Cloud-Native Application Protection Platforms

Cloud IaaS accelerates application development and modernization by eliminating capital expenditure and reducing procurement delays, but it also intensifies security and compliance challenges. Security in cloud environments is a shared responsibility: cloud service providers secure the underlying service and infrastructure, while customers must secure everything “above” the service layer, including configurations, identities, workloads, networks, and—critically—regulatory compliance for the data they process. The rise of containers and microservices adds complexity because container images are portable and reusable across environments, and workloads are ephemeral and scale rapidly. Traditional security tools and static image scanning alone are inadequate for this dynamic, short-lived runtime model.

Most attacks exploit known vulnerabilities, many of which stem from misconfiguration. Because cloud resources are transient, organizations must enforce policies that ensure resources are created securely by default, not merely scanned after deployment. A frequent high-impact mistake is granting external public access to cloud-hosted data. Identity and access governance is foundational: administrative privileges are prime targets (“keys to the kingdom”), and access entitlements for both humans and software-defined components must be controlled to prevent excessive permissions. Cloud-native security further spans many teams—developers, operations, cloud engineers, security, incident response, auditors, and legal—whose competing goals demand integrated workflows and automation.

Cloud-Native Application Protection Platforms (CNAPP) address these issues by unifying capabilities previously delivered as separate tools: CSPM (posture/misconfiguration visibility), CWPP (runtime workload protection), CIEM (entitlement governance), often CSNS (in-cloud network security), and increasingly CDSPM (data security posture). Key CNAPP use cases include DevSecOps (“shift left”), Kubernetes security monitoring for ephemeral activity, secure lift-and-shift workload migration, multi-cloud compliance reporting, and cloud-specific cyber risk management aligned to best practices and frameworks (including Complementary User Entity Controls). Selection criteria emphasize multi-environment coverage, entitlement discovery, storage/network/compute/container/application security, continuous posture management, strong integrations via APIs, and rigorous vendor evaluation through targeted RFP questions.

• Cloud IaaS is widely used to develop new applications and reengineer existing ones.
• Cloud services reduce capital expenditure and avoid lengthy hardware procurement delays.
• Customers do not manage the underlying cloud infrastructure but are responsible for everything above the provided service.
• Customers remain responsible for compliance with laws and regulations governing their data processing.
• Container images bundle application code and required dependencies into portable images deployable across environments.
• Containerized and microservice-based applications challenge traditional security tools due to scale and ephemeral workloads.
• Many vulnerabilities are caused by misconfiguration and can be avoided through best practices.
• Excessive entitlements in software-defined infrastructure can be exploited by threat actors.
• Kubernetes is used broadly to manage containerized workloads and is often consumed as a managed CSP service.
• CNAPP solutions are delivered as SaaS, and most vendors use public IaaS providers across multiple data centers.

• “Cloud-Native Application Protection Platforms (CNAPP) are intended to reduce complexity by helping organizations using multiple cloud services to identify and manage the risks for which they have responsibility.”
• “Static security products that focus on identifying vulnerabilities and malware in container images, while serving a useful purpose, do not address the full range of potential risks.”
• “The ephemeral nature of cloud resources means that it is not sufficient to scan for vulnerabilities it is essential to use policies that ensure that resources are automatically created using best practices.”
• “Cloud administrative access rights are a prime target of cyber adversaries since they provide the keys to the kingdom.”
• “What further differentiates cloud-native security as a discipline within the larger scope of cybersecurity is that it spans multiple organizational units and teams, which often have conflicting goals and requirements.”
• “Thus, the primary challenge for vendors creating cloud-native security solutions is making sure that all these various technologies can operate together, fully automated and at the cloud scale, considering the ephemeral and stateless nature of containers that differentiates them from traditional endpoints.”
• “Sometimes referred to as ‘Shift Left’, the DevSecOps practice is, in fact, about integrating security into the entire lifecycle of software development, from design to operations.”
• “The requirement is to be able to discover and monitor the security of all ephemeral activities within Kubernetes environments.”
• “The CSP is responsible for the security of the service that they provide and its infrastructure. The cloud customer is responsible for securing how they use the service.”
• “Organizations using cloud services to develop and deploy business applications must ensure that this is done in a way that meets their cyber risk appetite and regulatory obligations.”