The job to be done
Find risky paths through cloud resources and fix the conditions that make them possible.
Cloud and workload security connects configuration, identity, software and runtime evidence across cloud environments. Cloud security posture management checks settings and exposure. Cloud-native application protection platforms combine several related functions, but their modules still have different dependencies. A read-only account connector may find an exposed storage resource while a workload sensor observes a running process. Effective evaluation starts by identifying which question each signal can answer, who owns the affected resource and what remains outside the selected cloud, service or deployment coverage.
What goes in
- Cloud configuration and audit data
- Identity permissions
- Workload and deployment information
What should come out
- Exposure and entitlement findings
- Workload detections
- Preventive checks in delivery workflows
Inside the segment
These capabilities answer different questions. Use the distinction to define the work before assembling a shortlist.
Native cloud controls
Collect provider-specific configuration checks, threat findings and workload assessments.
Boundary: Services can have separate regional enablement, permissions and charges even when a common dashboard displays their results.
Cloud posture
Assess configuration, drift and publicly reachable resources against selected policies.
Boundary: A configuration finding is not evidence of a live attack or of complete runtime coverage.
Cloud entitlements
Examine effective cloud permissions and excessive access across humans and workloads.
Boundary: Cloud entitlement analysis is related to identity governance and privileged access, but does not replace every identity lifecycle or session control.
Workload and runtime protection
Observe or control supported process, file, network and other activity on running workloads.
Boundary: Sensors and service integrations vary across virtual machines, containers, serverless and managed services.
Code and deployment security
Assess images and infrastructure definitions before deployment and connect findings to their development owners.
Boundary: A passing pipeline check does not prevent every later configuration change or runtime behavior.
How the work flows
Map assets and questions
Inventory accounts, subscriptions, projects, services and owners. Decide whether each question requires configuration, permission, image or live runtime evidence.
Connect the minimum lab scope
Use isolated accounts and synthetic resources. Record connector permissions, data handling, estimated spend and how to remove the integration before enabling paid features.
Verify each signal
Compare discovered resources with a known inventory. Distinguish API and snapshot findings from agent or service-based runtime events and record coverage gaps.
Route and correct
Send a supported finding to the team that can change the resource or source template. Verify the correction at the resource, then observe the next assessment.
Operate through change
Monitor connector and sensor health, account onboarding, module changes and lifecycle notices. Retest after a workload, cloud feature or collection method changes.
The environment changes the question
Use these scenarios to adapt the evaluation to your organization. They describe operational concerns, not a determination of compliance.
Finance ↗
A payments team evaluates synthetic cloud resources for logging, network exposure and excessive service-role permissions.
Evaluate: Connect findings to actual control evidence and resource ownership; framework mappings alone do not establish audit success.
Utilities ↗
An operator examines a cloud-hosted test historian and customer portal while keeping plant control networks outside the lab.
Evaluate: Separate cloud identity and workload coverage from operational-technology network monitoring.
Manufacturing ↗
A factory analytics team evaluates a non-production Kubernetes cluster and a supplier integration role.
Evaluate: Check disconnected operation, supported sensors and vendor-access boundaries before selecting cloud-only collection.
Healthcare ↗
A health system tests a synthetic imaging pipeline with cloud storage and a small processing workload.
Evaluate: Review scan permissions, data handling and processing locations while selecting runtime signals according to the workload.
Retail & e-commerce ↗
A retail platform team examines a synthetic seasonal service that creates short-lived containers.
Evaluate: Measure whether resource changes and runtime signals are visible quickly enough for the team’s operating workflow.
What drives the operating cost
- Cloud accounts, workload counts, scanned data and selected modules can use different billing meters; obtain a scope-specific estimate.
- Snapshot scanning, configuration recording and cloud-native integrations can create provider charges in addition to a platform subscription.
- Runtime agents add deployment, compatibility, health monitoring and incident-review work beyond agentless onboarding.
- Log retention, findings export, data processing locations and migration work affect the operating cost of the chosen design.
Questions worth asking
- Which accounts, regions, services, and workload types are covered?
- What permissions does the platform itself require?
- Can the team trace a finding back to the responsible infrastructure change?
Common assumptions to check
Agentless cloud scanning supplies complete runtime protection.
APIs and snapshots describe particular states. Live process behavior requires the relevant sensor or service integration on a supported workload.
A CNAPP subscription protects every service in every connected cloud.
Modules, providers and workload types have separate coverage and dependencies. Verify the actual matrix rather than treating account connection as complete onboarding.
A compliance mapping proves the application is secure or certified.
Mappings relate findings to selected requirements. They do not replace organizational control implementation, evidence review or independent assessment.
APPLY THE IDEA / EVALUATION PLAN
Make the outcome observable.
Model an intentionally public test resource, an overbroad role, and a sensitive data path. Explain how the conditions combine, then remove one.
Record an authorized baseline and known inventory.
