A Prisma Cloud Administrator onboarded an AWS cloud account with agentless scanning enabled successfully to Prisma Cloud. Which item requires deploying defenders to be able to inspect the risk on…

Host vulnerability risks are detected by agentless scanning through snapshot analysis of installed packages and OS components, so Defenders are not required for this capability.

Container vulnerability risks (CVEs in image layers) are identified by agentless scanning by inspecting container image content on disk, not requiring Defenders.

Container runtime risks - such as anomalous process execution, unexpected network connections, and filesystem changes - can only be detected by a Defender running inside or alongside the container at runtime. Agentless scanning reads disk snapshots and does not have visibility into live runtime behavior. Therefore, even with agentless scanning enabled, Defenders must be deployed to inspect container runtime risks.

Host compliance risks are assessed by agentless scanning by evaluating host configuration against CIS benchmarks from the disk snapshot, so Defenders are not required.