Enterprise Cloud Security: Discovery, Evidence & Migration Intelligence

A decision platform that gives executives one trusted view of cloud coverage, migration readiness, operational risk, and evidence across AWS, Azure, GCP, Kubernetes, Prisma Cloud, Cortex, and Wiz.

Working DemoPrisma Cloud SDKWiz GraphQLCoverage DeltaDefender ReplacementExecutive ReportingReviewed ArchitectureMigration GatesEvidence Trust

Executive command view

One platform. One evidence model. One controlled migration path.

The platform converts fragmented cloud-security telemetry into an enterprise asset graph, measurable coverage decisions, migration gates, and board-ready reporting.

Cloud scopeMulti-cloud

AWS, Azure, GCP, Kubernetes, registries, pipelines, runtime, and security platforms.

Decision modelEvidence-led

Every recommendation traces to source, timestamp, tenant, freshness, confidence, and owner.

Migration postureGate-based

No control is retired until equivalent coverage, parallel validation, approval, and rollback are proven.

Business outcomeLower risk

Reduced blind spots, faster onboarding, measurable engineering work, and defensible reporting.

Executive decision framework

Discovery and normalized evidence foundationValidated demo

Coverage, correlation, and migration intelligencePlatform roadmap

Runtime replacement by workload typeApproval gated

Enterprise deployment, tenancy, SLOs, and DRProduction hardening

Readiness principle

78%

Illustrative readiness

Readiness is calculated from discovery, identity, runtime parity, policy translation, observation, and rollback evidence.

Production thresholds remain configurable.

Executive rule: distinguish implemented, demo-validated, planned, and vendor-confirmation-dependent capabilities in every report and roadmap.

Architecture Assurance & Key Decisions

This reviewed edition keeps the original platform vision while separating verified capabilities, planned capabilities, and migration assumptions. It also adds the operational controls required for a production enterprise platform.

Corrected HTMLUnique section IDs, regenerated navigation, valid code classes, removed Markdown artifacts, and eliminated draft-conversation text.

Clarified Migration LanguagePrisma Defender retirement is now gated by workload-specific equivalent coverage and evidence; a cloud connector alone must not be treated as runtime replacement.

Added Production ControlsData provenance, freshness, tenancy isolation, secrets handling, idempotency, reconciliation, approval gates, rollback evidence, and API-contract testing.

Added Reporting GapsConfidence scores, unknown coverage, stale evidence, unsupported mappings, collection/scope parity, exceptions, suppressions, ownership, and cost/licensing assumptions.

Critical architecture rule: label every feature as Implemented, Validated in demo, Planned, or Requires vendor/API confirmation. This prevents the roadmap from being mistaken for delivered functionality.

Executive Decision Graphics

These graphics focus on coverage confidence, migration gates, and evidence trust—the areas most likely to cause an unsafe or incomplete migration.

Coverage and Replacement Decision Matrix

Asset / Control

Prisma Evidence

Target Evidence

Parity

Action

Cloud account posture

Current

Equivalent

Ready for validation

Kubernetes runtime

Defender healthy

Coverage unverified

Unknown

Parallel validation

Host runtime

Protected

Missing

No parity

Do not retire Defender

Policy scope / collections

Mapped

Partial mapping

Partial

Engineering review

Exceptions / suppressions

Exported

Not imported

Incomplete

Translate and approve

Evidence freshness

2 hours old

15 minutes old

Mixed

Re-run before cutover

Migration Gate Scorecard

Discovery completeness

Required: 100%

Identity & permissions

No critical gaps

Runtime parity

Per workload

Policy translation

Exceptions included

Parallel observation

Time-bound window

Rollback evidence

Mandatory

Percentages are illustrative. Production gates must be configurable and traceable to evidence, approver, timestamp, tenant, and migration wave.

Production Readiness Requirements

Data contractsVersioned normalized schemas, connector capability manifests, backward compatibility, nullable/unknown semantics, and vendor-field lineage.

Collection reliabilityPagination, checkpointing, incremental sync, idempotency, retry budgets, rate-limit telemetry, dead-letter queues, and partial-run status.

Evidence integritySHA-256 hashes, source timestamps, collection timestamps, tenant IDs, correlation confidence, retention policy, encryption, and tamper-evident manifests.

Migration safetyWave planning, freeze windows, approval separation, success criteria, parallel observation, blast-radius limits, rollback triggers, and post-cutover monitoring.

Security & tenancyLeast privilege, secret rotation, tenant-scoped encryption keys, row-level isolation, audit trails, data residency, and export controls.

OperationsSLOs, health probes, queue depth, connector lag, freshness objectives, backup/restore, disaster recovery, capacity planning, and runbooks.

Reporting semanticsDenominators, excluded assets, stale/unknown data, confidence intervals, exception ownership, accepted risk, and historical trend snapshots.

TestingRecorded API fixtures, contract tests, schema-drift tests, synthetic tenants, scale tests, migration simulations, rollback tests, and security tests.

Important Terminology Correction

A Prisma Defender is a workload/runtime security agent. A target-platform cloud connector generally establishes cloud inventory or configuration access and must not automatically be treated as an equivalent runtime control. The replacement engine must compare capabilities by workload type—Kubernetes, host, container, serverless, embedded application, and agentless coverage—and only authorize retirement when the target control is deployed, healthy, observed in parallel, and meets defined parity criteria.

