CNAPP — the unified posture score
CNAPP is the unified view across what Onam Security runs: seven pillars, each scored by its own engine, rolled into one posture score.
The seven pillars
| Pillar | What it scores |
|---|---|
| Posture (CSPM) | Cloud configuration posture — the share of checks that pass |
| Threat detection and IAM (CDR) | Detections from audit logs, plus IAM posture findings |
| Workloads (CWPP) | Workload protection |
| Data (DSPM) | Data security posture |
| Network | Network posture |
| Threat | Threat signals |
| Code (AppSec) | Code security findings |
Identity analysis from CIEM feeds the attack path graph and its own views; it is not a separate pillar.
How scoring works
- Each pillar reports a score on a common 0–100 scale, computed by its own engine.
- The pillar scores are combined with fixed weights into one overall score — posture, threat detection and workloads weigh the most, threat and code the least. A pillar with no data is left out and the remaining weights are rebalanced, so the score stays on the 0–100 scale.
- The overall score maps to a risk band: low, medium, high or critical.
- Each overall score is stored, so the trend shows whether posture is improving.
Behind the pillars sits one findings model. Severity on a finding is raised when context makes it worse — it is on an attack path and internet-exposed, it is a crown jewel, it has a likely-exploited CVE, or an active threat actor is touching it — and each finding gets a fix-by date.
Why the score moves when nothing changed
Because the estate changed. Each scan discovers resources again, and a newly deployed misconfigured resource lowers the score at the next scan. The pillar scores and their findings show what caused a movement.
What is not in the score
Onam Estate and Onam FinOps are separate products and do not contribute to the CNAPP score. Folding a cost figure into a security score would make the number mean nothing.