LoginSign Up
← Back to all sparks
P

Prowler

INFRA · APIS
Velocity7.5

Open-source cloud security assessment and compliance platform

prowler.com ↗

Prowler 5.49 asks a new question after each scan: which of your servers run an image under attack?

cloud-securityvulnerability managementexploitabilityawsopen-core
◆Current state
Prowler ships a minor release every one to two weeks. 5.48 added Realtime for AWS, which checks resources as CloudTrail events arrive and can alert, open a Terraform pull request or fix the resource. 5.49 adds emerging threat signatures: a vulnerability described as data, matched against the machine images of every compute instance on AWS, Azure and Google Cloud, with Amazon Inspector clearing hosts patched in place. Prowler Cloud supplies a threat catalog and turns each threat into an Exploitability issue per account.
◆Where it's heading
Prowler is moving from configuration checks toward telling teams what is actually exploitable now: Realtime cut the wait for detection, and threat signatures cut the wait for a new check when a vulnerability lands. The free engine keeps the mechanism, while the maintained catalog and issue triage sit in Prowler Cloud.
◆Prediction
Expect the threat catalog to grow and exploitability issues to reach more providers or link into Realtime alerts in the next releases.

◆Recent moves

  1. 1d ago

    Prowler 5.49 matches cloud instances against threat signatures

    ⚡ SPARK

    A week after Realtime, Prowler adds a second fast path: new vulnerabilities become data signatures matched against every instance's image, with no new check or release needed. It extends the shift from posture scanning to telling teams what is exploitable.

    View source ↗
  2. 7d ago

    Prowler 5.48: Realtime AWS detection and auto-remediation

    ⚡ SPARK

    Realtime turns Prowler from a scheduled scanner into a live watcher on AWS CloudTrail with alert, pull-request or auto-fix responses. It is the endpoint of the arc from partial re-scans to verdict-first issues.

    View source ↗
  3. 15d ago

    Prowler 5.47: one-step provider setup, Issues verdicts explained

    One-step provider connection, verdict-first Issues with attack paths and a Why column, and MCP tools annotated as read-only or destructive. It builds directly on 5.46's Issues page, and Lighthouse AI can now connect a provider itself, not only advise. Product tours are gone, so the wizard carries onboarding alone.

    View source ↗
  4. 18d ago

    Prowler 5.46 adds Issues view and Bedrock/Vertex AI checks

    Follows 5.45's Azure AI checks with Bedrock guardrail and invocation-logging checks on AWS and Vertex AI Workbench checks on GCP, as the 5.45 pattern suggested. The Prowler Cloud Issues page, which groups findings into verdict-bearing issues, continues the paid tier's move into triage. PHP2Shell runtime checks show the team turning named CVEs into checks within a release.

    View source ↗
  5. 1mo ago

    Prowler 5.45 adds Azure AI Services and Entra ID checks

    5.45.0 adds nine Azure AI Services checks, including Prompt Shields on model deployments, five Entra ID checks and home-region support for OCI tenancies. Auditing hosted AI accounts is a natural extension of the coverage push, and the first entry in this window aimed at AI infrastructure itself.

    View source ↗
  6. 1mo ago

    Prowler 5.44.0

    A fixed resource can now be re-checked with a partial scan instead of waiting for the next full run. It shortens the remediation loop, and it is subscription-only, like the other recent workflow features.

    View source ↗