Reporting Fields Still Required

report_run_id
snapshot_id
tenant_id
source_platform
source_api_version
source_object_id
source_timestamp
collected_at
normalized_schema_version
evidence_hash
freshness_seconds
correlation_confidence
coverage_state: protected | partial | unprotected | unknown | stale
mapping_status: exact | close | partial | unsupported | not_evaluated
exception_id / exception_expiry
owner / approver
migration_wave
rollback_reference
licensing_assumption
cost_assumption

Vendor Validation & Evidence Notes

Prisma Cloud’s official API documentation confirms that Defenders are security agents, provides endpoints for deployed Defender inventory and summary, and exposes connected/deployed/licensed counts by category. The platform design should consume those fields directly rather than infer health from a single status field.

Prisma Cloud’s Cloud Security APIs require appropriate roles and short-lived authorization tokens, so the connector framework must support token renewal, permission diagnostics, and clear partial-coverage reporting. Some posture data is snapshot-based and can lag, making evidence freshness an explicit reporting requirement.

https://pan.dev/prisma-cloud/api/cwpp/get-defenders/
https://pan.dev/prisma-cloud/api/cwpp/get-defenders-summary/
https://pan.dev/prisma-cloud/docs/cwpp/deploy-defenders/
https://pan.dev/prisma-cloud/api/cspm/
https://pan.dev/prisma-cloud/api/cspm/get-resource-scan-info/

Platform Architecture & Control Flows

These diagrams summarize the architecture and workflows described throughout the document.

Integrated Enterprise Cloud Discovery Engine

The platform now includes a dedicated, read-only multi-cloud discovery worker named Enterprise Cloud Discovery Engine. This component is integrated as the provider-native collection layer and is intentionally separated from vendor security connectors and migration execution.

Exact Repository Placement

enterprise-cloud-security-platform/
  src/
    discovery/
      cloud_engine/
        EnterpriseCloudDiscovery/
        tests/
        setup.py
        requirements.txt
    connectors/
      prisma/
      cortex/
      wiz/
    normalize/
    correlate/
    validation/
    reporting/
    evidence/

New Names

Component: Enterprise Cloud Discovery Engine
Python package: EnterpriseCloudDiscovery
Distribution: enterprise-cloud-discovery-engine
CLI: enterprise-cloud-discovery
Platform command: enterprise-cloud discover
Evidence source key: enterprise-cloud-discovery-engine

Supported Provider Discovery

AWS
Microsoft Azure
Google Cloud
Kubernetes
Oracle Cloud Infrastructure
DigitalOcean
Alibaba Cloud

Strict Responsibility Boundary

Discovery Engine Owns

Provider authentication and API enumeration
Account, subscription, project, region and cluster discovery
Native inventory and configuration collection
Read-only checks
Native snapshots, source timestamps and checksums
Collection-gap and permission-denied evidence

Platform Core Owns

Tenant isolation and scheduling
Central secret retrieval and short-lived credentials
Canonical asset normalization
Correlation with Prisma, Cortex, Wiz, repositories, registries, CI/CD and ownership data
Coverage delta, onboarding validation and migration readiness
Dashboards, exports, evidence retention and governance

Discovery Job Contract

{
  "job_id": "disc-20260712-0001",
  "tenant_id": "tenant-001",
  "provider": "aws",
  "credential_ref": "vault://tenants/tenant-001/aws/audit-role",
  "scope": {
    "accounts": ["123456789012"],
    "regions": ["us-east-1"]
  },
  "services": ["iam", "ec2", "s3", "eks", "cloudtrail", "config"],
  "mode": "full",
  "output_uri": "object://evidence/tenant-001/disc-20260712-0001/"
}

Normalized Evidence Contract

{
  "schema_version": "1.0",
  "tenant_id": "tenant-001",
  "source": "enterprise-cloud-discovery-engine",
  "provider": "aws",
  "resource_type": "ec2_instance",
  "source_id": "i-0123456789abcdef0",
  "account_id": "123456789012",
  "region": "us-east-1",
  "observed_at": "2026-07-12T14:00:00+00:00",
  "payload_sha256": "...",
  "payload": {}
}

Failure Semantics

Authentication failure: fail the job and calculate no coverage conclusion.
Single-service failure: retain successful results and mark the snapshot partial.
Permission denied: emit a collection gap, never a false pass.
Rate limiting: checkpoint and retry with bounded exponential backoff and jitter.
Empty result: distinguish confirmed-empty from not-collected.
Stale snapshot: exclude it from migration approval calculations.

Required Production Refactoring

Replace direct report filesystem dependencies with an EvidenceSink interface.
Move authentication behind a platform CredentialProvider.
Add tenant ID, job ID and correlation ID to every log and metric.
Add per-provider/account/region/service incremental checkpoints.
Add bounded concurrency, rate-limit budgets and dead-letter processing.
Add PostgreSQL and encrypted object-storage sinks for production scale.
Add canonical adapters under normalize/providers/.
Add API fixture contract tests, schema-drift tests and partial-failure tests.
Create signed releases and an SBOM for every worker image.

Migration Integration Rule

Discovery output is evidence, not authorization to migrate. The migration service may only create a cutover plan when the snapshot is complete enough for the selected scope, freshness objectives are satisfied, vendor coverage is correlated, unknown assets are below the approved threshold, and rollback evidence has been generated.

