Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware
Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 (Updated Nov. 19)
FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
See all Unit 42 Threat Research
Table of Contents
Cloud Security

Agentless vs Agent-Based Security

3 min. read
Table of Contents

In cybersecurity, agents represent specialized software components that are installed on devices for performing security-related "actions."

Those actions include, but are not necessarily limited to:

  • Security scanning and reporting
  • System restarting and rebooting
  • Applying software patches
  • Making changes to configurations
  • General system monitoring

Due to their nature, it is crucial that the agents perform well in diverse environments, and they must also be low impact and low maintenance.

Agent-based systems are modeled on the pull communication style. With agent-based systems, the client is the central server that pulls the data from the agents on demand. Agents typically have to be installed on each machine following an automated process. Once the agents are configured, they can receive requests from the central server for the results of security-related actions and status updates.

Agentless Security

Agentless security performs many of the same actions, but without the agents. In practice, this means that we can inspect and review security scans and vulnerabilities on a remote machine without having to install an agent on that system. You may have to install software on a different layer of the system (like networking) to capture associated risk metrics, but you won’t need to have direct access to the host to install any service.

Agentless systems, then, are based on the push communication style. With agentless systems, the associated software pushes data to a remote system on a periodic basis. Because of the flexibility of this setup, agentless security solutions work well for baseline security monitoring. You can configure them to scan the whole infrastructure without having to install them to each subsystem. A central system, though, still needs to be available to coordinate scanning and the deployment of patches.

Video: Agent-based security software and agentless security software explained

On the other hand, you may need to install agent-based systems to certain hosts that require stricter controls. For example, if you have hosts that deal with financial data, you might want to maximize your use of available security technology by installing agents that can carefully monitor and protect those systems as well as improve their overall security posture.

Is Agentless or Agent-Based Security Better?

Since both agentless and agent-based security are widely used today, you may be wondering which one you should choose. Actually, you should use both to achieve comprehensive security. It is still important to understand the pros and cons of each one so that you know when to use them effectively.

To summarize, agentless systems have a number of features that make them appealing, including:

  • Quicker setup and deployment: You don’t need to have direct access to all hosts to perform security scans.
  • Less maintenance and lower provisioning costs.
  • Wider initial visibility and greater scalability.
  • Ideal for networks with large amounts of bandwidth.
  • Need for a center host available to perform actions.

Agent-based systems have the following benefits over agentless systems:

  • Enable in-depth scanning and monitoring of hosts: Agents can perform more specialized scanning of components and services.
  • Can be used as a firewall, since it can block network connections based on filtering rules.
  • Offer runtime protection per host or per application.
  • Provide security controls, like the ability to block attacks and patch live systems.
  • Ideal for networks with limited bandwidth, locations within DMZ zones or laptops that can be out of network reach. You can install the agent in systems without network connectivity.
  • Do not need a central host since they can perform tasks independently: Once installed, the agent will run its set of actions on demand without needing to establish a connection to a server beforehand – even when it is disconnected from the enterprise network.

Now that you know the pros and cons of each type of service, you can make informed decisions about how to deploy each to protect your infrastructure components. By combining agent-based and agentless systems, you can realize the best of both worlds.

Learn More

Cloud native workload security shouldn't require you to compromise your needs based on someone else's architecture. Prisma Cloud is one of the few enterprise security platforms that offers both agent-based and agentless security options in a single solution. See how simple and powerful the combination of agentless and agent-based security can be.

 

FAQs

Agent-based monitoring involves deploying software agents on servers or endpoints to collect data on system health, performance, and security events. These agents provide real-time monitoring and alerting for potential issues, and are particularly effective in environments that require detailed, granular monitoring at the system level.
Agentless scanning refers to the security practice of assessing devices for vulnerabilities or compliance without installing dedicated software on the target systems. It typically uses network-based techniques to remotely evaluate systems, making it well-suited for environments where agent deployment is not feasible or where minimal performance impact is desired.
Agent-based vulnerability assessment uses software agents installed on systems to continuously scan for security weaknesses. These agents have deep visibility into system configurations, running processes, and installed applications, allowing for comprehensive vulnerability detection and remediation.
Agentless compliance checks are evaluations of systems against security benchmarks or regulations performed without installing permanent software on the target systems. These checks use network protocols to remotely verify system configurations, enhancing flexibility and reducing the maintenance required for compliance monitoring.
Agent deployment refers to the process of installing monitoring or security software components on endpoints or servers within a network. This process enables the centralized management of security policies and the collection of detailed data required for in-depth analysis and response to security incidents.
Agentless configuration management governs systems' settings and states without resident software on target hosts. It leverages existing protocols like SSH or WinRM to execute management tasks directly over the network, offering the advantage of managing numerous systems without the complexity of agent maintenance.
Agent-based threat hunting uses installed software on endpoints to proactively search for and isolate advanced threats that evade traditional security measures. These agents collect and analyze detailed system activities, allowing threat hunters to trace indicators of compromise and remediate them swiftly.
Agentless network analysis involves monitoring and evaluating network traffic from a central location without deploying agents on network devices. This technique captures and inspects traffic to identify anomalies, optimize performance, and detect security threats across the network infrastructure.
Agent-based data encryption secures data by encoding it at the endpoint level using installed software agents. These agents ensure that data remains encrypted during transmission and at rest, providing granular control over encryption keys and policies directly on the devices that store or process sensitive information.
Agentless patch verification assesses systems for applied patches utilizing network-based tools rather than local agents. This method checks devices' patch levels against known vulnerabilities, ensuring compliance with security policies without the overhead of installing and managing agents on each endpoint.
Agent-based malware protection involves installing security agents on endpoints to detect and prevent malicious software in real-time. These agents continuously monitor for signs of malware, offering immediate isolation and remediation capabilities, and can adapt protection strategies based on evolving threat intelligence.
Agentless credential auditing scans and assesses user credentials and permissions settings across networked systems without installing local software agents. Utilizing network protocols for access, it verifies password policies, identifies shared accounts, and detects weak credentials to ensure adherence to security best practices.
Agent-based log management involves collecting, centralizing, and analyzing logs from various systems using software agents installed on each host. These agents facilitate real-time log data processing, enabling rapid anomaly detection and providing valuable insights for security incident investigations.
Agentless resource discovery identifies active devices and services within a network from a centralized location without deploying agents on individual nodes. This method relies on network scanning techniques and protocols to inventory and map networked assets, providing visibility for security management and planning.
Agent-based intrusion detection deploys monitoring agents on hosts or networks to detect suspicious activities indicative of potential security breaches. These agents analyze system behavior and network traffic for known attack patterns, alerting security teams to possible intrusions for immediate action.
Agentless policy enforcement manages and applies security policies across networked devices without the need for resident agents. It leverages network access control and management protocols to remotely configure devices, ensuring policy compliance and reducing the overhead associated with managing individual agents.

Related content

Get the latest news, invites to events, and threat alerts