Serverless Security Tools logopeterindia.net
Knowledge Hub

Serverless Security Tools

Guidance and tools for securing functions and serverless applications: learning resources, code and dependency scanning, posture management and runtime protection.

24 topics•4 categories•Updated October 2026

Guidance & Training

4 entries

Risk lists and practice material.

01OWASP Serverless Top 10OWASP’s incubator project listing the most common security risks in serverless applications and how to address them. 02OWASP ServerlessGoatA deliberately vulnerable serverless application for learning common serverless security flaws and how to exploit and fix them. The GitHub repository's last commit was in 2019, so it suits learning rather than current-platform guidance. The GitHub repository's last commit was in May 2019, so check its activity before relying on it. GitHub lists 1.0.1 as the latest release, from December 2018, so check its activity before relying on it. 03Serverless ArchitectureDesign patterns and architecture for serverless applications. 04Serverless PluginsPlugins that extend the Serverless Framework.

Code, Dependency & Posture Scanning

7 entries

Find vulnerabilities and misconfiguration before and after deployment.

05SnykDeveloper security platform that scans application code, open-source dependencies and infrastructure as code, which covers serverless projects. 06Amazon InspectorAmazon’s vulnerability scanner can scan AWS Lambda functions, including their code and package dependencies, for known software vulnerabilities. 07ProwlerOpen-source cloud security scanner for AWS, Azure and Google Cloud, with checks that cover serverless functions, such as secrets in Lambda code and publicly exposed function URLs. 08WizAgentless cloud security platform that scans cloud workloads, including serverless functions, for vulnerable dependencies, exposed secrets and risky permissions. Google completed its acquisition of Wiz in March 2026, according to press reports; Wiz continues under its own brand. Google completed its acquisition of Wiz in March 2026. 09Orca SecurityAgentless cloud security platform whose workload protection covers serverless functions such as AWS Lambda and Azure Functions. 10Check Point CloudGuardCloud security services from Check Point. 11Amazon GuardDutyThreat detection service for AWS accounts and workloads.

Runtime & Workload Protection

5 entries

Watch and control what functions do while they run.

12Aqua Security — Serverless SecurityLifecycle and runtime controls for serverless containers and functions on AWS Lambda, AWS Fargate and Azure Container Instances. 13Prisma Cloud — Cloud Workload ProtectionPalo Alto Networks’ workload protection platform, with a serverless security module for securing functions across their lifecycle. 14SysdigRuntime-focused cloud security from the creators of Falco, with threat and malware detection for serverless containers such as those on AWS Fargate. 15FalcoOpen-source runtime security for hosts, containers and Kubernetes. 16Trend Vision One Cloud SecurityCloud security platform from Trend.

Related Pages

8 entries

Related directories on this site.

17Serverless ComputingServerless computing hub. 18Serverless PlatformsPlatforms for running serverless applications. 19Serverless Development ToolsFrameworks and tools for building serverless apps. 20FaaS on KubernetesFunction platforms that run on Kubernetes. 21Workflow AutomationWorkflow and orchestration software. 22Serverless Monitoring ToolsMonitoring for serverless apps. 23Serverless at the EdgeEdge function platforms. 24AI Agents on ServerlessServerless platforms for AI agents.

Frequently Asked Questions

Is serverless more secure?

The provider secures the servers, but you still own code, dependencies, permissions, secrets and configuration. Serverless changes the risks, such as over-permissive roles and event injection, rather than removing them.

What are the main serverless risks?

The OWASP Serverless Top 10 lists risks such as injection through event sources, broken authentication, over-privileged function roles, insecure secrets and vulnerable dependencies.

Do I need agents?

Usually not. Agentless platforms scan configuration and code from the cloud API, and runtime tools use layers or built-in provider telemetry.

Where should I start?

Apply least-privilege roles per function, scan dependencies in the pipeline, and use a posture tool to find public or over-permissive resources.

Are the links checked?

Links were checked when this page was updated and all of them loaded.