The team lists synthetic assets, intended permissions, selected services, approved spend and rollback steps.
Test posture and runtime separately.
A harmless configuration deviation and a benign documented runtime event produce distinguishable findings with identifiable sources.
Verify remediation with the owner.
The resource or source template is corrected, legitimate operation continues and the relevant finding reflects the change after processing.
Test coverage gaps and lifecycle continuity.
A missing connector or sensor is visible, exported evidence remains usable and affected retiring features have an explicit continuity plan.
Use synthetic data and an authorized test environment. Record scope, product edition, permissions, results, and recovery behavior.
Vendors & products
14 profilesAn editorial selection of relevant offerings, with documented scope and practical evaluation questions. Atlas Fold provides a separate provisional documentation assessment for selected offerings; inclusion in this directory is not a ranking.
Amazon Web Services / Native AWS security services
AWS Security Hub and Workload Security
Security Hub, Security Hub CSPM, Inspector, and GuardDuty retain distinct technical roles. Current Essentials pricing bundles specified capabilities while add-ons and excluded features have other meters. Verify regional enablement, resource support, and the actual plan.
Microsoft / Native Azure and multicloud CNAPP
Microsoft Defender for Cloud
Foundational posture, paid Defender CSPM and workload-specific Defender plans have different coverage and billing. Some workload protections need Azure Arc or sensors; other service protections use cloud integrations. Map dependencies separately for each selected plan.
Google Cloud / Native Google Cloud posture and detection
Google Security Command Center
Confirm the activation scope and target tier. Enterprise is deprecated with shutdown on or after 21 May 2027 and a default move to Premium. Verify separately affected features and future integrations; Wiz is a separate product.
Product transitionWiz / Multicloud CNAPP
Wiz
This profile covers the Wiz platform and separately scoped Sensor capability. Agentless API or snapshot visibility is not runtime monitoring. Verify cloud, workload and module coverage rather than assuming the same capability exists for every connected account.
Palo Alto Networks / Application, posture and runtime security
Palo Alto Networks Cortex Cloud
Confirm whether a deployment or quotation refers to Cortex Cloud, Prisma Cloud or particular modules. Naming evolution alone does not prove every customer must migrate. Identity products acquired through CyberArk are separate from CNAPP runtime coverage.
Orca Security / Agentless scanning and runtime CNAPP
Orca Security
SideScanning and Orca Sensor serve different purposes. Confirm snapshot or disk access, supported workload types and runtime sensor requirements. Agentless assessment should not be described as continuous process prevention merely because it identifies a vulnerable package.
CrowdStrike / Cloud posture and workload protection
CrowdStrike Falcon Cloud Security
Cloud Security, container protection and managed offerings have separate packaging and coverage. Confirm the feature matrix for each cloud and workload; an agentless posture connection does not establish the same protection as a configured workload sensor.
Sysdig / Runtime-focused cloud and Kubernetes security
Sysdig
Runtime sensing, posture and Kubernetes assessment have different deployment requirements. Falco and eBPF-related detection require supported instrumentation; an API-only posture connection does not provide the same process visibility. Verify kernel, cluster and workload support before rollout.
Fortinet / Posture, workload and development security
Fortinet FortiCNAPP
Confirm the current FortiCNAPP edition and the modules retained in any existing Lacework deployment. Agentless control-plane collection and workload agents have different visibility; a shared platform name does not mean every runtime or development function is enabled.
Tenable / Cloud exposure and entitlement management
Tenable One Cloud Exposure
This profile covers the documented Cloud Security and Cloud Exposure capability areas. Verify selected modules, cloud connectors and runtime requirements. Existing Tenable vulnerability-management coverage does not automatically establish cloud entitlement, container or runtime visibility.
Check Point / CNAPP transition and cloud network security
Check Point CloudGuard and Wiz CNAPP
Scope the existing Check Point CNAPP deployment separately from Cloud Firewall and web-application firewall products. Use the partnership FAQ for migration planning; older CNAPP marketing pages should not be treated as proof that every module remains unchanged.
Product transitionAqua Security / Container and cloud workload security
Aqua Security
The platform documents several deployment and workload patterns, but coverage must be confirmed for the chosen environment. Image scanning, pipeline controls and runtime enforcement require different integrations; product assurances or authorization claims should not replace a scoped technical evaluation.
Trend Micro / Cloud posture within a broader security platform
TrendAI Vision One Cloud Security
Current documentation uses TrendAI Vision One, formerly Trend Vision One. Check the cloud-account comparison for each requested capability, and scope agents, integrations and subscriptions separately. Agentless disk or image scanning is not equivalent to host runtime monitoring.
Upwind / Runtime-focused CNAPP
Upwind
This profile covers the documented CNAPP approach, including agentless assessment and separately deployed runtime sensors. Verify platform and workload support in a lab; marketing claims about detection speed or reduced noise are not independent performance evidence.