Prowler
Prowler checks cloud accounts, Kubernetes clusters, infrastructure code and SaaS tenants against thousands of security and compliance rules that anyone can read, run for free from the command line, or use through a hosted platform priced per cloud account.
CyberReviewed Editorial Team · Updated · prowler.com
Company details
- Score
- 8.3/10Ranked 3 of 22
- Category
- Cloud security
- Founded
- 2016 as an open-source project; incorporated in 2023
- Headquarters
- Alfacar, Spain, with an office in Maine
- Leadership
- Toni de la Fuente, founder and CEO
- Funding disclosed
- $12.5 million in seed funding, including a $6.5 million extension led by Decibel in 2025
- Pricing
- Open-source edition free; Prowler Cloud $99 per cloud account per month, 20% less with annual billing
- Best fit
- Cloud and DevOps teams that want transparent posture and compliance checks across several clouds
Our take
Prowler is the easiest cloud posture tool in this category to try and to price: the open-source edition is free, and the hosted version costs $99 per cloud account a month. It suits teams that want to see exactly what each check does, though it focuses on configuration and compliance checks and does not detect attacks as they happen, and reviewers say its severity labels need tuning.
Scores by criterion
| Criterion | Score |
|---|---|
| Pricing transparency | 9.2 |
| Product scope and fit | 8.1 |
| Company durability | 6.8 |
| Evidence of adoption | 8.4 |
| Ease of adoption | 8.9 |
| Overall score (average of the five) | 8.3 |
Each criterion is defined on our methodology page.
Checks anyone can read
Prowler runs more than 2,500 checks across AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, OpenStack, Cloudflare and Vercel, along with Kubernetes clusters, infrastructure code such as Terraform and CloudFormation, and SaaS tenants including Microsoft 365, Google Workspace and GitHub.1 The command-line tool, SDK and self-hosted server are open source under the Apache-2.0 license.1 The hosted Prowler Cloud adds scheduled scans, compliance tracking across more than 70 frameworks, attack path graphs, an AI assistant called Lighthouse AI, an automated fixer, Jira and Slack alerts and single sign-on, and a Private Cloud edition runs in a customer's own cloud, data center or air-gapped network.1
Priced per cloud account
Prowler publishes its prices. Prowler Cloud costs $99 per cloud account per month on monthly billing, with 20% off for annual billing, and a cloud account means an AWS account, Google Cloud project, Azure subscription, GitHub repository or Microsoft 365 tenant.1 A seven-day free trial needs no credit card and has no limit on accounts, and the plan can also be bought through AWS Marketplace.1 The open-source edition is free, and the Private Cloud edition is quoted.1
From a weekend script to a company
Toni de la Fuente started Prowler in 2016 as a side project to audit AWS accounts for misconfigurations, and wrote its first 250 checks himself.35 He showed it at Black Hat Arsenal in 2018, kept building it while working at AWS, left in 2021 to work on it full time and incorporated the company in February 2023.5 In April 2025 a $6.5 million extension led by Decibel, with SNR and IrregEx, brought its seed funding to $12.5 million.2 At that point the project had more than 10 million downloads, 10,000 GitHub stars and 300 active contributors, and Prowler said teams at AWS, Salesforce, Tesla, Okta and Red Hat used it.2 It was picked for the Startup Battlefield at TechCrunch Disrupt 2024 and has bases in Alfacar, near Granada, and in Maine.6
How it compares with Orca Security and Upwind
Orca Security scans cloud workloads without agents and folds posture, vulnerabilities and data risks into one commercial platform. Upwind leans on a runtime sensor to show what is running and being attacked. Prowler is narrower and more open: its checks are public code that teams can read, change and extend, and its hosted price is published, which makes it the cheapest of the three to start with. Teams that need runtime detection will get more from the other two.
Limits
Reviewers say some findings are labeled critical when they are not, and that frequent releases add new checks that take time to review. Prowler centers on configuration and compliance checks, so it does not watch workloads for attacks as they happen. The Private Cloud edition is not priced publicly.1
What customers say
Quoted word for word from public reviews on PeerSpot, retrieved October 23, 2026. Each quote links to the review or post it comes from.
Where it helps
The best feature Prowler offers is that it is agentless; we just need to provide IAM roles, and it does not require hardcoded access keys or secret keys.
The real-time scoreboard in Prowler helps us see where we lag and identify practices we aren't implementing, the upgrades we need, and the vulnerabilities present in the infrastructure.
Where it falls short
Some of the findings in Prowler are not that critical but come in the critical category, so that could be improved.
All these new introduced checks sometimes come as a surprise for us because all these configurations might be new and we have to take time to review whether they are applicable to us or not.
Sources
- Prowler, Pricing, accessed October 23, 2026
- PRWeb, Prowler closes $12.5 million seed financing, April 2, 2025
- SiliconANGLE, Prowler raises $12.5M to advance its open-source driven cloud security platform, April 2, 2025
- Prowler, About us, accessed October 23, 2026
- FireTail, Modern Cyber episode 63 with Toni de la Fuente of Prowler
- El Independiente de Granada, La empresa granadina Prowler participará en San Francisco en un evento para startups innovadoras, 2024
