CNAPP explained: cloud security needs three checks at once, the cloud's configuration, the workloads that are running, and account permissions. A CNAPP (cloud-native application protection platform) is one platform that combines the tools that used to be sold separately for these checks, CSPM (cloud configuration checks), CWPP (protection of running systems) and CIEM (checks on cloud account permissions), and covers an application's life from code to production. This article explains what each tool does, what a CNAPP adds, and how to decide without ranking products.

Where the term comes from, and whether sources agree on it

Secondary sources say that Gartner, a technology research firm, coined the term CNAPP in a 2021 report. Gartner's report is paywalled, so this article did not read the original and uses definitions from the CSA (Cloud Security Alliance, an organization that publishes cloud security guidance), IBM and Microsoft instead. All three describe a CNAPP as several tools combined on one platform, but the list of tools is not the same. CSA and IBM count CIEM as part of it, while the Microsoft Defender for Cloud overview page (last updated August 2026) lists its three core components as CSPM, DevSecOps (security of code and the build process) and CWPP. CNAPP is a market category name, not a standard with a fixed scope, so judge a product by what it actually does, not by the category label.

CSPM, CWPP and CIEM ask different questions

The three tools check different things, and each has a blind spot:

  • CSPM (cloud security posture management): asks "is anything in our cloud configuration wrong", for example a storage area open to the public. A CSA article says this group sees little of the risk inside running systems
  • CWPP (cloud workload protection platform): asks "do the running systems have vulnerabilities or signs of attack". A workload is something that runs in the cloud, such as a virtual machine, a container (a unit that packages an app with what it needs) or a serverless function (code the cloud runs on request, with no server to manage). CSA says this group sees workload detail well but not the cloud's central configuration, and often has coverage gaps because it relies on agents (small pieces of software on the machine)
  • CIEM (cloud infrastructure entitlement management): asks "do cloud accounts and roles hold more permissions than they need". The goal is least privilege. CSA says this group does not fully cover other kinds of credentials or workload-level risk

Consider a hypothetical example (not a real incident) where all three views are needed to see the full risk. One virtual machine is open to the internet, the software on it has a vulnerability, and it is tied to a role that can reach customer data. With separate tools, each one sees only one of the three facts. Put together, they show a complete attack path. CSA says this is what a combined platform can find and separate tools may miss. The details of configuration checks are in the CSPM article, and excess permissions are covered in the comparison of IAM, IGA, PAM and CIEM.

INFOGRAPHIC
Hypothetical example: three weaknesses join into an attack path
01
Machine open to internet
CSPM sees the setting
02
Software has a flaw
CWPP sees inside
03
Role has excess rights
CIEM sees the rights
04
Customer data reachable
the full attack path

What a CNAPP adds to these three

As IBM and Microsoft describe them, CNAPP products often add the following, though not every product has all of them:

  • Checks before production (shift-left): moving checks to the time code is written and systems are built, for example scanning IaC files (infrastructure as code, files that define cloud setup as code) for wrong settings and secrets leaked in code before they go live
  • KSPM (Kubernetes security posture management): checks the configuration of Kubernetes (software that manages containers). The basics are in the article on container and Kubernetes security
  • DSPM (data security posture management): finds where sensitive data is stored and how it is protected
  • A combined view and attack paths: combines results from every area to show which weaknesses connect into an attack path and which to fix first. Microsoft states that attack path analysis is in the paid Defender CSPM plan, not the free one
INFOGRAPHIC
A CNAPP merges three older jobs and adds pre-production checks
CNAPP
one body of data, seen together
CSPM
checks cloud configuration
CWPP
protects running systems
CIEM
checks excess permissions
Pre-production checks
from code and IaC files

Each vendor splits its capabilities into different packages. In Microsoft's documentation, for example, Defender for Cloud has Foundational CSPM, which is free, and Defender CSPM, which is paid and adds capabilities such as attack path analysis and agentless vulnerability scanning of virtual machines (no agent installed on the machine). The example is here to show that having a CNAPP does not mean having every capability. This article does not compare or rank products.

When a CNAPP makes sense

This section is the article's own view, not taken from any standard. An organization that uses one cloud, has few systems and a small team may start with CSPM to get configuration checks in place, then add other parts. An organization that uses several clouds, runs containers or Kubernetes and releases new systems often will gain more from seeing every area in one place, because weaknesses that connect into an attack path often cross several areas. For which tasks belong to the cloud provider and which to your organization, see the article on the shared responsibility model.

Before talking to vendors, this article suggests asking these questions:

  • Does it cover what you actually use: every cloud, every account and every service the organization uses, including Kubernetes if you run it
  • How does it collect data: agent-based tools need software installed on the machine and may leave coverage gaps, while agentless tools need no installation. Ask what each approach can and cannot see
  • How does it prioritize: by context, such as whether something is exposed to the internet or holds high privileges, not by CVSS score (the vulnerability severity score) alone
  • Can it feed your existing systems: send alerts to a SIEM (a system that collects and analyzes logs) or to the ticketing system your team already uses, so that each issue has an owner
  • Which capability sits in which package: ask for confirmation that the features you need are included in the quoted price

A 2025 article on the CSA blog (written by an employee of a tool vendor, so it is the author's opinion) observes that many CNAPPs look at systems from the infrastructure side: configurations, permissions, exposed resources and images (the template files that containers are created from). They do not see what the application does with data, APIs and its own authentication logic. A CNAPP should therefore not be treated as a substitute for testing the application itself.

Common mistakes

  • Buying on the category name: assuming that buying a "CNAPP" covers everything, without checking whether the features you need are in the package you bought
  • Connecting only some accounts: linking the main account and forgetting test accounts or other teams' accounts, so the picture misses parts you do not know exist
  • Naming no owner for fixes: getting many alerts that nobody is responsible for fixing, so the risk does not really fall
  • Fixing by ease instead of context: closing the easy items first while the weaknesses that join into an attack path stay open
  • Believing the CNAPP covers the application too: not testing APIs and application logic because the tool is assumed to see everything

Start today

  • List every cloud account: record each account or subscription with the name of its owner
  • Start with configuration: if you have no CSPM-style checks yet, begin checking configuration and fix the highest risks first
  • Check for excess permissions: look at roles and accounts with broad rights and remove the permissions that are not used
  • Find out whether you run containers or Kubernetes: if you do, add them to the plan
  • Write the 5 evaluation questions: use the questions above as criteria and run a real trial (PoC, proof of concept) on a chosen account before deciding to buy
  • Name an owner and a deadline for fixes: agree on them before switching on every alert

To see where your organization's cloud security stands, try the self-assessment.

Scope and accuracy

The information comes from Microsoft documentation read on 27 October 2026 (the overview page updated in August 2026 and the CSPM page updated in September 2026), an IBM article, and two articles on the CSA website. The first was originally published in 2022 by a tool vendor, and the second was published in 2025 by an employee of a vendor, so both carry a vendor's viewpoint and neither is a CSA standard. In the author's search, no official CSA guidance that defines CNAPP was found. Gartner's report is paywalled and was not read. Product capabilities change often, so check the vendor's current documentation before deciding.

References and further reading