Cloud-Native Application Protection Platform (CNAPP) Cheat Sheet

Updated 2026-05-21

Next Topic: Cloudflare Workers Cheat Sheet

🧠Study flashcards on this topic126 cards · spaced repetition→

A CNAPP (Cloud-Native Application Protection Platform) is a unified security suite that consolidates CSPM, CWPP, CIEM, KSPM, DSPM, ASPM, and CDR into a single integrated platform, covering cloud-native applications from code commit through production runtime. Coined by Gartner in the 2021 Hype Cycle for Cloud Security, the term captures a deliberate shift away from point-tool sprawl toward a cohesive risk engine that connects posture, identity, workload, data, and runtime signals into one prioritized view. The critical insight driving adoption is that cloud breaches rarely stem from a single finding — they emerge from toxic combinations: a misconfigured storage bucket combined with an over-permissioned IAM role combined with an internet-exposed workload, each individually medium-risk but collectively critical. CNAPP platforms address this by modeling every cloud resource and relationship in a security graph, surfacing the attack paths that matter rather than the theoretical noise that doesn't.

What This Cheat Sheet Covers

This topic spans 17 focused tables and 142 indexed concepts, 126 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: CNAPP Architecture and Core ComponentsTable 2: CNAPP vs. Point Tools — The Consolidation CaseTable 3: Agentless vs. Agent-Based ScanningTable 4: Vulnerability Prioritization and Reachability AnalysisTable 5: Identity and Entitlement Security (CIEM)Table 6: Runtime Threat Detection and ResponseTable 7: IaC Security and Shift-Left IntegrationTable 8: Data Security Posture Management (DSPM) and Secrets DiscoveryTable 9: Kubernetes and Container Posture (KSPM)Table 10: AI Workload Protection (AI-SPM)Table 11: Compliance Frameworks and Automated AssessmentTable 12: CNAPP Integration with SIEM, SOAR, and TicketingTable 13: Multi-Cloud and Hybrid CoverageTable 14: CNAPP Vendor LandscapeTable 15: Deployment Patterns and CNAPP OnboardingTable 16: Common Pitfalls and Operational ChallengesTable 17: POC and Vendor Evaluation Criteria

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: CNAPP Architecture and Core Components

Every CNAPP is built on the convergence of several formerly standalone cloud security disciplines into a single data model and policy engine. Understanding what each pillar does — and how they reinforce each other — is the foundation for evaluating and operating any CNAPP product.

Concept	Example	Description
CSPM (Cloud Security Posture Management)	S3 bucket has `PublicAccessBlock` disabled → flagged critical	Continuously monitors cloud resource configurations via provider APIs (AWS Config, Azure Resource Graph, GCP Cloud Asset Inventory), identifying misconfigurations against benchmarks such as CIS, NIST, PCI DSS, and SOC 2.
CWPP (Cloud Workload Protection Platform)	Falco rule fires when `execve` is called inside a running container	Provides vulnerability scanning, malware detection, and behavioral runtime monitoring for VMs, containers, and serverless functions, using agents or agentless snapshot scanning.
CIEM (Cloud Infrastructure Entitlement Management)	IAM role with `AdministratorAccess` has not been used in 90 days	Discovers and governs human and machine identity permissions across cloud environments, enforcing least-privilege by revoking stale or excessive entitlements.
KSPM (Kubernetes Security Posture Management)	`kube-bench` CIS check: API server flag `--anonymous-auth=true`	Automates security assessment of Kubernetes cluster configurations, RBAC policies, network policies, and pod security settings against CIS Benchmarks and custom policies.
DSPM (Data Security Posture Management)	S3 bucket tagged `env:prod` contains unencrypted PHI records	Discovers, classifies, and monitors sensitive data (PII, PHI, PCI) across multi-cloud storage, building exposure graphs that show who can reach what data through which configuration path.
CDR (Cloud Detection and Response)	CloudTrail shows IMDS probe → then credentialed S3 `ListBuckets` → then bulk export	Monitors control-plane logs (CloudTrail, Azure Activity, GCP Audit), VPC flow logs, and workload eBPF telemetry in real time to detect active attacks including lateral movement and data exfiltration.
ASPM (Application Security Posture Management)	SAST finding severity up-scored after runtime confirms code path is reachable	Aggregates and correlates findings from SAST, DAST, and SCA tools into a unified application-layer risk view, prioritizing by business impact and runtime exploitability.
AI-SPM (AI Security Posture Management)	Amazon Bedrock model endpoint exposed publicly; service account has `s3:*` on training bucket	Discovers and secures AI models, pipelines, and datasets by detecting misconfigured endpoints, over-permissioned AI service accounts, exposed model weights, and supply chain risks in public model repos.
Security Graph	Node: EC2 instance → Edge: "has public IP" → Edge: "assumes IAM role with AdministratorAccess"	Graph database that models every cloud resource as a node and every configuration relationship as an edge, enabling attack path traversal to identify exploitable chains across isolated findings.
IaC Security Scanning	Terraform plan shows S3 bucket with `acl = "public-read"` blocked at CI PR stage	Scans Terraform, CloudFormation, ARM, Helm, and Kubernetes YAML templates for misconfigurations and policy violations before infrastructure is provisioned (shift-left).

Table 2: CNAPP vs. Point Tools — The Consolidation Case

The security industry accumulated a decade of purpose-built point tools — one for CSPM, another for container scanning, another for CIEM — that generated independent alerts without cross-domain correlation. Understanding why consolidation into CNAPP delivers qualitative rather than just quantitative improvement helps justify the architectural shift.

