Safety Detectives Interview

This interview of Safety Detectives is reprinted here with permission.

Toni de la Fuente, CEO of Prowler, is revolutionizing cloud security through transparency and community-driven solutions. From launching Prowler as an open-source side project to leading a global platform for cloud security auditing, Toni’s journey is rooted in simplifying complex challenges for organizations. In this SafetyDetectives Q&A, Toni shares Prowler’s unique approach to securing multi-cloud environments, the future of cloud security, and practical advice for organizations transitioning to the cloud.

Can you tell us about your journey and how you became involved with Prowler as its CEO?

In 2016, I was working in cloud security and constantly running into the same issue: tools for securing cloud environments were either too complicated, too opaque, or just didn’t exist for what I needed. I built Prowler as an open-source side project to solve a specific problem—auditing AWS environments for misconfigurations. What started as a weekend project quickly snowballed. Other engineers started using it, suggesting features, and contributing code. It was clear we’d tapped into something much bigger.

It was a long journey to becoming CEO – in 2023 we raised our seed round of funding and by the landscape it was clear Prowler was ready for the next step. What drives me today is the same thing that motivated me back then—making cloud security simpler, more accessible, and rooted in community collaboration.

What are the Prowler flagship services, and how does it differentiate itself from other cloud security auditing tools on the market?

Prowler offers comprehensive cloud security auditing and compliance across AWS, GCP, Azure, and Kubernetes—all from one platform. Our flagship service isn’t just the tool itself; it’s the philosophy of Open Cloud Security.

What makes Prowler different is its transparency and adaptability. We’re open source, which means you’re not locked into a black box. You can see exactly what our security checks are doing, tailor them to your specific needs, and even contribute your own. We also focus on compliance frameworks out of the box, helping teams achieve certifications like SOC 2, ISO 27001, and more.

Another key differentiator is community. Most security tools give you what the vendor thinks you need. With Prowler, you’re part of a global network of contributors and users. Every new feature or improvement comes from solving real problems faced by teams in the field. This makes Prowler more agile and practical than traditional tools.

As cloud adoption accelerates, what do you see as the biggest challenges facing organizations in maintaining cloud security?

One of the biggest challenges is complexity. As organizations grow their cloud footprints, they often end up with sprawling environments that are difficult to monitor and secure. Misconfigurations, exposed secrets, and overly permissive access controls are some of the most common issues we see.

Another challenge is the speed of change. Threats in the cloud evolve daily, and security teams often struggle to keep up. Traditional tools can’t match the agility of modern cloud environments, leaving teams to fill the gaps themselves.

Finally, there’s the human factor. Security isn’t just a technical problem; it’s also cultural. Many organizations still treat security as an afterthought or something owned solely by the IT department. The truth is, maintaining cloud security requires collaboration across engineering, operations, and leadership teams. That’s why Prowler doesn’t just provide tools—it is building a community to share knowledge, best practices, and support.

How do you see the future of cloud security shaping up, especially with the rise of multi-cloud and hybrid environments?

The future of cloud security is about integration and collaboration. Multi-cloud and hybrid environments are no longer the exception—they’re the rule. Organizations need tools that can span these diverse ecosystems without creating more silos or adding unnecessary complexity.

I believe the next wave of cloud security will focus on unified platforms that provide a single view of an organization’s security posture. These tools will offer real-time insights, automated remediation and suggestions at different points of the pipeline, and compliance tracking across environments.

Another trend is the shift toward transparency. As organizations demand more control over their security, Open Source tools like Prowler will play a key role in shaping how security is managed. Transparency builds trust, and trust will be a cornerstone of cloud security in the future.

How do you see the role of security auditing tools like Prowler in the context of hybrid or multi-cloud environments?

Security auditing tools are becoming the connective tissue that ties together hybrid and multi-cloud environments. In these setups, no single provider or solution can address all the security needs. Tools like Prowler bridge the gap by providing a unified platform where teams can audit, monitor, and remediate issues across AWS, GCP, Azure, and Kubernetes.

The key is adaptability. Hybrid and multi-cloud environments are constantly changing. Prowler’s open-source model ensures that it evolves alongside those changes, with new checks and features driven by the needs of the community.

What advice would you give to organizations looking to transition from traditional on-premise infrastructure to the cloud while maintaining robust security?

First, get clarity on your cloud provider’s shared responsibility model. It’s essential to understand what your provider secures versus what you’re responsible for.

Next, start small. Begin with a pilot project or a single workload to understand the risks and best practices for your environment. Use tools like Prowler to automate security checks and ensure you’re starting off on the right foot.

Finally, make security a shared priority. Cloud security isn’t just a technical issue—it’s a team effort. Train your developers, engage your leadership, and encourage collaboration between teams. Joining communities like the Open Cloud Security movement can also help you learn from others who’ve made the transition successfully.