Do I Still Need Imunify360 If I Have Cloud Hosting?

Customers migrating workloads to cloud infrastructure frequently ask whether they still need host-level security tools like Imunify360. The assumption is straightforward: if the cloud provider handles security, why pay for additional protection?

The answer depends on understanding what Imunify360 actually protects versus what cloud infrastructure provides. These are complementary security layers, not competing solutions. Infrastructure-level security protects the platform your server runs on. Host-level security protects what runs inside your server.

This distinction matters because attackers target both layers. A cloud provider's firewall blocks unauthorized network access, but it cannot detect malware uploaded through a legitimate WordPress plugin vulnerability. Security groups control which ports are open, but they cannot scan PHP files for malicious code injection.

What is Imunify360?

Imunify360 is a comprehensive security suite designed for Linux servers, particularly those running web hosting control panels like cPanel, Plesk, and DirectAdmin. CloudLinux developed it as an integrated defense platform that combines multiple security functions into a single product.

Malware Scanning and Cleanup continuously monitors files for known malicious signatures, suspicious patterns, and unauthorized modifications. When threats are detected, automatic cleanup removes malicious code without disrupting legitimate functionality.

Web Application Firewall (WAF) analyzes HTTP traffic and blocks attacks targeting web applications. This includes SQL injection, cross-site scripting, remote file inclusion, and other OWASP Top 10 vulnerabilities.

Intrusion Detection System (IDS) monitors system activity for indicators of compromise. This includes unauthorized file changes, suspicious processes, anomalous network connections, and privilege escalation attempts.

Intrusion Prevention System (IPS) goes beyond detection to actively block attack sources. IP addresses exhibiting malicious behavior are automatically added to firewall blocklists before they can cause damage.

Brute Force Protection monitors authentication attempts across SSH, FTP, email, and web application logins. Accounts or IP addresses exceeding threshold limits are temporarily or permanently blocked.

PHP Hardening restricts dangerous PHP functions and behaviors that attackers commonly exploit. This reduces the attack surface without breaking legitimate applications.

Reputation Management tracks whether server IP addresses appear on email blocklists or security databases. Early detection allows remediation before deliverability or search rankings suffer.

Patch Management provides kernel-level security updates through KernelCare integration, allowing live patching without server reboots.

Proactive Defense uses behavioral analysis to detect zero-day attacks by identifying actions that match attack patterns, even when specific malware signatures are unknown.

Feature-by-Feature Evaluation

Malware Detection

What Imunify360 Provides: Real-time file scanning with signature-based and heuristic detection. Monitors uploads, file modifications, and scheduled scans of the entire filesystem. Detects web shells, backdoors, cryptocurrency miners, and malicious scripts injected into legitimate files.

What Cloud Infrastructure Provides: Cloud providers do not scan files inside your instances. Infrastructure security focuses on network perimeter and hypervisor isolation. The cloud platform has no visibility into what files exist on your virtual machine or what code your applications execute.

Recommendation: Any server hosting websites, applications, or accepting file uploads needs malware detection. Cloud hosting does not provide this capability. Deploy Imunify360 or an equivalent solution like ClamAV, rkhunter, or commercial alternatives.

Malware Cleanup

What Imunify360 Provides: Automatic remediation that removes malicious code while preserving legitimate file content. Understands common CMS structures and can clean injected code from WordPress, Joomla, and Drupal core files without breaking functionality.

What Cloud Infrastructure Provides: No cleanup capability. If malware is detected through external scanning or behavioral indicators, remediation is entirely the customer's responsibility.

Recommendation: For hosting environments where customers upload files and install plugins, automated cleanup reduces incident response time from hours to minutes. Manual cleanup requires expertise and time that most teams lack during active incidents.

Web Application Firewall

What Imunify360 Provides: Application-layer inspection that understands HTTP semantics. Blocks SQL injection even when attackers use encoding tricks. Stops cross-site scripting before malicious JavaScript reaches browsers. Provides virtual patching for known CMS vulnerabilities.

What Cloud Infrastructure Provides: Cloud firewalls operate at layers 3 and 4 (network and transport). They control which IP addresses can reach which ports. They cannot inspect HTTP request content or understand application logic. Some cloud providers offer separate WAF services at additional cost.

Recommendation: Any public-facing web application needs a WAF. If your cloud provider offers WAF as a service, evaluate whether it provides sufficient rule coverage for your application stack. If not, deploy a host-level WAF through Imunify360, ModSecurity, or a dedicated reverse proxy.

