Aqua Security

Aqua Security secures enterprise code, pipelines, containers, Kubernetes and serverless from one cloud native application protection platform, sold by quote.

Aqua Security protects cloud native applications across their whole life, from a commit in a code repository to a container or function running in a public cloud. It is built by Aqua Security Software Ltd., which was founded in 2015, is headquartered in Boston and has no parent company. Development, posture and runtime findings live in one platform, so a security team can follow a single risk from the build to the running workload. The platform comes in two packages. Dev Security covers the software supply chain: code repository discovery and scanning, Infrastructure as Code checks, open source health scoring, CI/CD posture management and automated SBOM generation. Its Dynamic Threat Analysis runs container images in a secure sandbox to detect sophisticated malware. Cloud Security joins Cloud Security Posture Management, Kubernetes posture checks and agentless workload scanning across AWS, Azure, Google Cloud, Oracle and Alibaba Cloud. For runtime it adds eBPF-based detection through the Aqua Enforcer agent, drift prevention, malware blocking and segmentation by service identity. AI-SPM reviews services such as OpenAI and Amazon Bedrock. Aqua is aimed at large organizations that run containers, Kubernetes and serverless functions in production and want supply chain, posture and runtime controls from one vendor. Security engineers work from prioritized risk views and compliance reports, while developers see findings as comments on their pull requests and inside their IDE. Platform teams on OpenShift, Rancher or VMware Tanzu are supported, as are hybrid estates spanning several clouds. The company also serves federal agencies, workloads on IBM Z and teams building generative AI applications. In a DevSecOps pipeline, Aqua scans each image at build time and again in the registry. An image that fails its assurance policy is stopped before it moves on toward production. When a vulnerability appears in a running workload, the platform traces it to the exact line of code where it originated and can open a pull request for the owner. Toxic combination analysis then surfaces the cases where a misconfiguration, an exposed service or an excessive permission meets a live workload. Once a release ships, drift prevention keeps each container as it was built until the next one replaces it.