In short: A CNAPP (cloud-native application protection platform) is a single platform that secures cloud infrastructure and applications from code to runtime. It combines cloud security posture management (CSPM), cloud workload protection (CWPP), cloud infrastructure entitlement management (CIEM) and code or pipeline scanning, then correlates the findings so teams fix the risks that matter first.
What a CNAPP is and why the category exists
For years, cloud security meant buying separate tools: one to check configuration, another to protect virtual machines, another to scan container images and another to review permissions. Each produced its own list of findings, and nobody could see that a publicly exposed virtual machine with a critical vulnerability and an over-privileged identity was far more dangerous than any of those three problems on its own.
A CNAPP joins those tools together. It builds a single inventory of your cloud estate, collects findings from each layer and links them, so it can show an attack path: the chain of weaknesses an attacker could follow from the internet to your sensitive data. That context is the main reason to buy a platform rather than separate point products.
CNAPPs are aimed at infrastructure you run in the public cloud (IaaS and PaaS). If your cloud use is mainly Microsoft 365 and other SaaS apps, the controls you need sit elsewhere: see Microsoft 365 security and CASB. Our guide to what is cloud security explains where the customer's responsibilities start under the shared responsibility model.
The building blocks
Most CNAPPs are made of the same components, though vendors package and name them differently:
| Component | What it does | Our guide |
|---|---|---|
| CSPM (cloud security posture management) | Continuously checks cloud accounts for misconfigurations, such as public storage, missing encryption or open management ports, and measures you against benchmarks | CSPM |
| CWPP (cloud workload protection) | Protects running virtual machines, containers, Kubernetes and serverless functions: vulnerabilities, malware and runtime threats | Cloud workload protection |
| CIEM (cloud infrastructure entitlement management) | Finds identities, roles and service accounts with more permissions than they use | See CSPM, CIEM and CNAPP |
| DSPM (data security posture management) | Discovers where sensitive data sits in cloud storage and databases and who can reach it | See data loss prevention |
| Code and pipeline security | Scans infrastructure-as-code templates, container images and repositories for misconfigurations, vulnerabilities and exposed secrets before deployment | See DevOps security in Defender for Cloud |
| Cloud detection and response | Detects attacker activity in cloud control-plane logs and workloads and feeds your SOC or MDR service | See MDR |
Newer platforms also add AI security posture management, which inventories AI services and models in your cloud and checks how they are configured and exposed. For staff use of public AI tools, see securing generative AI instead.
Do you need a CNAPP?
Not every organisation does. As a rough guide:
- A few virtual machines in one Azure subscription: start with the free posture checks in Microsoft Defender for Cloud, endpoint protection on the servers and a properly configured cloud firewall. A full CNAPP may be more than you need.
- Production workloads in more than one cloud, or containers and Kubernetes in use: a CNAPP becomes much easier to justify, because it gives one view and one set of priorities across AWS, Azure and Google Cloud.
- Developers deploying through pipelines: code and image scanning catches problems before they reach production, which is cheaper than fixing them afterwards.
- Regulated or audited environments: compliance reporting against frameworks such as CIS benchmarks and ISO 27001 controls cuts down manual evidence gathering for audits.
If you are not sure what you have running, the first step is an inventory, which is part of our cloud security assessment.
CNAPP options compared
These are the platforms we are asked about most often. The table describes how each works rather than ranking them.
| Platform | Approach | Clouds | Worth knowing |
|---|---|---|---|
| Microsoft Defender for Cloud | Free Foundational CSPM, paid Defender CSPM and per-workload protection plans; agentless scanning plus Defender for Endpoint on servers | Azure, AWS, Google Cloud, on-premises through Azure Arc | Natural fit for Azure-first organisations; alerts flow into Microsoft Defender XDR |
| CrowdStrike Falcon Cloud Security | Agentless visibility combined with the Falcon sensor; CSPM, CWPP, CIEM, ASPM, DSPM, AI-SPM and cloud detection and response | AWS, Azure, Google Cloud, Oracle Cloud | Same platform and console as CrowdStrike Falcon endpoint protection |
| SentinelOne Singularity Cloud Security | CSPM, Cloud Workload Security, CIEM, Cloud Data Security and AI-SPM, with Purple AI for investigation | Major public clouds | Extends SentinelOne Singularity from endpoints to cloud |
| TrendAI Vision One Cloud Security | Cloud Risk Management, Server and Workload Protection, Container Security, File Security and Code Security, licensed through Vision One credits or pay as you go | Hybrid and multicloud | Part of TrendAI Vision One (formerly Trend Vision One) |
Two products you may still have contracts for are changing. Check Point's CloudGuard CNAPP customers are being offered an assisted migration to Wiz under a partnership announced in February 2025: see Check Point CloudGuard CNAPP and the move to Wiz. Sophos Cloud Optix reached end of life on 30 September 2026: see the update on our CSPM page.
How to choose
We suggest weighing these points, roughly in this order:
- Where your workloads are. A mostly Azure estate gets a lot from Defender for Cloud before anything else is bought. Genuinely multicloud estates should test how each platform handles their second and third cloud, not just their main one.
- What you already run on endpoints and servers. If your servers already run CrowdStrike, SentinelOne or Defender for Endpoint, the same vendor's cloud module avoids a second agent and a second console.
- Agentless or agent-based. Agentless scanning (reading disk snapshots and cloud APIs) is quick to deploy and reaches workloads that have no agent. Runtime protection that blocks attacks still needs an agent or sensor on important workloads. Most organisations use both.
- Who will act on the findings. A CNAPP produces a lot of recommendations. Check that it prioritises well, assigns work to resource owners and integrates with your ticketing and your MDR or SOC.
- How it is priced. Billing is usually per protected resource (virtual machines, containers, databases or storage accounts), sometimes through credits. Ask us for a quote and we will model it against your real inventory.
How Forever Systems helps
We are independent, so we start with what you already own. Many Azure customers have Foundational CSPM switched on and nobody looking at it, and many organisations have their cloud provider's native security tools only half configured. We review your accounts, subscriptions and projects, show you the most serious risks and recommend whether native tools are enough or a CNAPP is justified.
If a platform is right, we help you trial two options against your own estate, roll out the winner in stages and tune it so the findings reach the people who can fix them. Contact us to talk through your cloud estate.
CNAPP guides
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between CNAPP and CSPM?
CSPM checks your cloud accounts for misconfigurations and compliance gaps. A CNAPP includes CSPM but adds workload protection, identity entitlement analysis, code and image scanning and threat detection, and correlates them so you can see attack paths rather than separate lists.
What is the difference between CNAPP and CWPP?
CWPP protects running workloads such as virtual machines, containers and serverless functions. It is one component of a CNAPP, which also covers configuration, identities, data and code.
Does a small business need a CNAPP?
Usually not at first. If you run a handful of servers in one cloud, free posture checks, good endpoint protection on the servers and a properly configured firewall cover most of the risk. A CNAPP becomes worthwhile with several clouds, containers, development pipelines or regulatory reporting needs.
Is Microsoft Defender for Cloud a CNAPP?
Yes. Microsoft describes Defender for Cloud as a CNAPP with three core parts: cloud security posture management, DevOps security and cloud workload protection. It covers Azure, AWS, Google Cloud and on-premises machines connected through Azure Arc.
Do CNAPPs need agents?
Most use agentless scanning for visibility, posture and vulnerability assessment, and an agent or sensor for real-time runtime protection on important workloads. Using both gives coverage of everything plus active blocking where it matters.