README Part 1

Enterprise Cloud Security Discovery, Reporting & Migration Platform

1. Executive Summary
2. Product Vision
3. Why This Framework Matters
4. Business Justification
5. Product Goals
6. Enterprise Architecture
7. High Level Components
8. Working Demo
9. Existing Modules
10. Repository Layout
11. Core Framework
12. Enterprise Discovery Engine

Enterprise Cloud Security Discovery, Reporting & Migration Platform

Working Demo → Enterprise Product

Executive Summary

Organizations today invest significant engineering effort deploying cloud security platforms such as Prisma Cloud, Cortex Cloud, and Wiz. While these products provide excellent security capabilities, enterprise customers continue to face several operational challenges:

Cloud onboarding is largely manual.
Runtime validation requires custom scripts.
Executive reporting is fragmented.
Asset inventories differ between products.
Migration between vendors is expensive.
Engineering teams spend weeks validating deployments.
Security teams rely on spreadsheets for migration planning.

The purpose of this project is not to replace Wiz or Prisma Cloud.

Instead, it introduces a vendor-neutral Enterprise Discovery, Reporting, Validation, and Migration Platform that sits above both products and automates the operational work surrounding cloud security deployments.

The platform leverages APIs, SDKs, and cloud-native services to discover enterprise assets, validate onboarding, normalize security data, correlate assets across platforms, produce executive dashboards, and automate migration planning.

Product Vision

The framework is designed around six core principles:

1. Vendor Neutral

Support multiple platforms without locking customers into one product.

Supported platforms include:

Prisma Cloud
Cortex Cloud
Wiz
AWS
Azure
Google Cloud
GitHub
GitLab
Azure DevOps
Bitbucket
Artifactory
JFrog Xray
Jenkins
Harness
ServiceNow
Jira

2. Discovery First

Everything begins with discovery.

Before onboarding or migration, the platform automatically inventories:

Cloud accounts
Kubernetes clusters
Hosts
Containers
Images
Registries
Repositories
Pipelines
Runtime protection
IAM permissions
Cloud services
Security controls

Discovery is read-only and does not modify customer environments.

3. Normalize Everything

Each platform exposes different APIs and data models.

The framework converts them into a single normalized inventory.

Example:

AWS Account
↓

Cluster

↓

Namespace

↓

Deployment

↓

Pod

↓

Container

↓

Image

↓

Registry

↓

Repository

↓

Pipeline

↓

Owner

↓

Business Unit

This unified model allows the platform to correlate information regardless of the original security product.

4. Correlate Enterprise Assets

After normalization, assets are correlated across multiple systems.

Example relationships include:

AWS Account

↓

EKS Cluster

↓

Namespace

↓

Deployment

↓

Pod

↓

Container

↓

Image Digest

↓

Registry

↓

Git Commit

↓

Repository

↓

Pipeline

↓

SBOM

↓

Runtime Alert

↓

Owner

↓

Business Unit

↓

Jira Ticket

↓

ServiceNow Incident

This creates a complete enterprise security graph.

5. Validate Before Migrating

Rather than immediately migrating security controls, the platform validates:

Cloud onboarding
IAM permissions
Runtime coverage
Inventory freshness
Connector health
Policy availability
Compliance coverage
Runtime protection

Migration only proceeds after validation succeeds.

6. Enterprise Reporting

Every discovery cycle generates:

Executive dashboards
Engineering dashboards
Migration readiness
Runtime coverage
Compliance reports
Inventory reports
API health reports
Business case reports

Why This Framework Matters

Enterprise customers frequently encounter operational gaps that are not directly addressed by native product interfaces.

Typical examples include:

Determining whether every AWS account has been successfully onboarded.
Verifying runtime protection across hundreds of Kubernetes clusters.
Identifying stale cloud connectors.
Comparing Prisma and Wiz coverage during migration.
Producing executive-ready migration reports.
Estimating engineering effort and implementation timelines.

This framework automates those tasks and provides a consistent reporting layer across multiple cloud security platforms.

Business Justification

The framework reduces:

Manual onboarding effort
Migration risk
Engineering hours
Reporting complexity
Operational overhead

It increases:

Automation
Deployment quality
Runtime visibility
Executive visibility
Security governance
Migration confidence

Working Demo

The current implementation already demonstrates several core capabilities.

Working modules include:

AWS Onboarding Discovery

AWS account discovery
Cloud onboarding validation
Runtime inventory
SQLite reporting

Image Vulnerability Reporting

Container image discovery
Vulnerability reporting
Dashboard generation

Host Vulnerability Reporting

Host inventory
Vulnerability analysis
SQLite evidence

Runtime Discovery

Kubernetes inventory
Defender validation
Runtime coverage

Dashboard Generation

HTML reports
SQLite dashboards
Executive summaries

These working scripts become the initial production modules.

Repository Philosophy

The project evolves from a collection of standalone scripts into an enterprise platform.

Instead of creating isolated utilities, every component becomes a reusable module.

