Originally reported by SiliconAngle. Published March 2020.
Overview
In early 2020, Palo Alto Networks released an update to Prisma Cloud, its cloud-native security platform, with a clear DevSecOps focus. The update introduced capabilities designed to catch vulnerabilities and misconfigurations before they reach production — covering CI/CD pipelines, AWS Lambda workloads, and infrastructure-as-code (IaC) templates.
Prisma Cloud is a consolidated platform built in part through Palo Alto Networks’ acquisition strategy. The company spent more than $1 billion on acquisitions in 2019 alone, integrating technologies from several cloud security startups into a unified offering.
CI/CD Pipeline Policy Enforcement
One of the headline additions in this release is a policy engine for CI/CD pipeline security. Continuous integration and continuous delivery pipelines automate the process of building, testing, and deploying code to production. Without security guardrails, these pipelines can become a fast path for introducing vulnerabilities into live environments.
With the updated Prisma Cloud, administrators can define policies directly from a centralized dashboard to govern what can and cannot pass through CI/CD workflows. Supported compliance frameworks include the CIS (Center for Internet Security) benchmarks, a widely adopted set of security best practices.
“Customers now have the ability to set policies for vulnerability and compliance governing CI and CD workflows directly from the centralized Prisma Cloud dashboard.”
— John Morello, Head of Product for Container and Serverless Security, Palo Alto Networks
This kind of shift-left enforcement means security teams can flag non-compliant builds before code is ever deployed, rather than discovering issues after the fact in a running environment.
Serverless Security for AWS Lambda
The release also introduced dedicated protection for AWS Lambda, Amazon’s serverless computing service. Serverless functions present a distinct security challenge: they are ephemeral, event-driven, and often lack the monitoring instrumentation available on traditional servers or containers.
Palo Alto Networks built this capability on technology acquired through its mid-2019 purchase of PureSec, a startup specializing in serverless security. The approach works in two stages:
- Scanning: The tool analyzes a Lambda function’s configuration to detect misconfigurations and known vulnerabilities.
- Runtime protection: It then wraps the function in a runtime defense layer that blocks exploitation attempts targeting the identified weaknesses — effectively creating a virtual shield around the workload.
This pattern — scan, then protect in place — is particularly valuable for organizations that cannot immediately remediate every finding but still need to reduce exposure in running workloads.
IaC Template and AMI Vulnerability Scanning
The update extended Prisma Cloud’s vulnerability scanning capabilities to cover two additional pre-deployment artifacts:
Infrastructure-as-Code Templates
Infrastructure-as-code templates (such as those written in Terraform, AWS CloudFormation, or similar tools) define cloud environments declaratively. A misconfiguration in a template can be replicated at scale the moment it is applied. Prisma Cloud can now scan these templates for insecure settings before they are used to provision infrastructure, giving teams a chance to fix problems at the source.
Amazon Machine Images (AMIs)
Amazon Machine Images (AMIs) serve a similar templating function on AWS — they are pre-configured VM snapshots used to launch EC2 instances. If an AMI contains a vulnerable OS package or a misconfigured service, every instance launched from it inherits that problem.
“This provides DevOps and security teams with added visibility into the security posture of their AMIs before they’re ever deployed.”
— John Morello, Palo Alto Networks
By scanning AMIs at build time rather than after deployment, teams can prevent vulnerable base images from ever reaching production.
Why This Matters for DevOps Teams
Taken together, these features reflect a broader industry shift toward DevSecOps — embedding security controls directly into the development and deployment pipeline rather than treating security as a post-deployment audit. Key themes from this release:
- Shift left: Catching issues in CI/CD, IaC templates, and AMIs means problems are fixed when they are cheapest to address.
- Centralized governance: A single dashboard for policy management reduces the operational overhead of coordinating between development and security teams.
- Serverless visibility: Extending protection to Lambda workloads closes a gap that many security tools historically ignored.
- Compliance alignment: Built-in support for CIS benchmarks helps teams meet audit requirements without manual mapping.
Organizations running mixed workloads — containers, serverless functions, and traditional VMs — increasingly need a platform that covers all of these surfaces from a single control plane. This Prisma Cloud release was an early step toward that goal.
This article is based on reporting originally published by SiliconAngle in March 2020 and a blog post by John Morello of Palo Alto Networks.