Risk Assessment
CLARA
Cloud & AI Risk Assessment
Expert-led, complimentary assessments delivering actionable insights into cloud network and AI risk. Findings feed the Prisma AIRS 3.0 and Unit 42 conversations that follow.
Overview
Replace Assumptions with Evidence
CLARA is a complimentary suite of three expert-led assessments that validate your security posture and pinpoint weaknesses before adversaries exploit them.
Designed for Immediate Action
CLARA translates technical findings into business-risk context that empowers CISOs to align stakeholders — from technical teams to the board. Every assessment delivers quantified risk, prioritized protections, and a clear path forward based on actual exposure, not assumptions.
3
Expert-Led Assessments
Free
Complimentary for Customers
Actionable
Business-Risk Context Reports
Assessments
Three Assessment Pillars
Each pillar targets a critical dimension of cloud and AI security risk.
Cloud Network Risk Assessment
Discovers workloads and applications, maps the actual cloud perimeter and traffic patterns. Provides a real-time inventory of all cloud workloads, AI apps, agents, and models.
- Comprehensive workload discovery
- Traffic pattern analysis
- Eliminates blind spots
Cloud Firewall Benchmarking
Security Validation Report (SVR) showing blocked vs. allowed exploits. Tests AWS and Azure firewall efficacy with real-world attack simulations.
- SVR: blocked vs. allowed exploits
- AWS & Azure firewall testing
- Evidence-based ROI validation
AI Risk Assessment
Scans models and datasets for malicious scripts and tampering. Conducts red teaming exercises against live applications to identify prompt injections and data tampering. Findings map to Prisma AIRS 3.0, including the Portkey AI Gateway added May 29, 2026.
- Model & dataset scanning
- Red teaming live AI apps
- AI supply chain security
Outcomes
What CLARA Delivers
Concrete, measurable outcomes that drive security decisions — and a clean handoff into paid Unit 42 work.
Full Visibility
Complete visibility into cloud network and AI ecosystem — every workload, application, model, and data flow mapped and inventoried.
Empirical Validation
Third-party validation of firewall efficacy with real-world attack simulations. Evidence-based results, not vendor marketing claims.
Complete AI Ecosystem Assessment
Assessment of the complete AI ecosystem — models, training data, live applications, and agent behaviors — including red teaming and supply chain analysis.
Business-Risk Reporting
Business-risk context reports designed for CISOs and boards — translating technical findings into language that drives executive alignment and budget decisions.
Quantified Risk & Prioritized Protections
Quantified risk and prioritized protections based on actual exposure — not theoretical vulnerability scores. Every finding maps to a concrete remediation action ranked by real-world impact and exploitability. Where the AI findings are material, hand off to Unit 42: the External AI Hyperattack Assessment, or Frontier AI Defense (announced April 2026), whose Exposure Analysis, Autonomous Security Blueprint and Agentic Defense Transformation offers each include six months free of Cortex XDR, Cortex Xpanse and Koi.
Discovery
Discovery Questions
Use these questions to qualify and position a CLARA engagement.
Why ask: Most organizations overestimate their cloud visibility. CLARA's Cloud Network Risk Assessment discovers workloads, apps, and AI assets they didn't know existed.
Listen for: "We think we have good coverage" — opportunity to validate. "We have blind spots" — immediate CLARA fit. "We rely on CSP-native tools" — position cross-cloud discovery.
Why ask: AWS and Azure native firewalls often have significant efficacy gaps. The Cloud Firewall Benchmarking assessment provides objective, third-party SVR data.
Listen for: "No, we trust our CSP" — prime candidate. "We've done some testing" — offer the SVR as a more rigorous benchmark. "We use Palo Alto NGFW" — validate and reinforce ROI.
Why ask: AI security is the fastest-growing risk surface. Most organizations have deployed AI models without assessing their vulnerability to adversarial attacks.
Listen for: "We haven't tested that" — direct path to the AI Risk Assessment. "We're worried about it" — validate concerns with red teaming. "We don't use AI yet" — probe deeper; shadow AI is pervasive.
Why ask: CISOs increasingly need to communicate risk in financial and business terms. CLARA's reports are designed to bridge the gap between technical findings and executive decision-making.
Listen for: "We struggle with that" — CLARA's business-risk reporting is the differentiator. "The board asks but we show technical dashboards" — reframe with CLARA's executive-ready outputs.
Why ask: Cloud and AI environments change rapidly. An assessment from 6+ months ago may be significantly outdated. CLARA is complimentary, removing the budget objection.
Listen for: "Over a year ago" or "Never" — urgency driver. "We do annual pen tests" — position CLARA as complementary, focused on cloud and AI specifically. "It's free?" — close on scheduling.