Pro tool · 3 free runs with a free account

CNAPP, CSPM, CWPP or CIEM: what does your cloud need first?

Describe your clouds, workloads, team and compliance. Get the capabilities to put in place first, a phased maturity path, and the questions to ask every vendor.

Your cloud estate

Describe what you run

SaaS startup: AWS; other containers, serverless functions, managed data services; small estate.

Start from a typical estate

Clouds (pick all)

Workloads (pick all)

Accounts, subscriptions or projects

Infrastructure as code

Security team

Compliance

Also true for us

Recommendation

Start with posture, add capabilities in phases

Your first-phase needs are narrow. Start with posture management (native or a platform) and add the next capabilities as the estate grows; choose a vendor whose later modules you would want, but buy only what you will use this year.

Phase 1: First 90 days

Visibility and the biggest exposures

CSPM · Cloud security posture management
Phase 1
- • Misconfiguration (public storage, open management ports, logging off) is the problem every estate has; posture is the foundation the rest builds on.
- • With one cloud, start with the provider's native posture service before buying.
- • Compliance mapping (CIS and your frameworks) turns posture findings into audit evidence.
Answers: Is anything public that should not be? Is logging on? Is encryption on? Which accounts break our baseline?
RFP questions and building blocks
1. Which clouds, services and regions do you assess today, and how soon after a provider launches a new service do you cover it?
2. Agentless or agent-based? What read permissions does your role or service principal need, and can we review them?
3. How often is configuration re-scanned, and do you react to change events or only poll?
4. Which benchmarks and frameworks are mapped out of the box (CIS, PCI DSS, HIPAA, ISO 27001, NIST 800-53), and can we write custom policies as code?
5. How do findings route to owners (ticketing, chat, pull requests), and can we suppress with an expiry and a reason?
Open source: Prowler, Cloud Custodian, ScoutSuite
Cloud-native services: AWS Security Hub, Microsoft Defender for Cloud (CSPM), Google Security Command Center
Image scan · Container image and registry scanning
Phase 1
- • NIST SP 800-190 puts image vulnerabilities and embedded secrets at the top of container risks; fixing them in the build is cheaper than at runtime.
Answers: Which images in production carry critical vulnerabilities, and which build introduced them?
RFP questions and building blocks
1. Do you scan in CI, in the registry and at runtime, and link the three so one vulnerability is one finding?
2. Do you produce and ingest SBOMs (SPDX, CycloneDX)?
3. Can a policy fail a build or block deployment of an image above a threshold, with time-boxed exceptions?
Open source: Trivy, Grype, Syft (SBOM)
Cloud-native services: Amazon ECR scanning (Inspector), Microsoft Defender for Containers, Google Artifact Analysis
IaC scan · Infrastructure-as-code scanning
Phase 1
- • Your infrastructure is defined in code, so catching misconfigurations in the pull request stops them existing at all.
Answers: Would this change open a bucket or a security group before it merges?
RFP questions and building blocks
1. Is the IaC policy set the same as the runtime posture policy set, so a rule fixed in code matches the finding in the cloud?
2. Can you trace a runtime finding back to the IaC file and line that created it, and open a fix pull request?
3. Which IaC languages and module registries do you support?
Open source: Checkov, KICS, Trivy (config)
Cloud-native services: Some provider security centres scan connected code repositories

