Are the workloads running in production hardened?
CWPP: agentless workload protection for VMs, containers, serverless functions and managed hosts.
Cloud Workload Protection covers every compute form factor you run: virtual machines, containers, serverless functions and managed hosts. Each is scored on one workload posture model, and the data is collected without installing an agent.
- posture rules
- 9,853
- cloud providers
- 7
- cloud services
- 549
- compliance frameworks
- 78
Configuration scanning sees an EC2 instance with a sensible security group and calls it healthy.
It cannot see the unpatched OpenSSL inside the AMI, the root-owned SSH key baked into the image, the container running as privileged, or the Lambda with an outdated runtime. The workload is where the exploit lands, and most posture tools never look inside it.
How CWPP — Workload Protection works
- 01
Workload discovery inventories every VM, container, serverless function and managed host across all seven supported clouds via read-only APIs.
- 02
The agentless scanner takes point-in-time volume snapshots inside your own account and analyses them out-of-band, so no software runs on the workload itself.
- 03
Each workload is evaluated against the compute and workload rule set (219 dedicated posture rules), plus operating-system CIS benchmarks for Ubuntu, RHEL, SUSE, Debian and CentOS.
- 04
Vulnerability, container image, and host signal data is joined onto the same workload record, so one view shows configuration, packages, and exposure together.
- 05
Workload health rolls up into a single CWPP pillar score that trends over time and feeds the unified CNAPP score.
What you see in the console
- Unified workload inventory
- VMs, containers, serverless, and hosts in one list
- Per-workload posture score with severity-ranked findings
- OS hardening results against CIS benchmarks for five Linux distributions
- Package and vulnerability inventory collected without agents
- Privileged and root-running workload detection
- Runtime exposure
- which workloads are internet-reachable
- Serverless posture
- runtime versions, execution roles, and environment secrets
- CWPP pillar score trending, feeding the platform-wide CNAPP score
CWPP — Workload Protection in the real console.
A recreation of the Onam console with sample data — the screens and finding types your team works with.
Questions we get a lot
See CWPP — Workload Protection on your own cloud
Book a 30-minute demo. We walk through it on sample data, or on one of your accounts if you want to connect it.