Design principles include:

Modular architecture
Plugin-based connectors
Shared API framework
Normalized data model
Central evidence repository
Independent reporting engine
Vendor-neutral abstraction layer

High-Level Architecture

                    Enterprise

                         │
                         ▼

              Enterprise Discovery Engine
                         │
                         ▼

               Asset Normalization Engine
                         │
                         ▼

             SQLite Evidence Repository
                         │
                         ▼

               Correlation Engine
                         │
                         ▼

            Coverage Delta Engine
                         │
                         ▼

         Onboarding Validation Engine
                         │
                         ▼

         Migration Intelligence Engine
                         │
                         ▼

          Runtime Planning Engine
                         │
                         ▼

         Business Case Generator
                         │
                         ▼

           Migration Execution
                         │
                         ▼

      Continuous Drift Detection
                         │
                         ▼

       Executive & Engineering Reporting

Repository Layout

src/

    core/

    connectors/

    discovery/

    normalize/

    correlate/

    analysis/

    migration/

    validation/

    reporting/

    sqlite/

    evidence/

    cli/

Core Framework

Every module shares common services:

Configuration management
Authentication
HTTP client
Retry engine
Rate limiting
Logging
Metrics
SQLite persistence
Report generation
Plugin loading

No connector should implement these independently.

Enterprise Discovery Engine

The Discovery Engine is the foundation of the platform.

Its responsibilities are to:

Discover enterprise assets
Validate connectivity
Inventory cloud resources
Detect runtime coverage
Identify onboarding gaps
Normalize discovered objects
Store evidence
Trigger downstream analysis

Every subsequent component—including reporting, migration, validation, and policy translation—depends on this normalized discovery layer.

README Part 2

Repository Architecture, Enterprise Discovery & Platform Connectors

Repository Philosophy

The framework is not a collection of scripts.

It is a modular enterprise platform where every capability can operate independently or as part of a larger workflow.

Enterprise
    │
    ▼
Shared Core Framework
    │
    ├──────────────┬─────────────┬───────────────┐
    ▼              ▼             ▼               ▼
Discovery      Connectors    Reporting      Migration

Every module communicates through normalized objects rather than vendor-specific APIs.

Complete Repository Structure

enterprise-security-platform/

README.md
LICENSE
CHANGELOG.md

requirements.txt
pyproject.toml

/docker
/docs
/examples
/tests
/scripts

src/

    core/

        config.py
        constants.py
        settings.py
        logger.py
        metrics.py
        cache.py
        retry.py
        auth.py
        api_client.py
        async_client.py
        exceptions.py
        models.py
        scheduler.py
        plugin_loader.py

------------------------------------------------

    connectors/

        prisma/

            sdk/
            compute/
            cspm/
            runtime/
            appsec/

        cortex/

            cloud/
            xsiam/
            xdr/
            appsec/

        wiz/

            graphql/
            runtime/
            connectors/
            inventory/
            reports/

        aws/
        azure/
        gcp/

        github/
        gitlab/
        bitbucket/

        artifactory/
        harbor/
        nexus/

------------------------------------------------

    discovery/

        cloud_engine/

            EnterpriseCloudDiscovery/

        enterprise/

        aws/
        azure/
        gcp/

        kubernetes/

        runtime/

        repositories/

        registries/

        cicd/

        identity/

------------------------------------------------

    normalize/

------------------------------------------------

    correlate/

------------------------------------------------

    sqlite/

------------------------------------------------

    evidence/

------------------------------------------------

    analysis/

        onboarding_validation/

        coverage_delta/

        migration_analysis/

        runtime_analysis/

        policy_translation/

        business_case/

        drift_detection/

        api_health/

        roi/

------------------------------------------------

    migration/

------------------------------------------------

    validation/

------------------------------------------------

    reporting/

------------------------------------------------

    api/

------------------------------------------------

    cli/

Shared Core Framework

Every connector shares one implementation.

Authentication

↓

Retry Engine

↓

Rate Limiter

↓

HTTP Client

↓

Caching

↓

Logging

↓

SQLite

↓

Evidence Archive

No duplicate HTTP clients should exist.

Connector Layer

The connector layer is responsible for communicating with vendor APIs.

The rest of the framework never directly calls vendor APIs.

Framework

↓

Connector

↓

Normalize

↓

SQLite

↓

Correlation

↓

Reporting

Prisma Cloud Connector

Instead of creating another Prisma API library, reuse the existing SDK.

SDK

↓

Discovery

↓

Normalization

↓

SQLite

↓

Reporting

Current SDK coverage

Compute

Defenders
Collections
Hosts
Containers
Images
Registry
Runtime
Compliance
Policies
Vulnerabilities
Scans
Serverless
Logs

CSPM

Cloud Accounts
Account Groups
Compliance
Alerts
Policies
Rules
Suppressions
RQL
Assets

AppSec

Code Security
Repositories
Findings
Secrets
IaC
Packages
APIs

Wiz Connector

The Wiz connector should use GraphQL as the primary interface.

GraphQL

↓

Projects

↓

Cloud Accounts

↓

Inventory

↓

Issues

↓

Cloud Configuration

↓

Runtime

↓

Attack Paths

↓

Reports

Additional integrations

REST API
Audit Logs
EventBridge
SNS
SQS
Export Jobs

Enterprise Discovery Engine

Everything begins with discovery.