Phase 2: 3 to 6 months

Identity, workloads and shift-left

CWPP · Cloud workload protection
Phase 2
- • Running workloads carry the exploitable vulnerabilities attackers use to get in.
- • Internet-facing apps: vulnerabilities that are exposed to the internet should be ranked first.
Answers: Which running workloads have exploitable vulnerabilities? Is anything behaving like an attacker right now?
RFP questions and building blocks
1. Agent, agentless snapshot scanning, or both? What does each mode see that the other cannot?
2. For runtime detection: what is the kernel mechanism (eBPF, kernel module), CPU and memory overhead, and supported OS and kernel versions?
3. Can you block or only alert? What is the false-positive rate on a workload we provide during the trial?
4. How are vulnerabilities prioritised: CVSS only, or also exploitability (CISA KEV, EPSS), internet exposure and whether the package is loaded?
Open source: Trivy (vulnerability scanning), Falco (runtime detection), Wazuh (host monitoring)
Cloud-native services: Amazon Inspector and GuardDuty, Microsoft Defender for Servers and Containers, Google Security Command Center threat detection
CIEM · Cloud infrastructure entitlement management
Phase 2
- • Stolen or over-permissioned identities are how cloud breaches usually spread; CISA and NSA list secure cloud IAM first in their cloud guidance.
- • At small scale, native access analysers and a quarterly review may be enough for now.
Answers: Who can reach production data? Which permissions were granted but never used? Which identity paths lead to admin?
RFP questions and building blocks
1. Do you compute effective permissions (including resource policies, permission boundaries, SCPs and group nesting), or only list attached policies?
2. How do you treat machine identities: service accounts, workload identities, CI/CD roles and access keys?
3. Can you show unused permissions over a period we choose, and generate a least-privilege policy we can review before applying?
4. Do you show cross-account and cross-cloud privilege-escalation paths, and federated identities from our IdP?
Open source: PMapper (AWS), Cartography (asset and permission graph)
Cloud-native services: AWS IAM Access Analyzer, Microsoft Defender for Cloud (permissions management features), Google IAM Recommender
CDR · Cloud detection and response
Phase 2
- • Control-plane detection catches stolen keys and new admin users that posture checks never see.
Answers: Is someone using a stolen key, creating new admin users or disabling logging right now?
RFP questions and building blocks
1. Which log sources do you ingest (CloudTrail, Azure Activity and Entra logs, Google Cloud Audit Logs, Kubernetes audit logs), and who pays the log egress cost?
2. How do detections reach our SIEM or SOAR, and in what format?
3. Can you show a real detection-to-response timeline from a trial in our environment?
Open source: Falco plugins for cloud audit logs, Sigma rules in your SIEM
Cloud-native services: Amazon GuardDuty, Microsoft Defender for Cloud alerts, Google Security Command Center threat detection

Phase 3: 6 to 12 months

Depth, automation and data

DSPM · Data security posture management
Phase 3
- • No sensitive data flagged; native classification on your main stores may be enough.
Answers: Where is our regulated data, is it encrypted, who can read it, and is there any copy we forgot?
RFP questions and building blocks
1. Does classification run inside our account, or is data copied to your platform? Where are samples stored and for how long?
2. Which stores do you cover (object storage, managed databases, warehouses, snapshots, SaaS)?
3. How do you combine data sensitivity with exposure and identity paths to rank risk?
Open source: Few mature open-source options; classification is usually commercial
Cloud-native services: Amazon Macie, Microsoft Purview, Google Sensitive Data Protection

Not needed for this estate: KSPM.

RFP question pack

General questions plus capability questions for every phase, ready to paste into an RFP or trial plan.

Preview

CLOUD-NATIVE PROTECTION: CAPABILITY PRIORITIES AND RFP QUESTIONS
Estate: AWS; other containers, serverless functions, managed data services; small estate
Recommendation: Start with posture, add capabilities in phases. Your first-phase needs are narrow. Start with posture management (native or a platform) and add the next capabilities as the estate grows; choose a vendor whose later modules you would want, but buy only what you will use this year.

PHASE 1 (First 90 days): Visibility and the biggest exposures
- CSPM: Cloud security posture management. Misconfiguration (public storage, open management ports, logging off) is the problem every estate has; posture is the foundation the rest builds on.
- Image scan: Container image and registry scanning. NIST SP 800-190 puts image vulnerabilities and embedded secrets at the top of container risks; fixing them in the build is cheaper than at runtime.
- IaC scan: Infrastructure-as-code scanning. Your infrastructure is defined in code, so catching misconfigurations in the pull request stops them existing at all.

