Cloud security tool categories: CNAPP, CSPM, CWPP, CIEM, DSPM and vulnerability management
What does each category look at?
One product that combines posture, workload, identity, data and code checks, so findings from each can be read together.
Reads your cloud accounts through the provider's APIs and flags misconfigurations and compliance gaps.
Looks inside virtual machines, containers and serverless functions for vulnerabilities, malware and attacks in progress.
Maps which human and machine identities can do what, and flags permissions that are larger than the job needs.
Finds where sensitive data sits across cloud storage and databases, and who or what can reach it.
Finds known vulnerable software across hosts, images and functions and helps decide which to fix first.
Which vendor describes which category?
| Vendor | CNAPP | CSPM | CWPP | CIEM | DSPM | Vulnerability management |
|---|---|---|---|---|---|---|
| Aqua Security | Described | Described | Described | Not in our sources | Not in our sources | Described |
| CrowdStrike Falcon Cloud Security | Described | Described | Described | Described | Described | Described |
| Microsoft Defender for Cloud | Described | Described | Described | Described | Described | Described |
| Orca Security | Described | Described | Described | Described | Described | Described |
| Palo Alto Networks Cortex Cloud | Described | Described | Described | Described | Described | Described |
| SentinelOne Singularity Cloud | Described | Described | Described | Described | Described | Described |
| Sysdig Secure | Described | Described | Described | Described | Described | Described |
| Upwind | Described | Described | Described | Described | Described | Described |
| Wiz | Described | Described | Described | Described | Described | Described |
| Vendors describing it | 9 | 9 | 9 | 8 | 8 | 9 |
How do the categories overlap?
The categories share data. A CSPM finding that a storage bucket is public matters more when a DSPM finding says the bucket holds customer records, and more again when a CIEM finding shows a role that can read it from the internet. That is the case for a CNAPP: one inventory and one place to read the combined risk.
The overlap also explains why buyers rarely buy the five narrower categories as five products today. Every vendor on this site describes at least three of them in one platform. The narrower categories still matter as a way to ask precise questions: which identities can reach this data, which running workload has this vulnerable package.
Vulnerability management is the oldest of the six. In cloud estates it now happens in three places: in the build pipeline (scanning images and code), in the account (scanning snapshots or disks without an agent) and on the running workload (an agent or sensor). Ask each vendor which of the three it covers.
Frequently asked questions
Is CNAPP a separate product from CSPM?
Usually not. Vendors here sell a CNAPP that includes CSPM as one part. Microsoft is the exception that sells posture and server protection as separate plans of one product, with a free posture tier.
Which category should a small team buy first?
Most small teams start with posture (CSPM), because it reads every account through cloud APIs without touching workloads. The finder adds points to CNAPP for small teams because one console is easier to run than several.
What is CWPP versus EDR?
EDR is endpoint detection and response on laptops and servers. CWPP covers cloud workloads, including containers and serverless functions, and often adds agentless scanning. CrowdStrike and Microsoft extend their EDR agents to cloud servers; other vendors use their own sensors.