A self-hosted Wiz alternative

Two products with overlapping inputs and different outputs. Wiz reads your cloud and builds a resource graph used for posture and attack-path analysis. Hanu reads the same clouds, normalises what it finds into typed signals, and emits compound risks: one chain, one owner, with the rule, the score and every contributing observation attached. The deciding question is not which scanner sees more. It is which unit of work your team can close, and who is allowed to hold the data.

Where the other tool wins

Stated plainly, because a comparison page that flatters its author is not worth reading.

• Posture breadth and cloud coverage. A CNAPP at Wiz's scale ships more service coverage, more clouds and more continuously updated detection content than Hanu does. Hanu registers 368 AWS service checks, 77 for Azure and 77 for GCP, reads three clouds, and does not support Oracle Cloud at all - our engines for it are stubs.
• The graph is the product. A resource graph, its attack-path views and the query surface built on top of them are the centre of Wiz's product. Hanu's graph is derived from correlation output; it earns its place as a ranking input, and it is the thinner exploration tool of the two.
• A managed service. No datastore to size, no upgrade window to schedule, no backup rotation, no pager for the security tool itself. Wiz also publishes an in-cloud deployment option for customers whose telemetry cannot leave their tenancy, which means residency is not automatically a reason to look elsewhere.
• Recognition. A report from a known CNAPP vendor moves through procurement, customer questionnaires, board packs and insurance renewals with less explanation than a self-hosted tool does. That is worth real money and it is not a feature we can match.
• Content cadence. Detection content updates continuously as part of a managed service. In Community, Hanu's detections ship with each release, and the between-release feed is a Growth capability.

Where Hanu fits

The difference is approach rather than quality: what counts as the unit of work, and where the data is allowed to live.

• Deterministic correlation over typed signals. 166 typed signals from cloud, code, CI/CD, identity, certificate, container, network and AI collectors land on one bus with the resource, principal, account and confidence attached. 75 correlation rules join them in two tiers: 34 that evaluate one signal against history and context, and 41 that fuse signals from different providers inside a declared window. Scoring is arithmetic, and 0 LLMs sit anywhere in detection or scoring.
• Compound risk instead of finding count. 609 behavioural detections exist so that chains have material to form from, not so that you receive 609 tickets. What reaches a person is one risk per chain, with the evidence list attached: a workflow tamper and a credential exposure inside seven days, a release with no provenance and a first-ever credential validation in the same window.
• Self-hosted with zero egress. Eight services from one compose file, including its own Postgres, Neo4j, Redis and object store, with a documented minimum host of 2 vCPU, 6 GB RAM and 10 GB disk. There is no Hanu-hosted control plane, no usage ping and no licence callout, so 0 bytes of your telemetry leave your account, and the stack runs air-gapped with a signed detection bundle copied in.
• Source-available under the Elastic License 2.0. Community costs $0 to run in production, with no seat count and no ingest meter. ELv2 is not OSI-approved open source and we do not describe it as such; it is source-available with no time conversion, which means the rules deciding what matters are readable by the team who has to defend them. Growth and Enterprise can also be delivered as a managed instance if you would rather we carried the pager.

The practical result is a shorter queue with better reasons attached. A posture finding that reaches nothing stays low. A certificate in use chaining to a hierarchy whose keys are recoverable, or a workflow change in the repository holding your deploy credentials, arrives as one chain rather than as three unrelated items in three consoles. The mechanism is on security correlation; the operating trade is on self-hosting.

Verdict

Choose Wiz if you are a CISO, a head of cloud security or a security architect with a managed CNAPP budget, a vendor tenancy your policies permit, and a deliverable that is posture and attack-path coverage at breadth - or if a report from a recognised vendor is itself part of the requirement. Choose Hanu if you are a CTO or a platform lead at a smaller organisation with no dedicated security hire, if a regulator or a customer contract keeps telemetry inside a boundary you can demonstrate, or if the risks that matter arrive through CI/CD, identity and AI surfaces a cloud scanner does not read. Where both paragraphs are true, run both and accept two consoles: Hanu ships no Wiz connector, and we will not imply that findings flow between the two.

Questions that come up in evaluation