PHASE 2 (3 to 6 months): Identity, workloads and shift-left
- CWPP: Cloud workload protection. Running workloads carry the exploitable vulnerabilities attackers use to get in.
- CIEM: Cloud infrastructure entitlement management. Stolen or over-permissioned identities are how cloud breaches usually spread; CISA and NSA list secure cloud IAM first in their cloud guidance.
- CDR: Cloud detection and response. Control-plane detection catches stolen keys and new admin users that posture checks never see.

PHASE 3 (6 to 12 months): Depth, automation and data
- DSPM: Data security posture management. No sensitive data flagged; native classification on your main stores may be enough.

GENERAL VENDOR QUESTIONS
G1. Show the full asset inventory from a read-only connection to one of our accounts during the trial; how long did onboarding take?
G2. How do you correlate findings across capabilities (for example, a vulnerable workload that is internet-exposed and has an identity that reaches sensitive data) and show that as one risk?
G3. What data leaves our environment, where is it stored and processed, for how long, and under which certifications (SOC 2 Type II, ISO 27001, FedRAMP if relevant)?
G4. How is pricing measured (workloads, accounts, resources, data scanned), and what happens to the price if our estate doubles?
G5. Which capabilities are native to your platform and which come from acquisitions or partners, and do they share one data model and console?
G6. What is your API coverage, so findings and inventory can be pulled into our own tooling?
G7. Give two customer references with an estate like ours (clouds, scale, Kubernetes use).

CSPM QUESTIONS (Cloud security posture management)
CSPM-1. Which clouds, services and regions do you assess today, and how soon after a provider launches a new service do you cover it?
CSPM-2. Agentless or agent-based? What read permissions does your role or service principal need, and can we review them?
CSPM-3. How often is configuration re-scanned, and do you react to change events or only poll?
CSPM-4. Which benchmarks and frameworks are mapped out of the box (CIS, PCI DSS, HIPAA, ISO 27001, NIST 800-53), and can we write custom policies as code?
CSPM-5. How do findings route to owners (ticketing, chat, pull requests), and can we suppress with an expiry and a reason?

IMAGE SCAN QUESTIONS (Container image and registry scanning)
Image scan-1. Do you scan in CI, in the registry and at runtime, and link the three so one vulnerability is one finding?
Image scan-2. Do you produce and ingest SBOMs (SPDX, CycloneDX)?
Image scan-3. Can a policy fail a build or block deployment of an image above a threshold, with time-boxed exceptions?

IAC SCAN QUESTIONS (Infrastructure-as-code scanning)
IaC scan-1. Is the IaC policy set the same as the runtime posture policy set, so a rule fixed in code matches the finding in the cloud?
IaC scan-2. Can you trace a runtime finding back to the IaC file and line that created it, and open a fix pull request?
IaC scan-3. Which IaC languages and module registries do you support?

CWPP QUESTIONS (Cloud workload protection)
CWPP-1. Agent, agentless snapshot scanning, or both? What does each mode see that the other cannot?
CWPP-2. For runtime detection: what is the kernel mechanism (eBPF, kernel module), CPU and memory overhead, and supported OS and kernel versions?
CWPP-3. Can you block or only alert? What is the false-positive rate on a workload we provide during the trial?
CWPP-4. How are vulnerabilities prioritised: CVSS only, or also exploitability (CISA KEV, EPSS), internet exposure and whether the package is loaded?

CIEM QUESTIONS (Cloud infrastructure entitlement management)
CIEM-1. Do you compute effective permissions (including resource policies, permission boundaries, SCPs and group nesting), or only list attached policies?
CIEM-2. How do you treat machine identities: service accounts, workload identities, CI/CD roles and access keys?
CIEM-3. Can you show unused permissions over a period we choose, and generate a least-privilege policy we can review before applying?
CIEM-4. Do you show cross-account and cross-cloud privilege-escalation paths, and federated identities from our IdP?