Enterprise

↓

Cloud Providers

↓

Runtime

↓

Repositories

↓

Registries

↓

Identity

↓

Normalize

↓

Store

AWS Discovery

Discover

Organizations

Management Account
Organizational Units
Member Accounts

Cloud Services

CloudTrail
AWS Config
GuardDuty
Inspector
Security Hub
EventBridge
IAM
KMS

Compute

EC2
Lambda
ECS
EKS
Auto Scaling
ELB

Storage

Containers

Networking

VPC
Subnets
Security Groups
Route Tables
Transit Gateway
Internet Gateway

Identity

IAM Users
IAM Roles
Policies
Trust Relationships

Validation

Automatically verify

CloudTrail enabled
Config enabled
GuardDuty enabled
Inspector enabled
Security Hub enabled
Required IAM permissions
Required Regions
Connector Health

Azure Discovery

Discover

Tenants
Management Groups
Subscriptions
Resource Groups
VNets
NSGs
AKS
Defender
Key Vault
Storage
Identity
Policies

Validation

Defender Enabled
Security Center
Subscription Health
RBAC
Resource Graph

Google Cloud Discovery

Discover

Organizations
Folders
Projects
VPC
GKE
Artifact Registry
Cloud Run
Compute Engine
IAM
Cloud Logging
SCC

Validation

APIs Enabled
Security Command Center
Organization Policies
Runtime Coverage

Kubernetes Discovery

Discover

Cluster

Version
Distribution
Cloud Provider

Nodes

OS
Runtime
Kernel

Workloads

Deployments
StatefulSets
DaemonSets
Jobs
CronJobs

Runtime

Pods
Containers
Images
Digests

Security

RBAC
Network Policies
OPA
Kyverno
Admission Controllers
Pod Security

Runtime Protection

Prisma Defender
Wiz Runtime
Runtime Policies
Heartbeats

Repository Discovery

Supported

GitHub
GitLab
Azure DevOps
Bitbucket

Discover

Organizations
Teams
Repositories
Branches
CODEOWNERS
Branch Protection
GitHub Actions
Secrets Metadata
Releases

Repository Analysis

Terraform
Helm
Kubernetes YAML
Dockerfiles
API Specifications
Python
Go
Java
.NET
Node.js

Automatically recommend:

Wiz CLI
Cortex CLI
Trivy
Grype
Syft

Registry Discovery

Supported

Amazon ECR
Azure ACR
Google Artifact Registry
DockerHub
Artifactory
Harbor
Nexus

Discover

Images
Digests
Tags
SBOMs
Signatures
Vulnerabilities
Last Scan
Owners

CI/CD Discovery

Supported

Jenkins
GitHub Actions
GitLab CI
Azure DevOps
Harness

Discover

Pipelines
Secrets
Runners
Build History
Deployments
Artifacts

Identity Discovery

Supported

AWS IAM
Azure AD
Entra ID
Google IAM
Okta

Discover

Users
Groups
Roles
Federated Identity
Service Accounts
Trust Relationships

SQLite Evidence Database

Every discovered object is normalized before storage.

Core tables include:

organizations
cloud_accounts
regions
clusters
nodes
namespaces
pods
containers
images
registries
repositories
pipelines
runtime
defenders
wiz_connectors
policies
controls
alerts
findings
owners
tickets
migration_jobs
validation_results
snapshots
raw_api_archive

Every record stores:

UUID
Source Platform
Source Object ID
Parent UUID
Owner
Business Unit
Tags
Metadata
First Seen
Last Seen
Risk Score
Validation Status
Migration Status

Evidence Repository

Every API response is archived.

API Response

↓

Normalization

↓

SQLite

↓

Raw JSON Archive

↓

Evidence Bundle

↓

Executive Report

This allows:

auditability
reproducibility
offline reporting
migration validation
compliance evidence

README Part 3

Intelligence Engine, Coverage Analysis & Migration Planning

13. Cross Platform Correlation Engine
14. Coverage Delta Engine
15. Onboarding Validation Engine
16. Runtime Planning Engine
17. Defender Replacement Engine
18. Migration Intelligence Engine
19. Policy Translation Engine
20. Compatibility Engine
21. Engineering Work Queue
22. Business Case Generator
23. Continuous Drift Detection
24. API Health Monitoring
25. Recommendation Engine

Enterprise Intelligence Layer

The Discovery Engine inventories enterprise assets.

The Intelligence Layer transforms inventory into actionable engineering work.

Discovery

↓

Normalization

↓

Correlation

↓

Coverage Analysis

↓

Gap Analysis

↓

Migration Planning

↓

Engineering Tasks

↓

Executive Reports

Unlike vendor dashboards, this layer answers operational questions rather than simply displaying security findings.

Cross Platform Correlation Engine

The Correlation Engine is the heart of the platform.

It builds one enterprise graph from multiple systems.

AWS Account

↓

AWS Organization

↓

Region

↓

VPC

↓

Cluster

↓

Namespace

↓

Deployment

↓

Pod

↓

Container

↓

Image Digest

↓

Registry

↓

Repository

↓

Commit

↓

Pipeline

↓

SBOM

↓

CVE

↓

Runtime Alert

↓

Policy

↓

Owner

↓

Business Unit

↓

Jira

↓

ServiceNow

This relationship graph allows every report to answer questions that individual products cannot.

Enterprise Asset Graph

Each object maintains relationships.

Cloud Account

↓

Cluster

↓

Namespace

↓

Pod

↓

Container

↓

Image

↓

Registry

↓

Repository

↓

Developer

↓

Team

↓

Business Unit

Everything becomes searchable.

Coverage Delta Engine

This is one of the primary differentiators.

Instead of reporting one platform, compare both simultaneously.

