Cloud Workload Protection Platforms are security solutions purpose-built to protect the compute layer — virtual machines, containers, and serverless functions — wherever they run across public, private, and hybrid cloud environments. Originally defined by Gartner to distinguish workload-centric security from cloud configuration tools like CSPM, CWPP addresses a critical gap: an attacker who gains a foothold inside a running workload is invisible to controls that only inspect cloud API settings. The discipline covers the full protection arc from pre-deployment image scanning through live runtime monitoring, behavioral anomaly detection, and forensic response. A key mental model: CWPP protects the inside of the execution environment, while CSPM protects the cloud platform around it — both are necessary, and modern CNAPP platforms increasingly unify them.
What This Cheat Sheet Covers
This topic spans 16 focused tables and 115 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: CWPP Core Concepts and Definitions
Gartner coined the CWPP category to describe tools that secure server workloads throughout their lifecycle, an important distinction from network-perimeter or endpoint tools. Understanding these foundational terms and their boundaries is the prerequisite for evaluating any CWPP solution.
| Concept | Example | Description |
|---|---|---|
Sysdig Secure, Aqua Security, CrowdStrike Falcon Cloud Security | Unified security solution offering continuous threat monitoring, detection, and prevention for cloud workloads (VMs, containers, serverless) across hybrid and multi-cloud infrastructure. | |
EC2 instance, EKS pod, AWS Lambda function, GCE VM, Azure Container App | Any compute resource running in cloud or hybrid infrastructure — including static databases, ephemeral containers, batch jobs, and scheduled functions — that CWPP must protect. | |
Detecting a container spawning /bin/bash unexpectedly | In-execution monitoring of running processes, system calls, file access, and network connections to detect attacks in progress, including zero-days that bypass pre-deployment scanning. | |
CWPP: detects crypto-miner process inside a VM; CSPM: flags an open S3 bucket | • CWPP = workload runtime security (inside the execution environment) • CSPM = cloud infrastructure configuration posture (cloud platform settings and APIs) |