CDR QUESTIONS (Cloud detection and response)
CDR-1. Which log sources do you ingest (CloudTrail, Azure Activity and Entra logs, Google Cloud Audit Logs, Kubernetes audit logs), and who pays the log egress cost?
CDR-2. How do detections reach our SIEM or SOAR, and in what format?
CDR-3. Can you show a real detection-to-response timeline from a trial in our environment?

DSPM QUESTIONS (Data security posture management)
DSPM-1. Does classification run inside our account, or is data copied to your platform? Where are samples stored and for how long?
DSPM-2. Which stores do you cover (object storage, managed databases, warehouses, snapshots, SaaS)?
DSPM-3. How do you combine data sensitivity with exposure and identity paths to rank risk?

Trial on your own accounts, with the same test cases for every vendor. Ask for evidence, not slides.

Loading…

TL;DR

The short answer

5 points

A CNAPP (cloud-native application protection platform) is a category, not a single control: it bundles posture management (CSPM), workload protection (CWPP), entitlement management (CIEM) and often Kubernetes posture, image and IaC scanning and data security posture (DSPM) into one platform.
Posture management comes first for almost everyone, because misconfiguration is the problem every cloud estate has.
Identity (CIEM) rises fast with scale and machine identities; workload protection rises with internet-facing apps and VMs; Kubernetes adds its own posture layer.
A single-cloud, small estate with no dedicated staff is usually better served by the provider's native services first.
The case for a consolidated platform is correlation: one inventory and one risk that combines exposure, vulnerability, identity and data. Test that claim in a trial on your own accounts.

The capabilities inside a CNAPP

For the background, read What is CNAPP?

CSPM

Cloud security posture management

Continuously checks cloud account configuration against benchmarks (CIS, provider best practice, compliance frameworks) and flags drift.

Answers: Is anything public that should not be? Is logging on? Is encryption on? Which accounts break our baseline?

CIEM

Cloud infrastructure entitlement management

Maps who and what (people, roles, service accounts, workload identities) can do what across clouds, and finds unused or excessive permissions.

Answers: Who can reach production data? Which permissions were granted but never used? Which identity paths lead to admin?

CWPP

Cloud workload protection

Protects running workloads (VMs, containers, functions): vulnerability assessment, malware detection, hardening and runtime threat detection.

Answers: Which running workloads have exploitable vulnerabilities? Is anything behaving like an attacker right now?

KSPM

Kubernetes security posture management

Checks cluster and workload configuration (RBAC, pod security, network policy, admission control) against the CIS Kubernetes Benchmark and hardening guides.

Answers: Are pods running privileged or as root? Who has cluster-admin? Is there any network policy at all?

Image scan

Container image and registry scanning

Scans images in CI and in registries for vulnerable packages, secrets and misconfiguration, before and after they deploy.

Answers: Which images in production carry critical vulnerabilities, and which build introduced them?

IaC scan

Infrastructure-as-code scanning

Scans Terraform, CloudFormation, Bicep, Helm and Kubernetes manifests in pull requests so misconfigurations never deploy.

Answers: Would this change open a bucket or a security group before it merges?

DSPM

Data security posture management

Discovers and classifies sensitive data across cloud stores and shows who can reach it and how it is protected.

Answers: Where is our regulated data, is it encrypted, who can read it, and is there any copy we forgot?

CDR

Cloud detection and response

Detects attacker activity in cloud control-plane logs (API calls, identity events) and correlates it with workload signals.

Answers: Is someone using a stolen key, creating new admin users or disabling logging right now?

