CNAPP

How it works

CNAPP (Cloud-Native Application Protection Platform) consolidates cloud security tools that used to be sold and operated separately: CSPM for misconfigured cloud resources, CWPP (Cloud Workload Protection Platform) for runtime protection on containers and VMs, CIEM (Cloud Infrastructure Entitlement Management) for over-permissioned IAM roles, and IaC scanning that checks Terraform or CloudFormation before it ever deploys. One platform ingests findings from all four and correlates them, so instead of four separate alert queues you get one graph showing, for example, that an internet-facing VM has both a critical CVE and an over-permissioned role attached to sensitive data. Wiz, Palo Alto Prisma Cloud, and Orca Security are the vendors that built the category.

When it matters

CNAPP matters once a team is running production workloads across multiple cloud accounts and the four separate tools (posture, workload, entitlements, IaC) start producing more noise than signal because nothing correlates the findings. A small team on a single AWS account with a handful of services doesn't need it; a CSPM tool alone covers most of the risk at a fraction of the cost. Skip consolidation too long, though, and security teams end up triaging thousands of disconnected low-severity findings with no sense of which combination is actually exploitable.

Common misconceptions

• "CNAPP replaces [CSPM](/glossary/cspm/)." CSPM is one of the four pillars CNAPP consolidates, not something it makes obsolete; you're still buying CSPM capability, just bundled.
• "CNAPP is only for containers." CWPP covers containers and Kubernetes, but CNAPP's other pillars (CSPM, CIEM, IaC scanning) apply just as much to VMs and serverless.
• "More correlated findings means less work." Correlation reduces noise, it doesn't eliminate the need for someone to actually remediate the graph a CNAPP surfaces.