Agentless vs Agent-Based Security

In cybersecurity, agents represent specialized software components that are installed on devices for performing security-related "actions."

Those actions include, but are not necessarily limited to:

• Security scanning and reporting
• System restarting and rebooting
• Applying software patches
• Making changes to configurations
• General system monitoring

Due to their nature, it is crucial that the agents perform well in diverse environments, and they must also be low impact and low maintenance.

Agent-based systems are modeled on the pull communication style. With agent-based systems, the client is the central server that pulls the data from the agents on demand. Agents typically have to be installed on each machine following an automated process. Once the agents are configured, they can receive requests from the central server for the results of security-related actions and status updates.

Agentless Security

Agentless security performs many of the same actions, but without the agents. In practice, this means that we can inspect and review security scans and vulnerabilities on a remote machine without having to install an agent on that system. You may have to install software on a different layer of the system (like networking) to capture associated risk metrics, but you won’t need to have direct access to the host to install any service.

Agentless systems, then, are based on the push communication style. With agentless systems, the associated software pushes data to a remote system on a periodic basis. Because of the flexibility of this setup, agentless security solutions work well for baseline security monitoring. You can configure them to scan the whole infrastructure without having to install them to each subsystem. A central system, though, still needs to be available to coordinate scanning and the deployment of patches.

Video: Agent-based security software and agentless security software explained

On the other hand, you may need to install agent-based systems to certain hosts that require stricter controls. For example, if you have hosts that deal with financial data, you might want to maximize your use of available security technology by installing agents that can carefully monitor and protect those systems as well as improve their overall security posture.

Is Agentless or Agent-Based Security Better?

Since both agentless and agent-based security are widely used today, you may be wondering which one you should choose. Actually, you should use both to achieve comprehensive security. It is still important to understand the pros and cons of each one so that you know when to use them effectively.

To summarize, agentless systems have a number of features that make them appealing, including:

• Quicker setup and deployment: You don’t need to have direct access to all hosts to perform security scans.
• Less maintenance and lower provisioning costs.
• Wider initial visibility and greater scalability.
• Ideal for networks with large amounts of bandwidth.
• Need for a center host available to perform actions.

Agent-based systems have the following benefits over agentless systems:

• Enable in-depth scanning and monitoring of hosts: Agents can perform more specialized scanning of components and services.
• Can be used as a firewall, since it can block network connections based on filtering rules.
• Offer runtime protection per host or per application.
• Provide security controls, like the ability to block attacks and patch live systems.
• Ideal for networks with limited bandwidth, locations within DMZ zones or laptops that can be out of network reach. You can install the agent in systems without network connectivity.
• Do not need a central host since they can perform tasks independently: Once installed, the agent will run its set of actions on demand without needing to establish a connection to a server beforehand – even when it is disconnected from the enterprise network.

Now that you know the pros and cons of each type of service, you can make informed decisions about how to deploy each to protect your infrastructure components. By combining agent-based and agentless systems, you can realize the best of both worlds.

Learn More

Cloud native workload security shouldn't require you to compromise your needs based on someone else's architecture. Prisma Cloud is one of the few enterprise security platforms that offers both agent-based and agentless security options in a single solution. See how simple and powerful the combination of agentless and agent-based security can be.