Serverless Security evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

All 1 vendors in this category.

• baselineRFIWhat visibility does the platform provide into serverless function behavior at runtime (not just static configuration) — actual invocation patterns, network calls made during execution, and permissions actually used versus permissions granted — given serverless functions are ephemeral and traditional agent-based monitoring often doesn't apply?weight 3
  Answer key — what a strong answer shows

  Serverless functions' ephemeral nature makes traditional endpoint-agent monitoring impractical; ask specifically how runtime visibility is achieved (e.g., a lightweight extension/layer, or provider-native telemetry) since this is a genuinely different technical problem than securing a persistent VM or container.

• baselineRFPDescribe least-privilege enforcement for function IAM roles — can the platform identify and recommend right-sizing an over-permissioned function (a function with broad IAM access it never actually uses), and quantify the reduction in excessive permissions achieved with a customer reference.weight 3
  Answer key — what a strong answer shows

  Over-permissioned serverless functions are a very common real-world finding (broad default roles copy-pasted across many functions); ask for a concrete before/after permission-reduction figure from a named customer.

• baselineRFIHow does the platform detect vulnerable dependencies within function code/packages specifically, and is scanning integrated into the CI/CD deployment pipeline (catching issues before deploy) or only post-deployment (catching issues after functions are already live in production)?weight 3
  Answer key — what a strong answer shows

  Pre-deployment (CI/CD-integrated) scanning is materially stronger than post-deployment-only detection, since it prevents vulnerable functions from ever reaching production rather than just flagging them after the fact.

• baselineRFPDetail coverage across serverless platforms (AWS Lambda, Azure Functions, Google Cloud Functions) — is depth of protection consistent, or concentrated on one provider (commonly AWS Lambda, the most widely adopted) with materially thinner support elsewhere?weight 3
  Answer key — what a strong answer shows

  Ask for an explicit per-provider coverage breakdown, since serverless security tooling maturity often varies significantly by cloud provider and this gap is not always disclosed upfront.

• baselineRFIWhat protection exists against event-injection attacks specific to serverless architectures (malicious input via the triggering event source — e.g., a poisoned S3 object triggering a Lambda, or malicious API Gateway payload) as distinct from traditional application-layer input validation?weight 3
  Answer key — what a strong answer shows

  Serverless functions are invoked by diverse event sources (queues, storage triggers, API gateways) each with different injection risk profiles; ask specifically how the platform addresses event-source-specific injection risks, not just generic input validation.

• baselineRFIWhat is the pricing model — per function, per invocation volume, or a flat enterprise tier — and how does cost scale for a highly elastic serverless environment where invocation volume can spike dramatically?weight 3
  Answer key — what a strong answer shows

  Invocation-volume-based pricing interacts awkwardly with serverless's inherently elastic, spiky usage patterns — ask explicitly how the vendor handles pricing for genuinely variable workloads rather than assuming a static baseline.

• baselineRFPDescribe incident-response/forensic capability for a confirmed compromised serverless function, given functions are ephemeral and may no longer exist by the time an analyst begins investigating — what evidence is captured and preserved before a function instance terminates?weight 3
  Answer key — what a strong answer shows

  Serverless forensics is genuinely harder than persistent-server forensics given function ephemerality — ask for a specific evidence-preservation mechanism and a real customer example of investigating a confirmed compromise.

• baselineRFIWhat compliance-evidence generation exists showing serverless security controls were active and enforced (for a SOC 2 or similar audit), and is this a built-in exportable report or something the security team must assemble manually?weight 3
  Answer key — what a strong answer shows

  Native compliance-evidence generation is materially more valuable than raw findings requiring manual compilation for every audit cycle.

• baselineRFPHow does this platform relate to the customer's existing CNAPP/workload-protection tooling — is serverless security a genuinely distinct, function-specific capability, or does it substantially duplicate protection a comprehensive CNAPP platform already provides for serverless workloads?weight 3
  Answer key — what a strong answer shows

  This is a real, common buyer question given the functional overlap with CNAPP's own serverless coverage — a vendor should give an honest answer about the boundary and complementarity, not imply a standalone purchase is always necessary.

• baselineRFIWho within the organization gets access to serverless security findings and function-level permission data, and is there role-based access control given that this reveals detailed application architecture and potential privilege-escalation paths?weight 3
  Answer key — what a strong answer shows

  Function-level IAM and architecture findings are sensitive reconnaissance information — role-based access control over the tool's own findings is an often-overlooked consideration.

• baselineRFIWhat performance overhead (cold-start latency impact specifically) does the security instrumentation add to function execution, given serverless cold-start latency is already a significant, closely-watched performance concern?weight 3
  Answer key — what a strong answer shows

  Cold-start latency is a particularly sensitive performance metric for serverless workloads — ask for a specific, measured overhead figure rather than a general 'minimal impact' claim.

• baselineRFPDetail historical trend reporting on serverless security posture (over-permissioned-function count trend, vulnerable-dependency trend) over time, suitable for demonstrating program maturity to leadership.weight 3
  Answer key — what a strong answer shows

  Trend-over-time reporting is a distinct capability from a per-function security check — confirm this exists as a maintained, exportable report.

• baselineRFIWhat is a customer-referenced onboarding timeline from contract signature to the platform providing genuinely useful, tuned protection across an existing, large serverless footprint spanning many functions and services?weight 3
  Answer key — what a strong answer shows

  Strong answers give a concrete, customer-validated timeline for a realistic existing-footprint scenario (not a small greenfield deployment), and are honest about the customer-side configuration effort required.

These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.