In short: Cloud workload protection (CWPP) secures the compute you run in the cloud: virtual machines, containers, Kubernetes clusters and serverless functions. It finds vulnerabilities and malware, hardens configurations and detects and blocks threats at runtime, using an agent or sensor on the workload, agentless snapshot scanning, or both.
What CWPP protects
Cloud providers secure the hardware and hypervisor, but everything inside a virtual machine or container image is your responsibility. CWPP covers that layer:
| Workload | Main risks | What CWPP adds |
|---|---|---|
| Virtual machines and cloud servers | Unpatched software, malware, ransomware, stolen credentials, lateral movement | EDR or anti-malware on the server, vulnerability assessment, file integrity monitoring, just-in-time access to management ports |
| Container images | Vulnerable packages and secrets baked into images | Image scanning in registries and pipelines, with policies that stop vulnerable images being deployed |
| Kubernetes clusters | Misconfigured clusters, privileged containers, exposed dashboards | Cluster posture checks, admission control and runtime detection on nodes |
| Running containers | Container escape, crypto mining, reverse shells | Behavioural runtime detection and response |
| Serverless functions | Over-privileged roles, vulnerable dependencies | Function inventory, permission and dependency checks |
CWPP is one part of a CNAPP; the configuration side is covered by cloud security posture management.
Agent, sensor or agentless?
There are two ways to see inside a workload, and most organisations end up using both.
Agentless scanning reads disk snapshots and cloud APIs from outside the workload. It is quick to switch on, reaches virtual machines that have no agent (including ones nobody knew about), and runs nothing inside the workload itself. It is ideal for inventory, vulnerability assessment, malware scanning and secrets discovery, but it cannot stop an attack while it is happening.
Agents or sensors run on the server, or as a daemon on each Kubernetes node. They see processes, network connections and file activity in real time, so they can detect and block an attack and give your MDR service the data it needs to respond.
A sensible pattern is agentless scanning everywhere, plus an agent on production servers, internet-facing workloads and Kubernetes nodes. If your servers already run an endpoint agent from our endpoint guide, check whether the same vendor's cloud module can reuse it.
CWPP options compared
| Option | Workloads covered | Notes |
|---|---|---|
| Microsoft Defender for Servers and Defender for Containers | Windows and Linux servers in Azure, AWS, Google Cloud and on-premises; Kubernetes and container registries | Part of Microsoft Defender for Cloud; servers use Microsoft Defender for Endpoint |
| CrowdStrike Falcon Cloud Security | Hosts, containers and Kubernetes across AWS, Azure, Google Cloud and Oracle Cloud | Falcon sensor plus agentless scanning; see CrowdStrike Falcon |
| SentinelOne Singularity Cloud Workload Security | Servers, virtual machines, containers and Kubernetes | Runtime protection on the same platform as SentinelOne Singularity |
| TrendAI Vision One Server and Workload Protection, and Container Security | Servers, virtual machines and containers in hybrid and multicloud estates | Within TrendAI Vision One; Cloud IPS and File Security also available |
| Bitdefender GravityZone | Windows and Linux servers on-premises and in AWS, Azure and Google Cloud, plus containers | One agent and console with your endpoints; see Bitdefender GravityZone |
Sophos customers protect cloud servers with Sophos Endpoint for Server (formerly Intercept X Advanced for Server) and Sophos Cloud Workload Protection; our Sophos site covers Intercept X for Server and Sophos Cloud Workload Protection. Network-level segmentation between workloads is a separate control: see Zero Networks and the cloud firewall options.
Microsoft Defender for Servers Plan 1 vs Plan 2
Many organisations with servers in Azure start here, so it is worth knowing the difference:
| Feature | Plan 1 | Plan 2 |
|---|---|---|
| Microsoft Defender for Endpoint EDR with automatic onboarding | Yes | Yes |
| Agent-based vulnerability scanning and software inventory | Yes | Yes |
| Regulatory compliance assessment | Yes | Yes |
| Agentless vulnerability, malware and secrets scanning | No | Yes |
| File integrity monitoring | No | Yes |
| Just-in-time virtual machine access | No | Yes (Azure and AWS) |
| OS baseline misconfiguration checks and OS update assessment | No | Yes (Arc-onboarded machines) |
| Defender for DNS alerts | No | Yes |
| Defender Vulnerability Management premium features | No | Yes |
| Free log data ingestion allowance | No | Yes |
Microsoft recommends enabling either plan at subscription level. Plan 1 can also be switched on for individual servers; Plan 2 cannot be enabled per server, although it can be switched off for individual servers. New plans start with a 30-day trial. Microsoft also sells Defender Experts for Servers, a separate managed detection and response service that runs on top of either plan.
Choosing and deploying CWPP
- Inventory first. List virtual machines, clusters, registries and functions in every account. Agentless discovery usually finds workloads nobody remembered.
- Match the tool to your servers. If you already run a capable EDR, extend that vendor to the cloud rather than adding a second agent.
- Shift left for containers. Scan images in the pipeline and the registry, and block deployment of images with critical vulnerabilities, so runtime alerts are the exception.
- Decide who responds. Runtime alerts on a production server at night need a response plan; most smaller organisations route them to an MDR service.
- Measure coverage. Track how many of your workloads are actually protected and how long critical vulnerabilities stay open, not just the number of alerts.
Pricing is normally per server, per node or per protected resource. Ask us for a quote and we will compare options on your real estate.
How we help
We review your cloud workloads, check what protection is already deployed (including Defender for Endpoint licences you may already own through Microsoft 365), close the gaps and connect alerts to the people or service that will act on them. Contact us to discuss protecting your cloud servers and containers.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is CWPP?
A cloud workload protection platform secures the compute you run in the cloud, such as virtual machines, containers, Kubernetes and serverless functions. It covers vulnerability assessment, hardening, malware scanning and runtime threat detection and response.
Is CWPP the same as endpoint protection?
They overlap for servers, where the same EDR agent often provides both. CWPP goes further with container image scanning, Kubernetes protection, serverless checks and agentless scanning of cloud disks, and it is managed with cloud context such as account, region and exposure.
Do I need an agent on every cloud server?
Not necessarily. Agentless scanning can cover every server for vulnerabilities and malware. Put an agent or sensor on production, internet-facing and business-critical workloads, where real-time detection and blocking matter.
Does Microsoft Defender for Cloud protect AWS servers?
Yes. Defender for Servers protects Windows and Linux machines in Azure, AWS and Google Cloud, and on-premises machines connected through Azure Arc, using Microsoft Defender for Endpoint for detection and response.