What is CNAPP (Cloud-Native Application Protection Platform)?
A Cloud-Native Application Protection Platform (CNAPP) is a single platform that combines cloud posture management, workload protection, identity entitlement analysis, data security and runtime threat detection on one shared data model — so risks that span those domains are correlated rather than reported separately.
Why the category exists
By around 2021 a typical cloud security stack had four or five tools: a posture scanner, a workload scanner, an identity analyser, a data classifier, and something watching logs. Each was competent. Together they were close to useless for answering the only question that matters — *what should we fix first?*
The reason is that risk in cloud environments is almost never contained within one tool's domain. A real incident looks like this:
A container image has a known CVE (workload tool). The container runs with a service account that can assume a role (identity tool). That role can read a storage bucket (posture tool). The bucket holds customer PII (data tool). The container is reachable from the internet (network tool).
Five tools each hold one fact. Each fact on its own is a medium-severity finding that sits in a queue for months. Together they are a critical breach path. No individual tool can see it, and no human reliably assembles it by hand across five consoles.
CNAPP is the response: put every signal on one data model so the chain is computable.
What a CNAPP includes
| Component | What it answers |
|---|---|
| CSPM | Is the infrastructure configured correctly? |
| CWPP | Are the running workloads hardened and patched? |
| CIEM | Who can actually do what, and do they still need it? |
| DSPM | Where is the sensitive data and who can reach it? |
| Attack path analysis | Which combinations actually reach something valuable? |
| Runtime detection (CDR) | Is something happening right now? |
| Code security (SAST/DAST/SCA/IaC) | Are we shipping the problem in the first place? |
Increasingly SSPM belongs here too, since the identity that compromises a SaaS tenant is usually the same identity that federates into the cloud account.
Real CNAPP vs. a bundle
Many products marketed as CNAPP are several acquisitions behind one login page. The distinction is not marketing pedantry — it determines whether you get correlation or just consolidated billing. Tests that separate the two:
- One severity scale? If the posture module says "high" and the vulnerability module says "7.5" and nothing reconciles them, the data models are separate.
- Does a finding in module A change the ranking in module B? In a real CNAPP, a bucket holding PII raises the priority of the IAM finding that grants access to it. In a bundle, they never speak.
- Is there one asset inventory? If each module discovers resources independently, you will find the same instance counted differently in two places.
- Can it show a path, not a list? Chaining across domains is only possible on a shared graph.
- One onboarding? If enabling the data module requires a second set of credentials and a second scan, it is a separate product.
The posture score problem
Most CNAPPs produce a single score. Treat it carefully. A score is useful for trend ("are we improving?") and useless for action ("what do I do Monday?"). A good implementation lets the score decompose all the way down — score to pillar to finding to resource to remediation. A score that cannot be decomposed is a vanity metric.
Does CNAPP replace everything else?
No. CNAPP does not replace a SIEM, an EDR on employee laptops, or your identity provider. It replaces the cluster of cloud-specific point tools that were each solving one slice of cloud risk, and it does so specifically because those slices are not independent.
Next steps
- How Onam implements CNAPP — seven scored pillars on one graph
- What is CSPM?
- What is a cloud attack path?
Frequently asked questions
What does CNAPP stand for?
CNAPP stands for Cloud-Native Application Protection Platform. The term was introduced by Gartner to describe platforms that unify cloud posture, workload, identity and data security rather than selling them as separate tools.
What is the difference between CNAPP and CSPM?
CSPM is one component of CNAPP. CSPM checks infrastructure configuration; CNAPP additionally covers workloads, identity entitlements, data exposure and runtime threats, and correlates all of them on a single data model so cross-domain attack paths become visible.
Do I need CNAPP if I already have CSPM?
If your CSPM produces long finding lists that nobody can prioritise, that is the specific problem CNAPP addresses. CSPM tells you what is misconfigured; CNAPP tells you which misconfigurations combine with identity, data and workload facts to create a real path to something valuable.
Is CNAPP agentless?
The posture, identity and data components are agentless everywhere. Workload coverage varies by vendor — some require an agent, others use snapshot-based agentless scanning that analyses a point-in-time copy of the volume without running anything on the workload.