Intrusion Detection

What Imunify360 Provides: System-level monitoring for file integrity, process activity, and authentication events. Correlates indicators across multiple data sources to identify attack campaigns. Integrates with hosting control panels to provide per-account visibility.

What Cloud Infrastructure Provides: Cloud providers monitor infrastructure health and may detect certain attack patterns at the network level. However, visibility into guest operating system activity is limited by design. Your cloud provider cannot see what processes are running inside your instance.

Recommendation: Host-level IDS remains necessary for detecting attacks that occur inside your server. Cloud-level monitoring complements but does not replace this capability.

Intrusion Prevention

What Imunify360 Provides: Automated response that blocks attacking IP addresses at the host firewall. Integrates with fail2ban-style functionality but with tighter integration to the detection engine. Can share blocklists across multiple servers.

What Cloud Infrastructure Provides: Security groups and network ACLs provide manual blocking capability. Some providers offer managed IPS services that detect and block network-based attacks. These operate at the infrastructure perimeter, not inside your server.

Recommendation: Deploy both layers. Cloud IPS blocks attacks before they reach your server. Host IPS blocks attacks that bypass network controls or originate from allowed sources.

Brute Force Protection

What Imunify360 Provides: Protocol-aware monitoring for SSH, FTP, SMTP, POP3, IMAP, and web application logins. Understands cPanel, WordPress, and other common authentication endpoints. Applies intelligent rate limiting that distinguishes between legitimate users and automated attacks.

What Cloud Infrastructure Provides: No application-level authentication monitoring. Security groups can limit which IP addresses connect to SSH, but cannot detect password guessing once a connection is established.

Recommendation: Essential for any server with public authentication endpoints. Deploying strong SSH keys and disabling password authentication reduces risk but does not eliminate it. Web applications with login forms remain vulnerable without brute force protection.

PHP Hardening

What Imunify360 Provides: Runtime restrictions on dangerous PHP functions and behaviors. Blocks common exploit techniques like remote file inclusion, code execution through dynamic function calls, and directory traversal attacks. Works transparently without requiring application modifications.

What Cloud Infrastructure Provides: No PHP-specific protections. Cloud providers do not manage or secure application runtimes.

Recommendation: Critical for shared hosting environments and any server running third-party PHP applications. WordPress installations in particular benefit from hardening against the constant stream of plugin vulnerabilities.

Reputation Management

What Imunify360 Provides: Monitors email blocklists, search engine safe browsing databases, and security feeds. Alerts when server IP addresses appear on lists that affect deliverability or visibility. Provides remediation guidance.

What Cloud Infrastructure Provides: Cloud providers may monitor their IP reputation at the network level and take action against customers causing abuse. However, this monitoring protects the provider's reputation, not necessarily your specific workload.

Recommendation: Any server sending email or hosting public websites benefits from reputation monitoring. Early detection of blocklist inclusion allows remediation before business impact occurs.

Patch Management

What Imunify360 Provides: Integration with KernelCare for live kernel patching without reboots. Reduces the window of vulnerability exposure and eliminates downtime associated with kernel updates.

What Cloud Infrastructure Provides: Cloud providers patch the hypervisor and underlying infrastructure. Guest operating system patching remains entirely the customer's responsibility unless managed services are included.

Recommendation: Operating system patching is mandatory regardless of hosting environment. KernelCare or similar live patching reduces operational burden but does not eliminate the need for regular update cycles.

Proactive Defense

What Imunify360 Provides: Behavioral analysis that detects attacks based on execution patterns rather than signatures. Identifies compromised PHP scripts attempting privilege escalation, data exfiltration, or lateral movement. Stops zero-day attacks that signature-based detection misses.

What Cloud Infrastructure Provides: No behavioral analysis inside guest instances. Infrastructure monitoring may detect anomalies in network traffic patterns but cannot observe application-level behavior.

Recommendation: Proactive defense provides significant value against novel attacks. Traditional signature-based detection requires someone to discover and document an attack before protection exists.

Hosting Account Isolation

What Imunify360 Provides: Integrates with CloudLinux CageFS to provide per-account isolation on shared hosting servers. Prevents compromised accounts from accessing other customers' files or system resources.

What Cloud Infrastructure Provides: Each virtual machine is isolated by the hypervisor. This is stronger isolation than CageFS provides on shared hosting. However, within a single VM running multiple websites, no cloud-level isolation exists between those sites.

