What is a CNAPP? Cloud-native application protection platforms explained
What does a CNAPP tool do?
A cloud-native application protection platform builds one inventory of your cloud accounts, workloads, identities, data stores and, often, code repositories. On top of that inventory it runs the checks the narrower categories run: configuration (CSPM), workload contents and behavior (CWPP), permissions (CIEM), sensitive data (DSPM) and known vulnerabilities.
The value is in the joins. A vulnerable package is one finding; a vulnerable package on an internet-facing machine whose role can read a database of customer records is a path an attacker could use. CNAPPs present these joined findings as attack paths or risk scores so a team fixes the few that matter first.
Most CNAPPs now also scan code and infrastructure-as-code before deployment and add inventory and posture checks for AI services and models.
When do you need CNAPP?
- You need three or more of the narrower categories and would rather run one console than several.
- Findings from separate tools already overlap and nobody can tell which ones matter most.
- Your team is small and cannot maintain several integrations.
- You want cloud findings traced back to the code or pipeline that created them.
When is CNAPP not enough?
A CNAPP is broad by design, and breadth is uneven. A platform that started agentless may have a thinner runtime story, and one that started from a runtime agent may see less without it. Check the category you care about most on its own, using the vendor's own pages, rather than assuming the platform label covers it equally well. A CNAPP also does not replace endpoint protection on laptops or identity security for your workforce directory.
Which finder answers point to CNAPP?
- +2 if you protect source code and build pipelines
- +1 if you protect AI services, models or agents
- +2 if your team is one or two people
- +1 if your team is three to ten people
- Bundling bonus: count how many of CSPM, CWPP, CIEM, DSPM and vulnerability management have 3 or more points. If 3 or more do, +4; if exactly 2 do, +2.
Which vendors describe CNAPP?
9 of 9 vendors describe CNAPP on the pages we read, and 0 are not in our sources.
| Vendor | Status | What their pages say | Source |
|---|---|---|---|
| Aqua Security | Described | Positions one platform across posture, pipeline scanning and runtime enforcement. | Source: Aqua cloud native security platform, read . |
| CrowdStrike Falcon Cloud Security | Described | Combines CSPM, workload protection, CIEM, ASPM and AI-SPM under Falcon Cloud Security. | Source: CrowdStrike Falcon Cloud Security, read . |
| Microsoft Defender for Cloud | Described | Posture (Defender CSPM) and workload protection (Defender for Servers) are separate plans in one product; the full set needs paid plans. | Source: Microsoft Learn: Defender for Cloud CSPM plans, read . |
| Orca Security | Described | CNAPP is listed as a module on the platform page, built on one Unified Data Model. | Source: Orca Security platform overview, read . |
| Palo Alto Networks Cortex Cloud | Described | Palo Alto Networks includes CNAPP at no additional cost for Cortex Cloud Runtime Security customers. | Source: Palo Alto Networks press release: Cortex Cloud introduced, read . |
| SentinelOne Singularity Cloud | Described | Cloud Native Security is described as an agentless CNAPP. | Source: SentinelOne Cloud Native Security, read . |
| Sysdig Secure | Described | Sysdig describes Sysdig Secure as a CNAPP. | Source: Sysdig press release: Sysdig Secure AI, read . |
| Upwind | Described | Lists posture, identity, data, workload, code, API and detection modules on one platform. | Source: Upwind homepage, read . |
| Wiz | Described | Wiz Cloud, Wiz Code and Wiz Defend on one Security Graph. | Source: Wiz platform overview, read . |
Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.
What should you ask a CNAPP vendor?
- Which of the six categories are included in the price you are quoting, and which are add-ons?
- What can the product see with no agent installed, and what needs one?
- Which clouds are supported, by name?
- How does a finding in one category change the priority of a finding in another?
Frequently asked questions
Is a CNAPP the same as a CSPM?
No. CSPM is one part of a CNAPP. A CSPM reads account configuration; a CNAPP adds workload, identity, data and usually code checks over the same inventory.
Do CNAPPs need agents?
It varies by vendor. Some build their inventory and scan workloads without agents and offer a sensor as an option; others lead with an agent. Each vendor profile on this site states the approach from the vendor's own pages.
Which vendors call their product a CNAPP?
On the pages we read, several vendors use the term directly. SentinelOne calls Cloud Native Security "an agentless CNAPP", Orca lists CNAPP as a module, and Palo Alto Networks includes CNAPP with Cortex Cloud Runtime Security. The table above shows the status for all nine.