Delve
AI-native compliance automation with agent-based evidence collection
Prowler
Unified cloud security platform for automated compliance across providers
Prowler automates security audits and continuous compliance for AWS, Azure, GCP, Kubernetes and more, offering hundreds of built‑in checks, customizable frameworks, and a web UI for real‑time monitoring.
Overview
Audience
Security engineers, DevOps teams, and compliance officers who need to assess cloud environments quickly and continuously. Prowler supports AWS, Azure, Google Cloud, Kubernetes, and additional providers, making it suitable for startups to enterprises.
Capabilities
Prowler ships with hundreds of pre‑built checks mapped to standards such as CIS, NIST, PCI‑DSS, GDPR, and industry‑specific frameworks. Users can run audits via a single CLI command or through the web‑based Prowler App, which visualizes results, tracks remediation, and offers real‑time dashboards. Custom frameworks can be defined, and integrations with CI/CD pipelines enable automated compliance as code.
Deployment
The platform can be launched with Docker Compose for quick local testing or installed from source using Git, Poetry, and npm. Containers are built for linux/amd64, and environment variables allow role assumption and credential mounting. The API and worker components run on standard Python and Gunicorn stacks, while the UI is served on port 3000. Documentation provides step‑by‑step guides for each method.
Highlights
Multi‑cloud support for AWS, Azure, GCP, Kubernetes and more
Over 500 built-in security and compliance checks aligned with major standards
Web UI with real-time dashboards plus full CLI/API access
Customizable frameworks and integration with CI/CD pipelines
Pros
- Comprehensive coverage of industry and regulatory frameworks
- Single tool for audit, monitoring, and remediation
- Easy installation via Docker Compose or source build
- Extensible with custom checks and automation hooks
Considerations
- UI requires Docker environment; not a native binary
- Some providers (IaC, LLM, NHN) are still in beta
- Initial configuration of credentials can be complex for role assumption
- Large number of checks may produce noise without proper filtering
Managed products teams compare with
When teams consider Prowler, these hosted platforms usually appear on the same shortlist.
Looking for a hosted option? These are the services engineering teams benchmark against before choosing open source.
Fit guide
Great for
- Organizations needing continuous compliance across multiple cloud providers
- Teams that prefer both CLI and graphical interfaces for security assessments
- Companies adopting DevSecOps pipelines that require automated checks
- Security auditors looking for a standards-aligned checklist library
Not ideal when
- Environments that cannot run Docker or lack container support
- Very small projects that need only a handful of simple checks
- Users seeking a fully managed SaaS solution without self-hosting
- Teams requiring out-of-the-box support for unsupported cloud services
How teams use it
Periodic compliance audit
Run scheduled Prowler scans to generate reports aligned with PCI-DSS and CIS, enabling auditors to demonstrate continuous compliance.
CI/CD security gate
Integrate Prowler CLI into pipelines so builds fail when new security findings exceed defined thresholds.
Incident response hardening
Leverage Prowler’s remediation guidance to quickly identify misconfigurations after a breach and apply recommended fixes.
Multi-cloud visibility dashboard
Use the Prowler App to aggregate findings from AWS, Azure, and GCP into a single real-time dashboard for executive reporting.
Tech snapshot
Python90%
TypeScript9%
HCL1%
Shell1%
JavaScript1%
CSS1%
Frequently asked questions
Can I run Prowler without the web UI?
Yes, the CLI works independently; use `prowler <provider>` to execute checks directly from the terminal.
Which compliance frameworks are included out of the box?
Prowler includes CIS, NIST 800, NIST CSF, CISA, RBI, FedRAMP, PCI‑DSS, GDPR, HIPAA, SOC2, GXP, AWS FTR, AWS Well‑Architected Security Pillar, ENS, among others.
Is there support for custom checks?
Yes, you can create custom security frameworks and add your own checks to tailor assessments to specific organizational needs.
What cloud providers are currently in stable stage?
AWS, GCP, Azure, Kubernetes, GitHub, and Microsoft 365 are listed as stable; other providers are in beta.
Project at a glance
Active- Stars
- 12,688
- Watchers
- 12,688
- Forks
- 1,928
LicenseApache-2.0
Repo age9 years old
Last commit2 days ago
Primary languagePython
Last synced yesterday