What it means
CNAPP is a platform category that brings together several cloud security capabilities. Common combinations include configuration assessment, workload protection, vulnerability information, and development-pipeline findings. Some offerings also emphasize identity permissions or relationships between findings. The category label does not define a universal feature set: supported cloud services, collection methods, licensing, and response capabilities differ. Evaluate the actual capabilities against your applications and operating model. A combined view can help identify related problems, but it does not replace application-specific authorization tests or accountable engineering ownership.
AN ILLUSTRATIVE SCENARIO
Connecting a container finding to a reachable service
A company running an online appointment service finds a vulnerable component in a container image. Its cloud platform also identifies the running workload and its network exposure. The combined context helps the team prioritize the affected deployment and rebuild the image. Engineers still need to verify which version is running, how requests are authorized, and whether the replacement works. An image scan alone cannot establish those runtime and business-logic properties.
Put it to work
- Map required capabilities to your applications, cloud services, and development workflows. Confirm supported environments and exactly which features need additional access, agents, or licenses.
- Connect findings to stable resource identities and owners. Validate important relationships, such as whether a scanned image is the one actually deployed to a reachable workload.
- Route fixes into engineering and operations workflows. Verify changes in both deployment definitions and running systems, and track collection gaps or unsupported resources explicitly.
How to check your work
Follow a representative issue from source or image to the deployed workload, responsible team, completed fix, and runtime verification. Confirm that disconnected accounts or unsupported services appear as coverage gaps rather than silently passing.
Connect the ideas
- CSPM
Checks of cloud configuration against policy, such as public storage or open security groups.
- SCA
Inspection of dependencies and libraries for known vulnerabilities and license issues.
- Shared responsibility
The split of security duties between a cloud or SaaS provider and the customer, which varies by service.
- Coverage
An explicit statement of which sources, time windows, and rows were actually collected, including truncation.