G2

Adrie B.

Chairman of the foundation

Small-Business (50 or fewer emp.)

8/7/2026

"Attack Path Analysis That Makes Cloud Risk Actionable"

4.5/5

What do you like best about Microsoft Defender for Cloud?

It’s not just a scanner—it’s a control plane that connects posture findings to real remediation, and it’s become genuinely strong at doing that.

A few things that stand out for me:

Attack path analysis. This is the feature that changed how I run client conversations. Instead of handing someone a spreadsheet with 400 “high severity” findings, I can show an actual graph: “this exposed VM connects to this database with this over-permissioned identity, and here’s the three-hop path an attacker would take.” It turns abstract risk into a story leadership can actually follow, and it pushes prioritization instead of the usual whack-a-mole.

Unifying CSPM and CWPP in one place. Before this was consolidated, I was stitching together posture data from one tool and runtime threat detection from another for every client. Now I can see recommendations and active threat alerts in the same console, often tied to the same resource. That correlation—“this resource is misconfigured and is also showing suspicious activity right now”—is where the real value shows up.

Multi-cloud without needing a separate product. Being able to onboard an AWS account and evaluate it against the same posture framework as an Azure subscription, all in the same portal, still feels like a genuine win. A lot of clients end up with hybrid environments almost by accident (for example, shadow IT AWS accounts spun up by a dev team), and having one pane of glass to catch that is worth a lot.

Native reporting. I’ve mentioned this earlier, but it deserves its own callout: being able to build a CNAPP Executive Summary report inside the product and export it for a board deck—rather than exporting raw data into Power BI every quarter—has saved me hours per client.

If I had to pick just one highlight, though, it’s the attack path graph. It’s what turns “here’s a wall of alerts” into “here’s what actually matters and why,” and that’s basically the whole job of a security consultant. Review collected by and hosted on G2.com.

What do you dislike about Microsoft Defender for Cloud?

The recommendation-noise problem never fully goes away. Even with the shift to individual, per-finding recommendations, the practical effect for a lot of shops is more line items, not fewer. Grouped recommendations were easier to triage at a glance; now I’m explaining to a client why they have 40 near-identical “update this package” entries instead of one grouped item. Granularity is great for engineers doing the actual remediation, but it’s a rougher experience for anyone trying to get a quick posture read.

Licensing and plan boundaries are genuinely confusing. Walking someone through which Defender plan covers which capability—and which sub-features are metered separately (looking at you, per-resource billing on things like Defender for Open-Source Relational Databases)—eats up real time in every engagement. It’s not that the pricing is unreasonable; it’s that it stays opaque until you’re already three tabs deep in the Azure pricing calculator.

The pace of change is exhausting to keep up with. New GA features, new deprecations, new permission requests (like the GitHub connector’s new artifact_metadata:write scope), and new default-behavior changes all land more or less monthly. That’s good for the product, but rough on a consultant who has to read every release note or risk a client asking, “Why did this alert disappear?” and not having an answer. Nobody has time to be a full-time Defender for Cloud news-tracker.

Defaults also quietly shift under you. Foundational CSPM moving to opt-in for new subscriptions this October is the current example—sensible from Microsoft’s cost perspective, but it means immature orgs that relied on “it just works out of the box” are going to lose baseline visibility without realizing it. I’ve seen this pattern before with other default changes, and it always turns into a wave of “Wait, why isn’t this showing up anymore?” support tickets.

Cross-cloud parity isn’t quite there yet. AWS and GCP support has improved a lot, but the depth of coverage—especially on workload protection, not just posture—still lags what you get natively in Azure. If a client is AWS-heavy with just a toe in Azure, I’m upfront that this won’t feel as first-class as it does for an Azure-native shop.

There’s also alert fatigue on the identity/OAuth side. As Defender for Cloud Apps keeps absorbing more governance surface (AI agent protection, unused app insights, etc.), the volume of identity-related findings has grown fast. It’s good coverage, but without dedicated headcount to triage it, a lot of clients just let it pile up—which defeats the purpose.

None of this is a dealbreaker—I still recommend it to nearly every Azure client—but it’s not a “set it and forget it” tool. Anyone selling it to leadership as one is setting expectations wrong. Review collected by and hosted on G2.com.

What problems is Microsoft Defender for Cloud solving and how is that benefiting you?

The problems it’s solving

1. Fragmented visibility across cloud sprawl. Before a tool like this, answering “what’s our security posture?” meant pulling data from five different places—Azure Policy, native AWS Security Hub, some Kubernetes dashboard, and even manual spreadsheets. Defender for Cloud pulls that into a single view of resources, misconfigurations, and identities across Azure/AWS/GCP. That’s the foundational issue: you can’t secure what you can’t see.

2. The alert-to-action gap. Traditional security tooling is great at generating alerts and terrible at telling you which ones actually matter. Attack path analysis and exposure-based prioritization go straight at alert fatigue by tying findings to real exploitability—whether an exposed resource is reachable and whether it leads anywhere valuable.

3. Compliance as an ongoing state instead of a point-in-time audit. Frameworks like ISO, NIST, and CIS benchmarks used to mean a consultant doing a manual audit once or twice a year. The built-in regulatory compliance dashboards shift that into a continuously updated posture, which changes the cadence of how compliance work gets done.

4. The DevSecOps handoff problem. The GitHub connector and the artifact attestation work address a real gap: security findings used to live entirely in ops-land, disconnected from the developers who actually write the vulnerable code. Pushing findings back into the CI/CD pipeline closes that loop.

Benefits

1. It shortens my time-to-value on every new engagement. When I onboard a new client, I’m not building a bespoke inventory-and-risk process from scratch. I plug them in, wait for the initial scan, and I have a defensible baseline in days instead of weeks. That’s billable time I’m not burning on plumbing.

2. It gives me a credible artifact for client conversations. Secure Score and the attack path graphs aren’t perfect, but they’re legible to non-technical stakeholders. I spend less time translating technical risk into business risk because the tool does part of that translation for me.

3. It makes my recommendations more defensible. When I tell a client, “Fix this first,” I can point to Microsoft’s own risk-prioritization logic backing that call, rather than it being just “my opinion as a consultant.” That matters when you’re pushing back against a dev team that doesn’t want to reprioritize their sprint.

4. The native reporting has quietly become part of my deliverable. I used to build custom PowerBI decks for quarterly reviews; now a meaningful chunk of that is generated in-portal and exportable to PDF. That’s real time back in my week that I can spend on remediation work instead of report formatting.

The honest caveat: it solves the visibility and prioritization problems well. It doesn’t solve the organizational problem. A client still needs a human with the authority to act on what it surfaces. I’ve seen plenty of tenants with beautiful Secure Scores and dashboards that nobody ever looks at because there’s no clear owner. The tool gives me leverage; it doesn’t replace the part of the job where I have to convince a room full of people to care. Review collected by and hosted on G2.com.