CNAPP & CSPM: from isolated finding to attack path

CSPM (Cloud Security Posture Management) continuously checks cloud configurations against policies and benchmarks, uncovering misconfigurations and compliance deviations. CWPP (Cloud Workload Protection Platform) protects the workloads themselves – virtual machines, containers and serverless functions – through vulnerability analysis and runtime monitoring. CIEM (Cloud Infrastructure Entitlement Management) inventories cloud identities along with their permissions and enforces the least-privilege principle. KSPM applies the posture concept to Kubernetes clusters; DSPM (Data Security Posture Management) locates sensitive data in cloud storage and assesses its exposure.

Instead of running CSPM, CWPP, CIEM and vulnerability scanners separately, a CNAPP integrates these functions into a single platform with a shared data model – from code through the pipeline to runtime. A 2023 Cloud Security Alliance survey of 1,201 IT and security leaders shows how widespread the approach has become: three out of four organizations had already adopted a CNAPP or were planning to do so – above all to master the complexity of their multi-cloud environments. The hyperscalers, too, now explicitly position their security suites as CNAPPs, for example Microsoft Defender for Cloud with its CSPM, DevSecOps and CWPP building blocks.

Agentless approaches read configurations and workload snapshots via the cloud providers' APIs: they achieve near-complete coverage in a short time, even for workloads on which no agent was ever installed. Their limitation: they deliver point-in-time snapshots and can neither detect nor block runtime attacks in real time. Agent-based sensors, by contrast, provide runtime telemetry for detection and response, but create rollout and operational overhead. In practice, the combination has prevailed – agentless baseline coverage for visibility and posture, complemented by lightweight sensors on critical workloads; this is the model followed by Wiz, with agentless scanning plus an optional runtime sensor, and likewise by Microsoft Defender for Cloud.

Traditional point tools produce long lists of unconnected findings; in the CSA survey, 32 percent of organizations said they were unable to prioritize security measures because of the flood of often imprecise alerts. CNAPPs counter this with graph analysis: resources, misconfigurations, vulnerabilities, identities, network exposure and data classification are modeled as an interconnected graph. This makes toxic combinations visible – for instance an internet-exposed VM with a critical vulnerability and a highly privileged role – and attack paths show which routes attackers could actually take to reach critical assets. Prioritization is thus based not on individual severity but on real-world exploitability.

A CNAPP starts before deployment: IaC scanning checks Terraform, ARM or Kubernetes manifests in the CI/CD pipeline for misconfigurations and exposed secrets, so findings get fixed where they originate – in the code. At the same time, cloud context helps determine which code findings are even relevant in production. At the other end of the lifecycle are runtime protection and Cloud Detection & Response (CDR), which detect active threats in running workloads. That container security must cover the entire lifecycle from image through registry and orchestration to runtime is already described in the NIST guide SP 800-190.

Key criteria include coverage of your own environment (cloud providers, Kubernetes, serverless, on-premises where applicable), the scanning architecture (agentless plus sensor), the quality of graph analysis and attack paths, compliance mappings to frameworks such as the CIS Benchmarks or the BSI C5 catalogue, and integrations with SIEM, ticketing and developer workflows. Equally important is the operating model: without defined responsibilities for remediating findings, even the best platform remains ineffective. Add to this vendor risk, as the CNAPP market is consolidating – in March 2026, Google completed its acquisition of Wiz for around 32 billion US dollars. It is therefore advisable to regularly verify feature parity across all clouds in use and to address switching costs and multi-cloud neutrality contractually.