes.

In terms of public clouds, Prisma Cloud covers AWS, Azure, and GCP , as well as providers like Oracle Cloud Infrastructure and Alibaba Cloud. It's designed for multicloud and hybrid environments, with deep APIs for integration with pipelines, external security tools, and DevOps ecosystems.

The SaaS edition is continuously updated , so the classic concept of "end of support" doesn't apply in the same way. The self-hosted Compute Edition does have version lifecycles, aligned with Palo Alto's product policies, which teams should keep in mind when planning upgrades.

Regarding support, user opinions are somewhat mixed : many positively value the breadth of documentation and technical capabilities, while others mention that the support experience can be inconsistent, with response times that could be improved in some cases.

Market vision, alternatives and user perception

Within the CNAPP and container security landscape , Prisma Cloud competes with players such as Wiz, Orca Security, Aqua Security, Sysdig, Microsoft Defender for Cloud, Lacework, Check Point CloudGuard, Trend Micro Cloud One, Qualys, SentinelOne Singularity Cloud Security or SCA/DevSecOps solutions such as Checkmarx One and Veracode.

Prisma Cloud's main strength is its broad coverage : from IaC and CI/CD to runtime, including CSPM, CWP, CIEM, network security, and data security. For organizations looking to reduce the number of tools and dashboards, consolidating everything onto a single platform is often a very compelling argument.

Among the strengths most cited by users are the unified visibility of cloud assets, the ability to automate fixes, the power of its query languages ​​(RQL/KQL) to investigate incidents, and the good integration with cloud providers and third-party technologies.

Among the weaknesses, the learning curve is mentioned most frequently (it's not a trivial tool), along with the feeling that some features are still being developed. Some also find the licensing model somewhat convoluted and point out that the support experience could be more consistent.

Even with these drawbacks, Prisma Cloud is perceived as a strong solution for companies with complex infrastructures, especially those that already work with Palo Alto Networks in other security layers and want to align policies between network, endpoints and cloud workloads.

The evolution of Twistlock within Prisma Cloud has resulted in a very complete platform for protecting containers and cloud-native applications: it controls vulnerabilities from the code, automates CI/CD scans, monitors logs and runtime, integrates natively with Kubernetes and public clouds, and above all adds a layer of context and prioritization that helps teams focus on what is truly critical without being overwhelmed by alerts.