A security team must assess vulnerabilities and misconfigurations on thousands of virtual machines across 40 cloud accounts within days. Other teams own the workloads, and the security team is not permitted to install software on them. Which approach fits?

Agentless cloud security tools connect to provider APIs with read permissions, inventory resources, and analyze workload disks by taking snapshots that are scanned outside the running instance. They can identify vulnerable packages, misconfigurations and exposed secrets across many accounts quickly, without coordinating installations with workload owners, which matches the coverage, speed and no-install constraints. The trade-off is depth: agentless scanning is periodic and lacks continuous runtime visibility. Agent-based workload protection provides deep, real-time telemetry about processes and behavior, but it requires installing software on every machine, which the team is not permitted to do and which would take far longer across thousands of instances. An eBPF-based sensor is also installed software, running in the kernel to observe system calls and network activity in real time; it offers excellent runtime insight but violates the same constraint. A network intrusion detection sensor sees traffic, not installed packages or configuration, so it cannot assess vulnerabilities comprehensively and misses anything not exercised on the wire. Exam caveat: mature programs often combine agentless breadth with agents on critical workloads where runtime detection matters. Operational check: grant the tool read access to each account, run the first scan, and confirm that coverage reports include every account and virtual machine.