What is CNAPP?

What CNAPP is

A Cloud-Native Application Protection Platform (CNAPP) is a unified security solution that combines cloud posture management, workload protection, identity security, and vulnerability scanning into a single integrated platform. Gartner coined the term in 2021 to describe the convergence of several previously separate cloud security categories.

The problem CNAPP solves is tool sprawl. Before CNAPP existed, securing a cloud environment meant buying and managing separate products for infrastructure misconfiguration (CSPM), workload protection (CWPP), identity management (CIEM), container security, IaC scanning, and vulnerability assessment. Each tool had its own dashboard, its own alert format, and its own blind spots. Security teams drowned in alerts with no way to connect a misconfigured IAM role to a vulnerable container running in a public-facing subnet.

CNAPP puts all of that context into one platform. A single risk graph connects infrastructure misconfigurations, vulnerable software, overly permissive identities, and exposed network paths. Instead of investigating six separate tools to understand one attack path, security teams see the full picture in a single view.

The market has grown rapidly. Wiz, Palo Alto Networks Prisma Cloud, and Orca Security are among the leaders. Nearly every major security vendor now offers or is building a CNAPP product.

Core components

CNAPP brings together several security capabilities that used to live in separate products. Understanding each component helps you evaluate what a specific CNAPP platform does well and where it has gaps.

CSPM (Cloud Security Posture Management)

CSPM continuously monitors cloud infrastructure for misconfigurations: publicly accessible storage buckets, overly permissive security groups, unencrypted databases, disabled logging. It compares your actual cloud configuration against best-practice benchmarks like CIS and against compliance frameworks like PCI DSS, HIPAA, and SOC 2. For a detailed comparison of standalone CSPM and integrated CNAPP platforms, see our CSPM vs CNAPP guide.

CWPP (Cloud Workload Protection Platform)

CWPP protects the workloads running in your cloud: virtual machines, containers, and serverless functions. It handles vulnerability scanning, malware detection, runtime threat detection, and integrity monitoring. CWPP answers the question: “Is anything bad running inside my workloads?”

CIEM (Cloud Infrastructure Entitlement Management)

CIEM analyzes identity and access permissions across cloud environments. It finds overly permissive roles, unused service accounts, cross-account access risks, and privilege escalation paths. In most cloud breaches, excessive permissions are a contributing factor, and CIEM addresses that directly.

Additional capabilities

Most CNAPP platforms also include:

How CNAPP works

CNAPP platforms typically use two approaches to gain visibility into your cloud environment: agentless scanning and agent-based monitoring.

Agentless scanning connects via cloud provider APIs and reads configuration data, snapshots, and metadata without installing anything on your workloads. This gives broad visibility with minimal deployment effort. Most CNAPP platforms start here. Wiz popularized the agentless-first approach and demonstrated that you can get deep visibility, including vulnerability scanning of running workloads, without installing agents.

Agent-based monitoring installs lightweight agents on workloads for real-time runtime protection, file integrity monitoring, and process-level visibility. Agents provide deeper runtime context but require deployment and maintenance.

Most modern CNAPP platforms use both: agentless for broad posture assessment and agents for runtime protection where needed.

The data from both approaches feeds into a unified risk graph. This graph maps relationships between cloud resources: which compute instances run which containers, which identities can access which storage, which network paths are exposed to the internet. When the platform finds a vulnerability in a container image, it checks whether that container is actually running, whether it is internet-facing, whether the identity associated with it has access to sensitive data, and whether there is a known exploit. That multi-factor analysis is what separates CNAPP from individual scanners.

CNAPP vs point solutions

The case for CNAPP over individual tools comes down to context and operational efficiency:

The tradeoff is depth. A dedicated CSPM product may have deeper coverage of cloud provider-specific misconfigurations than the CSPM component inside a CNAPP. Similarly, a specialized container security tool may detect more runtime anomalies than a CNAPP’s CWPP module. Organizations with very specific requirements in one area sometimes keep a specialized tool alongside their CNAPP.

Top CNAPP tools

The CNAPP market is one of the most competitive in security. Here are the platforms worth evaluating:

• Wiz — The fastest-growing CNAPP vendor. Agentless-first architecture that gained adoption for its speed of deployment and unified risk graph. Named a Leader in the 2025 IDC MarketScape for CNAPP. Strong across CSPM, CWPP, CIEM, DSPM, and container security. Now owned by Google Cloud following the 2025 acquisition.

• Orca Security — Agentless cloud security platform that covers CSPM, CWPP, CIEM, and DSPM. The SideScanning technology reads workload data directly from cloud provider block storage without agents. Strong for organizations that want deep visibility without any agent deployment.

• Prisma Cloud — Palo Alto Networks’ CNAPP offering. One of the broadest platforms covering code-to-cloud security, including CSPM, CWPP, CIEM, IaC scanning, API security, and runtime defense. Benefits from integration with the broader Palo Alto security ecosystem.

• Lacework — Acquired by Fortinet in 2024. Uses behavioral analytics and anomaly detection for cloud workload protection. The Polygraph technology builds baselines of normal cloud behavior and alerts on deviations. Strong for runtime detection and compliance automation.

Each of these platforms takes a slightly different approach. Wiz and Orca emphasize agentless breadth. Prisma Cloud emphasizes depth across the full lifecycle. Lacework emphasizes behavioral detection. The right choice depends on your cloud footprint, your team’s priorities, and how much you value agentless simplicity versus agent-based depth.

Getting started

Deploying CNAPP involves both technical setup and organizational preparation. Here is a practical path:

Map your cloud footprint. List every cloud account, subscription, and project across all providers. Note which environments are production versus development. CNAPP pricing and prioritization both depend on this inventory.

Connect cloud accounts. Most CNAPP platforms connect via read-only IAM roles or service principals. The initial connection gives agentless visibility within hours, not weeks. Start with production accounts to see the highest-risk findings first.

Triage the initial findings. The first scan of any cloud environment produces hundreds or thousands of findings. Focus on critical and high severity findings that affect production, internet-facing resources with known exploits, overly permissive identities with access to sensitive data, and unencrypted storage containing sensitive information.

Establish ownership. Assign cloud accounts and workloads to engineering teams. Without clear ownership, findings sit in a backlog with no one accountable. Most CNAPP platforms support integration with your organizational structure.

Integrate with development workflows. Connect the CNAPP platform to your CI/CD pipeline for IaC scanning and container image scanning. Shift findings left so that misconfigurations are caught before deployment. Integrate with Slack, Jira, or your ticketing system for remediation tracking.

Deploy agents selectively. If your CNAPP offers agent-based runtime protection, start with production workloads that handle sensitive data or face the internet. You do not need agents everywhere on day one.

FAQ

Frequently Asked Questions

Written by

Suphi Cankurt

Suphi Cankurt is an application security enthusiast based in Helsinki, Finland. He reviews and compares 129 AppSec tools across 10 categories on AppSec Santa. Learn more.