Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why CISOs Are Moving to Cloud-Native Security Controls
Transcript
- Lucas: So we're recording this in late June 2026, and one of the quieter but really consequential shifts happening in enterprise security right now is this move away from best of breed third-party security tools toward cloud-native controls. I'm talking about organizations deciding to use AWS Security Hub, Azure Policy, or Google's Security Command Center instead of buying a separate tool from CrowdStrike or Palo Alto for the same function. Luna: That's a pretty big reversal from the 'best of breed' mantra we've heard for a decade. What's driving it? Lucas: The Cloud Security Alliance put out a report earlier this year — their 2025 State of Cloud Native Security — and one number stood out: 68 percent of enterprises now say they prioritize native security controls over third-party tools for at least two of their core cloud security functions. That's up from 42 percent in 2023. Luna: So it's not just a fringe trend — it's becoming mainstream. But I have to imagine there's a trade-off. You lose some advanced features, right? Lucas: Absolutely. Native controls are usually good enough for maybe 80 percent of use cases. They cover the basics — configuration monitoring, compliance frameworks like CIS benchmarks, basic threat detection. But they don't have the deep behavioral analytics you'd get from a dedicated EDR tool, for example. The trade-off is reduced complexity and tighter integration with your cloud environment versus richer detection capabilities. Luna: And that integration piece is huge. If you're already all-in on AWS, spinning up Security Hub and GuardDuty is basically a few clicks. No separate agent deployment, no cross-account IAM headaches. Lucas: Exactly. I talked to a CISO at a mid-size SaaS company — about eight hundred employees, mostly on AWS — who said they went from fifteen security tools down to seven over the past eighteen months. They replaced their third-party CSPM with Security Hub, their vulnerability scanner with Amazon Inspector, and their WAF with AWS WAF. Their security operations team shrank by two people because there was less tool-sprawl overhead. Luna: Did they see any gaps after the migration? Lucas: They did. Their old CSPM had a feature that flagged overly permissive cross-account roles in a way Security Hub didn't at the time. So they had to supplement with a small open-source tool for that one use case. But overall, they estimated a 40 percent reduction in licensing costs — that's about four hundred thousand dollars a year — and their mean time to detect actually improved because there were fewer false positives to triage. Luna: That's a compelling argument. But the obvious counter is vendor lock-in. If you go all-in on AWS native security, how easy is it to move to Azure or GCP later? Lucas: It's not easy. That's the biggest strategic concern. The Cloud Security Alliance report found that 55 percent of CISOs listed vendor lock-in as their top worry with native security stacks. The tools are deeply tied to each cloud's control plane. Your security posture definitions, your automated response playbooks — they're all written in that cloud's native language. Migrating them is essentially a rewrite. Luna: So the advice seems to be: if you're committed to a single cloud, native is great. If you're multi-cloud, you might need a layer that abstracts across them. Lucas: Right. And that's where you see companies like Wiz and Orca still thriving — they provide that cross-cloud layer. But the native tools are getting better fast. Azure Policy, for instance, now has over a hundred built-in definitions for security controls, and it integrates directly with Microsoft Sentinel for SIEM. Google's Security Command Center Premium includes threat detection, vulnerability scanning, and even container analysis. The gap is narrowing. Luna: Let's talk about the economics more specifically. You mentioned 40 percent licensing savings. But there are hidden costs — training your team, migrating existing policies, maybe losing some tool-specific automation. Lucas: Absolutely. The same CISO I spoke with said their migration took about six months and involved two dedicated engineers full-time. They also had to retrain their whole SecOps team on Security Hub's query language — which is different from what they were using. So the upfront cost was real. But they broke even within a year, and now they're saving consistently. Luna: I wonder if there's also a cultural shift happening. DevSecOps teams are already comfortable with infrastructure as code. Using native security controls feels more like writing Terraform modules than managing a separate appliance. Lucas: That's a great point. The security team I mentioned actually started defining their security policies as code alongside their application infrastructure. So when a developer spins up a new S3 bucket, Security Hub automatically checks it against the company's encryption policy — no tickets, no delays. That kind of 'shift left' integration is much harder with a third-party tool that sits outside the cloud API. Luna: And if today was actually useful to you — whether you're building a security strategy or running a cloud team — the way these conversations stay ad-free is through listener support. You can find us at buy me a coffee dot com slash fexingo. Just a simple way to keep the show going. Lucas: Yeah, it really helps. We don't run ads, we don't have sponsors pushing products — that's intentional. So if you've gotten something out of this episode, that link is there. And it's totally fine if you just listen — we're glad you're here. Luna: Exactly. All right, back to the trade-offs. One area where I think native tools still lag is in incident response automation. Third-party SOAR platforms have much richer playbook libraries. Lucas: That's fair. AWS has some automation capabilities through EventBridge and Lambda, but it's not as turnkey as something like Splunk SOAR. However, cloud providers are investing heavily here. Azure Logic Apps and Google Cloud Workflows are getting soar like features. I wouldn't be surprised if within two years, the native options are competitive for most common response scenarios. Luna: Let's talk about compliance, because that's a huge driver. If you're subject to FedRAMP or PCI DSS, having a native tool that maps directly to your cloud's compliance certifications is a big advantage. Lucas: Huge. AWS Security Hub has built-in compliance packs for CIS, PCI DSS, HIPAA, FedRAMP, even NIST 800-53. When Amazon itself gets audited, those same controls apply to your account. So the compliance inheritance is real. With a third-party tool, you're responsible for mapping its checks to each framework yourself. That's a lot of manual work. Luna: And auditors are starting to accept native reports more readily. A friend of mine who's a FedRAMP assessor told me they now see Security Hub and Azure Policy reports as primary evidence, as long as the customer has configured them correctly. Lucas: That's a big shift. Even two years ago, most auditors wanted screenshots from a dedicated compliance tool. Now they're more comfortable with the cloud provider's own output. That reduces audit prep time significantly. Luna: So the bottom line: native security controls are good enough for most organizations, especially if you're single-cloud, and they save money and complexity. But you give up some advanced features and risk lock-in. Lucas: And the calculus changes based on your organization's maturity. If you're a startup scaling fast, native lets you move quickly without hiring a large security team. If you're a Fortune 500 with a dedicated red team, you might still want the best-in-class tools for niche use cases. But I think the trend is clear: the center of gravity is shifting toward the cloud providers. Luna: Where do you see this going in the next year or two? Are we going to reach a point where most companies run purely on native controls? Lucas: I doubt it's all or nothing. I think the majority will end up with a hybrid model — native for the core compliance and baseline detection, third-party for the advanced analytics and specialized threats. But the balance will tilt further toward native. The Cloud Security Alliance predicts that by 2028, over 70 percent of cloud security controls will be native. And cloud providers are incentivized to keep improving — it's a huge competitive moat for them. Luna: That's a good note to end on. For anyone re-evaluating their security stack, the native option deserves a serious look. Lucas: Absolutely. Thanks for listening, and we'll be back next week with another deep dive.