How the priorities are set

Each capability gets a score from your inputs: number of clouds and accounts, which workloads you run, how much infrastructure is in code, whether you hold sensitive data, how many machine identities you have, whether apps face the internet, and the size of the team that will act on findings. Scores fall into three phases (first 90 days, 3 to 6 months, 6 to 12 months). The weights are PlayCISO's judgement built on the NIST, NSA, CISA, CIS and CSA guidance below.

We do not rank vendors or repeat vendor claims. The RFP pack is designed so every vendor answers the same questions with evidence from a trial in your environment.

Frequently asked questions

What is CNAPP?

CNAPP stands for cloud-native application protection platform, a category name introduced by Gartner in 2021. It describes platforms that combine cloud security posture management (CSPM), cloud workload protection (CWPP), cloud infrastructure entitlement management (CIEM) and related capabilities such as Kubernetes posture, image and infrastructure-as-code scanning, so cloud risk can be seen and prioritised from code to runtime in one place.

What is the difference between CNAPP and CSPM?

CSPM checks cloud account configuration against benchmarks and flags drift. It is one part of a CNAPP. A CNAPP adds workload protection, identity entitlements and usually shift-left scanning, and correlates them, for example ranking a vulnerable VM higher because it is internet-exposed and its role can read sensitive data.

What is the difference between CSPM and CWPP?

CSPM looks at how the cloud control plane is configured (storage access, network rules, logging, encryption). CWPP looks at what runs on it (VMs, containers, functions): vulnerabilities, malware and runtime behaviour. A perfectly configured account can still run a vulnerable workload, and the reverse.

What is CIEM?

Cloud infrastructure entitlement management works out the effective permissions of every person and machine identity across clouds, finds unused or excessive access and shows escalation paths. It matters more as accounts and service identities multiply.

Do I need a CNAPP or are native cloud tools enough?

For one cloud, a small estate and no dedicated cloud security staff, the provider's native posture and threat detection services are usually the right start. A consolidated platform earns its cost with several clouds, larger estates, Kubernetes, and a team that will act on correlated findings. Microsoft, for example, describes its own Defender for Cloud as a CNAPP.

Does this tool rank CNAPP vendors?

No. It prioritises capabilities for your estate and gives you questions to ask every vendor. Open-source projects and cloud-native services are listed only as examples of what exists. Run every vendor through the same trial on your own accounts.

Sources

NIST: SP 800-190, Application Container Security Guide (Sep 2017). Container risks sit in images (vulnerabilities, embedded secrets, untrusted sources), registries, orchestrators, containers and the host OS; it recommends container-specific vulnerability management and runtime defences rather than relying on traditional host tools.
NSA and CISA: Kubernetes Hardening Guide v1.2 (Aug 2022). Scan containers and pods for vulnerabilities and misconfigurations, run with least privilege, use network separation, strong authentication and RBAC, and audit logging to detect malicious activity.
CISA and NSA: Cloud security best practices (five Cybersecurity Information Sheets) (7 Mar 2024). Covers secure cloud identity and access management, key management, network segmentation and encryption, securing data in the cloud, and mitigating risk from managed service providers.
Center for Internet Security: CIS Benchmarks (read 31 Oct 2026). Consensus configuration baselines for AWS, Azure, Google Cloud, Kubernetes and more; most posture tools report against them.
Cloud Security Alliance: Cloud Controls Matrix (CCM) (v4.1, Jan 2026). A cloud control framework in 17 domains, including Identity & Access Management, Infrastructure & Virtualization Security, Logging & Monitoring, and Threat & Vulnerability Management; useful for framing RFP coverage questions.
CNCF: Falco graduation announcement (29 Feb 2024). Falco, an open-source runtime security tool for Linux and Kubernetes, reached CNCF graduated status.
Microsoft Learn: What is Microsoft Defender for Cloud? (read 31 Oct 2026). Microsoft describes Defender for Cloud as a cloud-native application protection platform combining DevSecOps, posture management (CSPM) and workload protection (CWPP).