Prisma

+

Wiz

+

AWS

+

Kubernetes

↓

Coverage Delta

Coverage Categories

Protected by Prisma

Protected by Wiz

Protected by Both

Not Protected

Unknown

Manual Validation

Example Report

AWS Accounts

148

Protected by Prisma

142

Protected by Wiz

117

Protected by Both

113

Migration Ready

109

Need Runtime

21

Missing Protection

6

Cluster Coverage

Cluster

Production-EKS

Prisma Runtime

Healthy

Wiz Runtime

Missing

Recommendation

Deploy Wiz Runtime

Priority

High

Runtime Coverage Analysis

Every runtime workload is analyzed.

Cluster

↓

Namespace

↓

Deployment

↓

Container

↓

Runtime

↓

Defender

↓

Runtime Policy

↓

Coverage

Metrics

Runtime %

Container %

Cluster %

Policy %

Defender %

Defender Replacement Engine

Instead of simply listing Defenders, determine whether they can be retired.

Workflow

Existing Defender

↓

Heartbeat

↓

Runtime Policies

↓

Collections

↓

Equivalent Wiz Runtime

↓

Parallel Validation

↓

Production Validation

↓

Remove Defender

Replacement Categories

Keep Defender

Replace with Wiz Runtime

Deploy Wiz Connector

Deploy Wiz Sensor

Manual Review

Unsupported

Example

Cluster

payments-prod

Prisma Defender

Healthy

Collections

15

Runtime Policies

18

Equivalent Wiz Coverage

98%

Recommendation

Deploy Wiz Runtime

Parallel Validation

Remove Defender

Runtime Planner

Migration order matters.

The planner determines deployment order.

Cloud

↓

Cluster

↓

Runtime

↓

Connector

↓

Policy

↓

Validation

↓

Migration

↓

Cutover

Onboarding Validation Engine

This engine verifies that onboarding is production ready.

Checks

AWS

CloudTrail
Config
GuardDuty
Inspector
Security Hub
IAM
Organizations
Regions

Prisma

Account Groups
Collections
Runtime
Defenders
Policies
Compliance

Wiz

Connectors
Projects
Runtime
Inventory
Cloud Config
Integrations

Validation Result

AWS Account

123456789012

CloudTrail

PASS

Config

FAIL

Inspector

PASS

GuardDuty

PASS

Runtime

FAIL

Recommendation

Not Production Ready

Migration Readiness Engine

Every discovered object receives a readiness score.

Discovery

↓

Validation

↓

Coverage

↓

Compatibility

↓

Engineering Work

↓

Migration Ready

Readiness Score

Cloud Discovery

100%

Runtime

81%

Policies

92%

Repositories

96%

Images

95%

Connector Health

100%

Migration Readiness

93%

Policy Translation Engine

Translate vendor-specific policies into normalized objects.

Prisma Policy

↓

Normalized JSON

↓

Compatibility Engine

↓

Equivalent Wiz Policy

↓

Validation

↓

Migration

Translation Status

Exact Match

Close Match

Partial Match

Manual Review

Unsupported

Policy Mapping

Preserve

Severity

Description

Scope

Cloud Accounts

Projects

Compatibility Engine

Determine whether migration can be automated.

Migration Intelligence Engine

Migration workflow

Discover

↓

Normalize

↓

Correlate

↓

Compatibility

↓

Engineering Plan

↓

Dry Run

↓

Approval

↓

Migration

↓

Validation

↓

Cutover

↓

Drift Monitoring

Dry Run Engine

No production changes.

Produces

Migration Report

Compatibility Matrix

Risk Assessment

Rollback Plan

Engineering Estimate

Rollback Planning

Every migration stores

Original State

↓

Migration Plan

↓

Validation

↓

Rollback Steps

↓

Evidence

Engineering Work Queue

Automatically create engineering tasks.

Deploy Wiz Runtime

18 Clusters

Deploy Connector

5 AWS Accounts

Enable Config

7 Accounts

Install Runtime

3 Clusters

Remove Defender

11 Clusters

Validate Runtime

18 Clusters

Export

Jira

ServiceNow

Azure DevOps

CSV

Recommendation Engine

Every discovered object receives recommendations.

Example

Repository

payments-api

Terraform

Detected

Dockerfile

Detected

Recommended

Run Wiz CLI

Generate SBOM

Run Trivy

Store Results

Business Case Generator

Produce executive metrics.

Calculate

Engineering Hours

Automation %

Migration Timeline

Professional Services

Infrastructure

Operational Savings

ROI

Example

Current Manual Work

920 Hours

Automation

710 Hours

Engineering Saved

210 Hours

Estimated Savings

$84,000

Executive Migration Scorecard

Cloud Accounts

148

Clusters

67

Repositories

2,184

Registries

26

Protected

91%

Migration Ready

84%

Remaining Tasks

43

Automation

88%

Estimated Completion

19 Days

Continuous Drift Detection

Continuously monitor the environment.

Detect

Connector Failure

Runtime Failure

Policy Drift

Permission Drift

Coverage Drift

Inventory Drift

Defender Offline

Wiz Connector Offline

New AWS Accounts

New Kubernetes Clusters

New Registries

Missing Runtime

API Health Monitoring

Track every connector.

Platform

API Calls

Latency

Retries

Errors

Rate Limits

Availability

Last Success

Evidence Preservation

Every recommendation links back to evidence.