Concept	Example	Description
Tool sprawl problem	8 separate security tools, 14 consoles, no shared data model	• Point tools each cover a narrow slice and cannot correlate their findings • a CSPM alert about an IAM misconfiguration and a CWPP alert about a vulnerable package in the same workload never combine into a single prioritized risk

The rest of this section is part of the full cheat sheet

Table 3: Agentless vs. Agent-Based Scanning

The scanning model determines latency, coverage, operational overhead, and runtime enforcement capability — there is no universally correct choice. Most mature CNAPPs deploy both: agentless for rapid posture visibility and agents for real-time runtime detection.

Concept	Example	Description
Agentless scanning	Wiz connects via read-only cloud API; first findings appear within hours of onboarding	• Uses cloud provider APIs and disk snapshot analysis to scan resources without installing software on workloads • fast deployment, zero performance impact, no agent lifecycle management

The rest of this section is part of the full cheat sheet

Table 4: Vulnerability Prioritization and Reachability Analysis

A cloud environment with thousands of CVEs cannot be remediated by severity score alone — CVSS 9.8 findings on isolated internal systems are less urgent than CVSS 6.5 findings on internet-facing containers with admin IAM roles. CNAPP replaces raw severity with context-enriched risk scores that reflect actual exploitability.

Concept	Example	Description
Reachability analysis	CVE-2024-XXXX in a package: loaded in memory, code path reachable from public endpoint → prioritized	Identifies which vulnerable packages are actually executed in production and reachable by attackers, filtering out packages present in images but never loaded at runtime.

The rest of this section is part of the full cheat sheet

Table 1: CNAPP Architecture and Core Components

Concept	Example	Description
CSPM (Cloud Security Posture Management)	S3 bucket has `PublicAccessBlock` disabled → flagged critical	Continuously monitors cloud resource configurations via provider APIs (AWS Config, Azure Resource Graph, GCP Cloud Asset Inventory), identifying misconfigurations against benchmarks such as CIS, NIST, PCI DSS, and SOC 2.
CWPP (Cloud Workload Protection Platform)	Falco rule fires when `execve` is called inside a running container	Provides vulnerability scanning, malware detection, and behavioral runtime monitoring for VMs, containers, and serverless functions, using agents or agentless snapshot scanning.
CIEM (Cloud Infrastructure Entitlement Management)	IAM role with `AdministratorAccess` has not been used in 90 days	Discovers and governs human and machine identity permissions across cloud environments, enforcing least-privilege by revoking stale or excessive entitlements.
KSPM (Kubernetes Security Posture Management)	`kube-bench` CIS check: API server flag `--anonymous-auth=true`	Automates security assessment of Kubernetes cluster configurations, RBAC policies, network policies, and pod security settings against CIS Benchmarks and custom policies.
DSPM (Data Security Posture Management)	S3 bucket tagged `env:prod` contains unencrypted PHI records	Discovers, classifies, and monitors sensitive data (PII, PHI, PCI) across multi-cloud storage, building exposure graphs that show who can reach what data through which configuration path.
CDR (Cloud Detection and Response)	CloudTrail shows IMDS probe → then credentialed S3 `ListBuckets` → then bulk export	Monitors control-plane logs (CloudTrail, Azure Activity, GCP Audit), VPC flow logs, and workload eBPF telemetry in real time to detect active attacks including lateral movement and data exfiltration.
ASPM (Application Security Posture Management)	SAST finding severity up-scored after runtime confirms code path is reachable	Aggregates and correlates findings from SAST, DAST, and SCA tools into a unified application-layer risk view, prioritizing by business impact and runtime exploitability.
AI-SPM (AI Security Posture Management)	Amazon Bedrock model endpoint exposed publicly; service account has `s3:*` on training bucket	Discovers and secures AI models, pipelines, and datasets by detecting misconfigured endpoints, over-permissioned AI service accounts, exposed model weights, and supply chain risks in public model repos.
Security Graph	Node: EC2 instance → Edge: "has public IP" → Edge: "assumes IAM role with AdministratorAccess"	Graph database that models every cloud resource as a node and every configuration relationship as an edge, enabling attack path traversal to identify exploitable chains across isolated findings.
IaC Security Scanning	Terraform plan shows S3 bucket with `acl = "public-read"` blocked at CI PR stage	Scans Terraform, CloudFormation, ARM, Helm, and Kubernetes YAML templates for misconfigurations and policy violations before infrastructure is provisioned (shift-left).

Table 2: CNAPP vs. Point Tools — The Consolidation Case

Concept	Example	Description
Tool sprawl problem	8 separate security tools, 14 consoles, no shared data model	• Point tools each cover a narrow slice and cannot correlate their findings • a CSPM alert about an IAM misconfiguration and a CWPP alert about a vulnerable package in the same workload never combine into a single prioritized risk

Table 3: Agentless vs. Agent-Based Scanning

Concept	Example	Description
Agentless scanning	Wiz connects via read-only cloud API; first findings appear within hours of onboarding	• Uses cloud provider APIs and disk snapshot analysis to scan resources without installing software on workloads • fast deployment, zero performance impact, no agent lifecycle management

Table 4: Vulnerability Prioritization and Reachability Analysis

Concept	Example	Description
Reachability analysis	CVE-2024-XXXX in a package: loaded in memory, code path reachable from public endpoint → prioritized	Identifies which vulnerable packages are actually executed in production and reachable by attackers, filtering out packages present in images but never loaded at runtime.