Prowler is an Apache-2.0, Python-based open-source cloud security platform that automates security and compliance assessments across AWS, Azure, and Google Cloud through thousands of ready-to-use checks, aimed at cloud security, compliance, and DevSecOps teams that need continuous posture management without a commercial licence.

What it is

Prowler is an open-source cloud security platform written in Python and released under Apache-2.0. It ships with thousands of ready-to-use security checks, remediation guidance, and hundreds of built-in controls that map findings to compliance frameworks. It occupies the cloud security posture management (CSPM) category and covers AWS, Azure, and Google Cloud from a single tool. The project is distributed in three shapes: a command-line interface invoked as prowler, a local dashboard started with prowler dashboard, and Prowler Local Server, a self-hosted web application. A hosted version, Prowler Cloud, is offered separately at cloud.prowler.com.

The concrete problem it solves is framework-by-framework assessment work. Rather than building and maintaining per-provider checks and manually reconciling them against each standard, Prowler supplies the checks and the control mappings directly. Its built-in frameworks span industry standards such as CIS, NIST 800, NIST CSF, CISA, and MITRE ATT&CK; regulatory frameworks including RBI, FedRAMP, PCI-DSS, and NIS2; privacy frameworks GDPR, HIPAA, and FFIEC; governance frameworks SOC2, GXP, and ISO 27001; cloud-specific frameworks AWS Foundational Technical Review, AWS Well-Architected, and BSI C5; national standards ENS and KISA ISMS-P; and custom frameworks. Prowler ThreatScore adds weighted risk prioritization so that critical findings surface first.

Key capabilities

• Runs scans from the command line with prowler and serves a local results dashboard with prowler dashboard.
• Maps findings against hundreds of built-in controls across CIS, NIST 800, NIST CSF, CISA, MITRE ATT&CK, PCI-DSS, FedRAMP, NIS2, GDPR, HIPAA, FFIEC, SOC2, GXP, ISO 27001, BSI C5, ENS, and KISA ISMS-P, plus custom frameworks.
• Assesses AWS, Azure, and Google Cloud environments.
• Applies Prowler ThreatScore, a weighted risk prioritization scoring model, to rank findings.
• Generates Attack Paths, a graph feature that extends every completed AWS scan by combining Cartography's cloud inventory with Prowler findings.
• Selects the Attack Paths graph sink with ATTACK_PATHS_SINK_DATABASE, using Neo4j by default or Amazon Neptune as an opt-in cloud-managed alternative.
• Ships Docker Compose files that already include a neo4j service, and supports Amazon Neptune over Bolt on port 8182 with SigV4 authentication through boto3.

Who uses it and how

• Cloud security and DevSecOps teams running recurring posture assessments across AWS, Azure, and GCP from a single CLI or dashboard.
• Compliance and risk owners who need findings mapped to ISO 27001, SOC2, PCI-DSS, HIPAA, GDPR, FedRAMP, NIS2, or national schemes such as ENS and KISA ISMS-P.
• Security analysts who want attack-path graph analysis on AWS estates, either self-hosting Neo4j through the provided Compose files or pointing at Amazon Neptune with NEPTUNE_WRITER_ENDPOINT and AWS_REGION.
• Organizations that prefer a hosted control plane, using Prowler Cloud, or that need an air-gapped or in-account deployment through Prowler Local Server.
• Teams with bespoke obligations, using custom security frameworks.

Getting started

Run the CLI with prowler, or start the local dashboard with prowler dashboard. For the web application, deploy Prowler Local Server following its installation documentation, or sign up for the hosted Prowler Cloud.

How it compares

No comparable or competing products are named in the facts for this entry. Within this registry, Prowler stands alone in the cloud security posture management and compliance category.

When to use it — and when not to

A self-hoster must operate a graph database: the Docker Compose path requires a Neo4j service with credentials able to create per-tenant databases, and the Neptune path additionally requires AWS SigV4 credentials, a writer endpoint, and a region. Note that Cartography ingestion always uses a temporary Neo4j database regardless of the configured sink, so the NEO4J_* variables must remain set even when ATTACK_PATHS_SINK_DATABASE=neptune. Attack Paths currently extends only AWS scans, so organizations running exclusively on Azure or GCP will not get that feature. Teams unwilling to run infrastructure should choose Prowler Cloud instead.

prowler <provider>

prowler dashboard