Recommendation: Account isolation matters primarily for shared hosting and reseller environments. Single-tenant cloud VMs benefit from hypervisor isolation but still need internal isolation if hosting multiple untrusted workloads.

Infrastructure Security vs Host Security

Understanding the boundary between infrastructure and host security clarifies why both layers matter.

Infrastructure protections include:

• Physical security of data centers
• Hypervisor isolation between virtual machines
• Network security including DDoS mitigation
• Storage redundancy and encryption at rest
• Security groups and firewall rules
• VLAN isolation between tenants

Host protections include:

• Malware scanning and removal
• File integrity monitoring
• Authentication and access control
• Web application firewall
• Operating system hardening
• Application-specific security

These layers complement rather than replace each other. A perfectly secured infrastructure cannot prevent a WordPress plugin vulnerability from compromising your site. A perfectly secured host cannot prevent a network attack that overwhelms your cloud provider's edge network.

Defense in depth means deploying protection at every layer where attacks can occur. Removing any layer increases overall risk even if other layers remain strong.

Who Should Keep Imunify360?

Certain workloads strongly benefit from comprehensive host-level security:

cPanel and Plesk Servers run multiple websites with varying security postures. End users install plugins, upload files, and create vulnerabilities that require constant monitoring and remediation.

Shared Hosting Providers concentrate many tenants on single servers. One compromised account can affect all others without proper isolation and monitoring.

WordPress Hosting faces continuous attacks against a well-understood platform. The combination of plugin vulnerabilities, weak passwords, and automated attack tools makes comprehensive protection essential.

Multi-Tenant Environments including reseller hosting and agency deployments need visibility and control across multiple customer accounts.

Managed Hosting Providers offering security as a value-added service need integrated tools that scale across their fleet.

Who May Not Need Imunify360?

Some workloads have alternative security models that reduce or eliminate the need for traditional host-level security:

Internal Applications that never face internet traffic have reduced attack surface. Security focuses on access control and authentication rather than public attack defense.

Private Cloud Workloads running behind VPNs or zero-trust network access have different threat models than public web servers.

Container Environments use immutable images that are rebuilt rather than patched. Runtime security tools designed for containers replace traditional host scanning.

Kubernetes Clusters have purpose-built security tools including admission controllers, network policies, and runtime protection that operate at the orchestration layer.

Immutable Infrastructure where servers are replaced rather than modified eliminates the persistence that traditional malware requires. Attackers cannot maintain access when infrastructure is continuously recreated.

Appliances and Single-Purpose Servers with minimal attack surface and no user-modifiable content may have acceptable risk without comprehensive scanning.

Comparison Table

The InMotion Cloud Alternative: Transparent, Predictable Pricing

The question of whether to deploy Imunify360 ultimately connects to a larger question about how you manage security across your infrastructure. Hyperscaler platforms often push customers toward their proprietary security services with complex, usage-based pricing that makes costs difficult to predict.

InMotion Cloud takes a different approach. Transparent pricing based on actual resource consumption means you can budget accurately for both infrastructure and the security tools you deploy on top of it. There are no hidden fees for network traffic, no surprise charges for security service API calls, and no artificial complexity designed to obscure true costs.

When you deploy infrastructure on InMotion Cloud, you retain full control over your security stack. Run Imunify360, ClamAV, or any host-level security tool without worrying about compatibility issues or vendor lock-in. Combine host-level protection with InMotion Cloud's infrastructure security including DDoS mitigation, security groups, and network isolation.

The result is layered defense with predictable costs. You know exactly what your infrastructure costs and can make informed decisions about which additional security tools provide appropriate value for your specific workloads.

Conclusion

Imunify360 and cloud infrastructure security address different threat vectors. Imunify360 protects the operating system and applications running inside your server. Cloud infrastructure protects the platform your server runs on and the network it connects to.

For public-facing Linux servers, especially those running web hosting control panels or shared hosting environments, using both together provides defense in depth. The cloud platform blocks network attacks while Imunify360 handles the malware, exploits, and configuration vulnerabilities that exist inside your applications.

The decision depends on your specific workload. Servers hosting multiple websites with user-uploaded content need comprehensive scanning. Immutable containers deployed through CI/CD pipelines may have alternative security models. Understanding what each layer protects helps you make informed decisions about where to invest your security budget.

Whether you deploy Imunify360 or alternative tools, the principle remains constant: infrastructure security and host security are complementary layers, not competing solutions.