What is CWPP (Cloud Workload Protection Platform)?
A Cloud Workload Protection Platform (CWPP) secures the compute workloads running in a cloud environment — virtual machines, containers, serverless functions and managed hosts — by inspecting what is installed and running inside them, rather than how the surrounding cloud infrastructure is configured.
The gap CWPP fills
CSPM looks at a virtual machine and sees a resource: its security group, its IAM role, whether its volume is encrypted. All of that can be correct while the machine itself is indefensible — running a three-year-old kernel, an unpatched OpenSSL, an SSH key baked into the base image, and a service listening on a port nobody documented.
Configuration is the door. The workload is the room. CWPP is the only category that opens the room.
What counts as a workload
CWPP is deliberately broad, because "compute" stopped meaning "server" a long time ago:
- Virtual machines — EC2, Azure VMs, GCE, OCI Compute
- Containers — images in registries and containers actually running in EKS, AKS, GKE, OKE, ACK
- Serverless — Lambda, Azure Functions, Cloud Functions, including runtime versions and execution roles
- Managed hosts — anything the provider runs on your behalf where you still own the configuration inside
A tool that covers containers but not serverless is not a CWPP; it is container security.
What CWPP checks
| Area | Examples |
|---|---|
| Vulnerabilities | Installed packages matched against CVE feeds, with exploitability context |
| OS hardening | CIS benchmarks for Ubuntu, RHEL, SUSE, Debian, CentOS |
| Container posture | Privileged containers, hostPath mounts, running as root, stale images |
| Serverless posture | End-of-support runtimes, over-permissive execution roles, secrets in environment variables |
| Secrets on disk | Credentials, private keys and tokens sitting in the filesystem |
| Runtime behaviour | Process, file and network activity, where the vendor supports it |
Agent vs agentless
This is the decision that determines whether a CWPP rollout succeeds.
Agent-based installs software on every workload. It gives continuous runtime telemetry — process execution, syscalls, live network connections — which snapshot scanning cannot replicate. The cost is real: a package to distribute, a version to maintain, a rollout plan, an exception list for machines that break, and a recurring negotiation with the platform team. Coverage commonly plateaus well short of 100%, and the uncovered remainder is usually the legacy estate that most needs scanning.
Agentless takes a point-in-time snapshot of the workload's volume and analyses it out-of-band. Coverage is complete on day one because there is nothing to install, and there is zero performance impact. The trade-off is that it is point-in-time: it will not show you a process that spawned and exited between scans.
Most mature programmes use agentless as the coverage baseline and add runtime detection from cloud-native audit and flow logs, reserving agents for the small set of workloads that genuinely need live process telemetry.
CWPP vs CSPM vs container security
- CSPM — the cloud configuration around the workload.
- CWPP — everything inside the workload, across every compute form factor.
- Container security — the container-specific slice: images, registries, Kubernetes RBAC, admission control. It is a subset of CWPP, not a synonym.
Next steps
- How Onam implements CWPP — VMs, containers, serverless and hosts, agentlessly
- What is agentless cloud security?
- What is CNAPP?
Frequently asked questions
What does CWPP stand for?
CWPP stands for Cloud Workload Protection Platform — security for the compute workloads themselves (virtual machines, containers, serverless functions and hosts), as distinct from the cloud infrastructure configuration around them.
What is the difference between CWPP and CSPM?
CSPM inspects cloud configuration — security groups, IAM policies, encryption settings. CWPP inspects what is actually installed and running inside the workload — packages, vulnerabilities, OS hardening, secrets on disk. A workload can pass every CSPM check and still be trivially exploitable.
Does CWPP require an agent?
Not necessarily. Agentless CWPP uses point-in-time volume snapshots analysed out-of-band, giving complete coverage with no software on the workload. Agents add continuous runtime telemetry but historically stall short of full coverage because every workload needs the agent installed and maintained.
Is container security the same as CWPP?
No. Container security covers images, registries, Kubernetes RBAC and admission policy. CWPP is the umbrella across every compute form factor, including the virtual machines and serverless functions that are not containers at all.