API Response

↓

Normalized Object

↓

SQLite

↓

Evidence Archive

↓

Migration Report

↓

Executive Dashboard

Nothing is generated without traceable evidence.

README Part 4

Enterprise Dashboards, APIs, Deployment, Security, Roadmap & Future Vision

26. Executive Dashboard
27. Engineering Dashboard
28. Compliance Dashboard
29. Migration Dashboard
30. Runtime Dashboard
31. REST API
32. CLI
33. Plugin SDK
34. Reporting Framework
35. SQLite Schema
36. Security Model
37. Deployment Architecture
38. CI/CD Integration
39. Testing Strategy
40. Multi-Tenant Architecture
41. AI Security Discovery
42. MCP Discovery
43. Future Modules
44. Complete Development Roadmap
45. Enterprise Vision

Executive Dashboard

Executives should never need to understand vendor-specific terminology.

The dashboard focuses on business outcomes.

Executive KPIs

Cloud Accounts

Azure Subscriptions

GCP Projects

Kubernetes Clusters

Repositories

Container Images

Registries

Runtime Coverage

Compliance Score

Migration Readiness

Engineering Hours Saved

Automation %

Estimated Cost Savings

ROI

Remaining Migration Tasks

Executive Home Page

Enterprise Overview

Cloud Accounts
148

Clusters
71

Repositories
2,415

Images
37,812

Protected Assets
93%

Migration Ready
88%

Engineering Tasks Remaining
37

Estimated Completion
14 Days

Estimated Savings
$215,000

Engineering Dashboard

Engineering needs operational visibility.

Displays

Connector Health

Runtime Coverage

Defender Status

Wiz Runtime

Inventory Age

API Errors

Policy Drift

Permission Drift

Migration Queue

Failed Validation

Runtime Dashboard

Cloud

↓

Cluster

↓

Namespace

↓

Deployment

↓

Container

↓

Runtime

↓

Policy

↓

Coverage

↓

Alerts

Shows

Defender heartbeat
Wiz runtime health
Runtime policy coverage
Runtime alerts
Container inventory
Vulnerabilities
Runtime drift

Migration Dashboard

Displays migration progress.

Discovery

↓

Validation

↓

Compatibility

↓

Dry Run

↓

Approval

↓

Migration

↓

Validation

↓

Defender Removal

↓

Complete

Progress tracked by:

Account
Cluster
Repository
Registry
Policy
Runtime

Compliance Dashboard

Supported frameworks

CIS
NIST
PCI DSS
SOC2
HIPAA
ISO 27001

Displays

Framework

Controls

Passed

Failed

Exceptions

Evidence

Owner

REST API

Every module exposes REST endpoints.

/api/v1/discovery

/api/v1/runtime

/api/v1/reporting

/api/v1/migration

/api/v1/validation

/api/v1/evidence

/api/v1/connectors

/api/v1/dashboard

/api/v1/health

GraphQL API

Expose normalized enterprise inventory.

Example

query {

    clusters {

        name

        runtime

        owner

        migrationStatus

        coverage

    }

}

CLI

enterprise discover

enterprise inventory

enterprise runtime

enterprise report

enterprise validate

enterprise coverage

enterprise migrate

enterprise rollback

enterprise dashboard

enterprise drift

enterprise health

Plugin SDK

New vendors should require minimal code.

class Connector:

    discover()

    normalize()

    validate()

    report()

    migrate()

Examples

Prisma
Wiz
Azure
AWS
GitHub
Artifactory

Reporting Framework

Supported outputs

HTML

Markdown

PDF

Excel

JSON

CSV

PowerPoint

Executive Summary

Engineering Report

Compliance Package

Migration Package

Evidence Bundle

SQLite Evidence Schema

Core tables

organizations

cloud_accounts

regions

clusters

nodes

namespaces

deployments

pods

containers

images

registries

repositories

pipelines

sboms

findings

policies

controls

runtime

defenders

wiz_connectors

owners

business_units

tickets

migration_jobs

migration_objects

validation_results

compatibility_results

raw_api_archive

report_history

snapshots

api_logs

Each object stores

UUID

Platform

Source ID

Parent

Owner

Business Unit

Tags

Metadata

Risk Score

Validation Status

Migration Status

First Seen

Last Seen

Checksum

Security Model

Authentication

OAuth2
API Keys
AWS IAM
Azure Entra ID
Google IAM

Authorization

RBAC
Team Based
Business Unit
Project Based

Secrets

HashiCorp Vault
AWS Secrets Manager
Azure Key Vault
GCP Secret Manager

Audit

Every API request

Every migration

Every report

Every policy change

Every validation

Deployment

Supported

Docker

Docker Compose

Kubernetes

Helm

AWS ECS

Azure Container Apps

Google Cloud Run

Microservice Architecture

Gateway

↓

Discovery Service

↓

Correlation Service

↓

Reporting Service

↓

Migration Service

↓

Evidence Service

↓

SQLite/PostgreSQL

CI/CD Integration

Supported

GitHub Actions

GitLab CI

Azure DevOps

Jenkins

Harness

CircleCI

Typical pipeline

Commit

↓

Build

↓

SBOM

↓

Scan

↓

Normalize

↓

Evidence

↓

Policy Validation

↓

Deployment

Testing Strategy

Unit Tests

Integration Tests

API Tests

Performance Tests

Migration Tests

Rollback Tests

SDK Compatibility Tests

Regression Tests

Multi-Tenant Architecture

Support

Enterprise

Business Unit

Project

Managed Service Providers (MSSP)

