Skip to content
THREATWIRE

Prowler

Cloud security posture and compliance checks

Open-source cloud security platform that runs hundreds of checks against AWS, Azure, Google Cloud, Kubernetes and Microsoft 365, mapped to compliance frameworks.

Open sourceApache-2.0
Alternative toWizPrisma Cloud
Visit website View repository Docs
Homepage of Prowler
Official website (prowler.com), captured by ThreatWire.

What Prowler does

Prowler audits cloud accounts against a large library of security checks and maps the results to frameworks such as CIS, NIST, PCI DSS, ISO 27001 and others. It started as an AWS command-line tool and now covers several providers.

It can run as a CLI or as a self-hosted application with a web interface, API and scheduled scans. Prowler, the company, also offers a hosted version.

Key features

  • Hundreds of checks across major cloud providers
  • Mappings to many compliance frameworks
  • CLI plus self-hosted app with UI and API
  • Custom checks and mutelists
  • CSV, JSON-OCSF and HTML reports

Licence

Apache-2.0 · Apache License 2.0 · Open source

Prowler Open Source is Apache-2.0; the company also runs a commercial hosted service.

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.

Security of Prowler itself

5 published advisories for Prowler in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.

  • GHSA-89q3-592m-8p4rmedium2026-09-30

    Tenant members can revoke privileged provider-deletion jobs without management permission

  • GHSA-c2jg-2778-ggm4CVE-2026-73262medium2026-08-03

    Stored XSS in HTML reports through unescaped cloud resource tags

  • GHSA-ccqh-6cjc-wp4jCVE-2026-73263critical2026-07-29

    RCE on Prowler App workers via kubeconfig auth-provider cmd-path

  • GHSA-fhj4-q47f-w7mvCVE-2026-73264high2026-07-10

    Server-Side Request Forgery (SSRF) in Lighthouse Provider

  • GHSA-h8m9-jgf8-vwvpCVE-2026-59151critical2026-06-22

    SAML Domain Claiming Enables Cross-Tenant Account Takeover

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Cloud and IaC security#cspm#aws#azure#gcp#compliance#security#security-tools#security-audit#security-hardening#hardening

Related tools

  • Checkov

    Static analysis for infrastructure as code

    Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.

    Stars
    9.1k
    Forks
    1.4k
    Last commit
    6 days ago
    Apache-2.0Open sourceCloud and IaC security
    Alternative toPrisma CloudWiz+1

  • ScoutSuite

    Multi-cloud security auditing tool

    NCC Group's multi-cloud auditing tool that collects configuration data through cloud APIs and highlights risk areas in an offline HTML report.

    Stars
    7.9k
    Forks
    1.2k
    Last commit
    2 years ago
    GPL-2.0-onlyOpen sourceCloud and IaC security
    Alternative toWizPrisma Cloud

  • KICS

    Infrastructure-as-code scanner with Rego queries

    Checkmarx's open-source scanner for security issues and misconfigurations in IaC, with queries written in Rego across many platforms.

    Stars
    2.7k
    Forks
    385
    Last commit
    today
    Apache-2.0Open sourceCloud and IaC security
    Alternative toWizPrisma Cloud

  • Trivy

    All-in-one scanner for images, code, IaC and clusters

    Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.

    Stars
    39k
    Forks
    776
    Last commit
    today
    Apache-2.0Open sourceContainer and Kubernetes security
    Alternative toSnykPrisma Cloud+1

  • Kubescape

    Kubernetes security posture and compliance scanner

    CNCF project that scans clusters, manifests and Helm charts against frameworks such as the NSA-CISA guidance and CIS Benchmarks, and scans images.

    Stars
    12k
    Forks
    1.1k
    Last commit
    today
    Apache-2.0Open sourceContainer and Kubernetes security
    Alternative toWizPrisma Cloud

  • Nuclei

    Template-based vulnerability scanner

    Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.

    Stars
    32k
    Forks
    4k
    Last commit
    today
    MITOpen sourceVulnerability scanning
    Alternative toTenable NessusQualys VMDR+1
Share on X@threatwire_https://www.threatwire.tech/tools/prowler