What is CWPP? Cloud workload protection explained
What does a CWPP tool do?
Workload protection covers two jobs. The first is inspection: what software, secrets and malware sit on the workload. Several vendors do this without an agent by reading a copy of the workload's disk out of band, so nothing runs inside the machine.
The second job is runtime protection: watching processes, network connections and file changes while the workload runs, and blocking or stopping what should not happen. That needs a sensor on the workload, commonly built on eBPF on Linux, or an EDR agent.
Container workloads add the build pipeline and the cluster: images can be scanned before they deploy, and an admission controller can refuse a non-compliant image at the cluster door.
When do you need CWPP?
- You run virtual machines or Kubernetes clusters that hold production data.
- You need to detect or stop attacks on running workloads, not only report misconfigurations.
- You must show which machines carry a given vulnerable package.
- Servers on premises or in a private cloud need the same coverage as cloud ones.
When is CWPP not enough?
A CWPP sees workloads; it does not see the account settings around them or the permissions of the roles they run as. A perfectly patched machine with an over-permissioned role is still a risk. Pair workload protection with posture and identity checks, or buy them together in a CNAPP.
Which finder answers point to CWPP?
- +3 if you protect virtual machines
- +2 if you protect containers and Kubernetes
- +1 if you protect serverless functions
- +1 if you run private cloud or on-premises servers
- +1 if you run disconnected (air-gapped) environments
Which vendors describe CWPP?
9 of 9 vendors describe CWPP on the pages we read, and 0 are not in our sources.
| Vendor | Status | What their pages say | Source |
|---|---|---|---|
| Aqua Security | Described | Monitor, detect, enforce and contain inside running workloads, with kernel-layer enforcement. | Source: Aqua cloud native security platform, read . |
| CrowdStrike Falcon Cloud Security | Described | Cloud workload protection with agent and agentless options. | Source: CrowdStrike Falcon Cloud Security, read . |
| Microsoft Defender for Cloud | Described | Defender for Servers Plan 1 and Plan 2, with file integrity monitoring and just-in-time access in Plan 2. | Source: Microsoft Learn: Defender for Servers overview, read . |
| Orca Security | Described | Workloads are covered by SideScanning (VMs, containers, serverless) and, for runtime, the optional Orca Sensor. | Source: Orca agentless SideScanning, read . |
| Palo Alto Networks Cortex Cloud | Described | Runtime security with a performance-optimized agent. | Source: Cortex Cloud overview, read . |
| SentinelOne Singularity Cloud | Described | Cloud Workload Security for containers, VMs and AI workloads. | Source: SentinelOne Singularity Cloud, read . |
| Sysdig Secure | Described | Runtime threat detection for containers and Kubernetes through the agent. | Source: Sysdig Secure, read . |
| Upwind | Described | Container and Kubernetes, serverless, and CDR modules, with eBPF sensors. | Source: Upwind homepage, read . |
| Wiz | Described | Agentless workload scanning plus the Wiz Sensor for runtime blocking, Kubernetes file integrity monitoring and drift detection. | Source: Wiz Defend and Wiz Sensor, read . |
Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.
What should you ask a CWPP vendor?
- What can you see with no agent, and what does the agent add?
- Does the agent block, or only detect and alert?
- Which operating systems, Kubernetes distributions and serverless runtimes are covered?
- What does the agent cost in CPU and memory on a busy node, and who maintains it?
Frequently asked questions
Can workload protection be agentless?
Inspection can. Several vendors read disk snapshots or use cloud APIs to find vulnerable packages and malware without an agent. Blocking an attack in progress generally needs a sensor or agent on the workload.
What is eBPF and why do sensors use it?
eBPF is a Linux kernel feature that lets small, checked programs observe system activity. Runtime sensors from Orca, Wiz and Upwind are described as eBPF-based on their pages.
Is CWPP the same as EDR?
They overlap. EDR began on laptops and servers; CWPP covers cloud workloads including containers and serverless. CrowdStrike and Microsoft extend their EDR agents to cloud servers.