Tenant

↓

Business Unit

↓

Cloud Accounts

↓

Projects

↓

Reports

↓

Evidence

AI Security Discovery

Future module

Discover

OpenAI

Azure OpenAI

Amazon Bedrock

Vertex AI

Anthropic

SageMaker

Discover

AI Models

Prompts

Vector Databases

Embeddings

AI Secrets

AI APIs

Model Endpoints

Inference Runtime

MCP Discovery

Future capability

Discover

MCP Servers

Connected Tools

Tool Permissions

Secrets

Models

Runtime

Audit Logs

Policies

Future Platform Modules

Cloud

OCI
Alibaba
DigitalOcean

Containers

OpenShift
Rancher

Security

Tenable
Orca
Lacework
Aqua
Check Point

Identity

Okta
Ping
CyberArk

Observability

Datadog
Grafana
Splunk
Elastic

Development Roadmap

Version 1

Working Demo

AWS onboarding
Runtime reports
SQLite
Dashboard

Version 2

Enterprise Discovery

AWS
Azure
GCP
Kubernetes

Version 3

Platform Connectors

Prisma SDK
Wiz GraphQL
GitHub
Artifactory

Version 4

Enterprise Intelligence

Coverage Delta
Onboarding Validation
Defender Replacement
Runtime Planning
Policy Translation
Engineering Queue

Version 5

Enterprise Reporting

Executive Dashboard
Engineering Dashboard
Compliance
Migration Dashboard
ROI Dashboard

Version 6

Migration Automation

Dry Run
Validation
Rollback
Evidence Packages

Version 7

Enterprise SaaS Platform

Web UI
REST API
GraphQL
Multi-Tenant
Role-Based Access Control
Scheduler
Continuous Drift Detection

Competitive Advantages

The platform differentiates itself by combining capabilities that are typically spread across multiple tools:

Vendor-neutral discovery across cloud providers, Kubernetes, repositories, registries, CI/CD, and identity systems.
Unified evidence repository with normalized data and full auditability.
Coverage Delta Engine to compare Prisma Cloud and Wiz environments during migration.
Defender-to-Wiz migration planning with runtime validation and phased cutover recommendations.
Business Case Generator that estimates engineering effort, migration timeline, automation percentage, and ROI.
Continuous Drift Detection for onboarding health, runtime coverage, permissions, and policy changes.
Cross-platform asset correlation linking cloud resources, runtime, repositories, pipelines, SBOMs, vulnerabilities, and ownership into a single enterprise graph.

Final Vision

The long-term objective is to build an Enterprise Cloud Security Operations Platform rather than another security scanner.

The platform should enable organizations to:

Discover and inventory enterprise cloud environments.
Validate onboarding into Wiz, Prisma Cloud, or Cortex Cloud.
Continuously monitor coverage and operational health.
Correlate assets across cloud, runtime, source control, registries, and CI/CD.
Plan, validate, and execute migrations with measurable risk reduction.
Generate executive, engineering, compliance, and audit-ready reports from a single normalized data model.

By separating discovery, normalization, correlation, reporting, and migration from any single vendor implementation, the framework becomes a reusable enterprise automation platform that can evolve alongside future cloud security products while preserving operational visibility, governance, and migration intelligence.

Enterprise Cloud Security: Discovery, Evidence & Migration Intelligence

One platform. One evidence model. One controlled migration path.

Executive decision framework

Readiness principle

Architecture Assurance & Key Decisions

Executive Decision Graphics

Coverage and Replacement Decision Matrix

Migration Gate Scorecard

Production Readiness Requirements

Important Terminology Correction

Reporting Fields Still Required

Vendor Validation & Evidence Notes

Platform Architecture & Control Flows

Integrated Enterprise Cloud Discovery Engine

Exact Repository Placement

New Names

Supported Provider Discovery

Strict Responsibility Boundary

Discovery Engine Owns

Platform Core Owns

Discovery Job Contract

Normalized Evidence Contract

Failure Semantics

Required Production Refactoring

Migration Integration Rule

README Part 1

Enterprise Cloud Security Discovery, Reporting & Migration Platform

Table of Contents

Enterprise Cloud Security Discovery, Reporting & Migration Platform

Working Demo → Enterprise Product

Executive Summary

Product Vision

1. Vendor Neutral

2. Discovery First

3. Normalize Everything

4. Correlate Enterprise Assets

5. Validate Before Migrating

6. Enterprise Reporting

Why This Framework Matters

Business Justification

Working Demo

AWS Onboarding Discovery

Image Vulnerability Reporting

Host Vulnerability Reporting

Runtime Discovery

Dashboard Generation

Repository Philosophy

High-Level Architecture

Repository Layout

Core Framework

Enterprise Discovery Engine

README Part 2

Repository Architecture, Enterprise Discovery & Platform Connectors

Repository Philosophy

Complete Repository Structure

Shared Core Framework

Connector Layer

Prisma Cloud Connector

Compute

CSPM

AppSec

Wiz Connector

Enterprise Discovery Engine

AWS Discovery

Organizations

Cloud Services

Compute

Storage

Containers

Networking

Identity

Validation

Azure Discovery

Google Cloud Discovery

Kubernetes Discovery

Cluster

Nodes

Workloads

Runtime

Security