# 7. Cloud Security: CSPM, CNAPP, CWPP
Onwards to a category that has exploded in acronyms and vendor consolidation faster than anyone can keep up. Cloud security is genuinely complex, but vendors have made it sound more complex than it needs to be, in order to sell you platforms.
Context: Let me decode the alphabet soup first, because vendors love hiding behind it:
- CSPM (Cloud Security Posture Management), finds misconfigurations in your cloud accounts (open S3 buckets, overly permissive IAM, unencrypted databases). The "are we configured securely?" tool.
- CWPP (Cloud Workload Protection Platform), protects the workloads themselves (VMs, containers, serverless functions). The "is the running thing safe?" tool.
- CIEM (Cloud Infrastructure Entitlement Management), manages cloud identity permissions and entitlements (because IAM in AWS/Azure/GCP is a nightmare). The "who can do what in my cloud?" tool.
- KSPM (Kubernetes Security Posture Management), CSPM but specifically for Kubernetes.
- DSPM (Data Security Posture Management), finds and protects sensitive data wherever it lives.
- CNAPP (Cloud-Native Application Protection Platform), the "we'll do all of the above in one platform" category. Gartner's invented mega-acronym that vendors embraced for ARR reasons.
The market has consolidated hard toward CNAPP, with vendors like Wiz, Palo Alto Prisma, Lacework, Orca, Sysdig, and CrowdStrike Falcon Cloud claiming end-to-end coverage. The truth: most CNAPPs are stronger in their original DNA (CSPM-first vendors are weaker on workload, CWPP-first weaker on posture, etc.), and "agentless" is both their biggest selling point and biggest blind spot.
The core question for any cloud security tool: "Does this help me find the actual exploitable risk in my cloud, or just generate 50,000 'critical' misconfigurations my team can't possibly action?"
14 Questions to Ask Cloud Security Vendors
1. "Walk me through your coverage honestly, across AWS, Azure, GCP, and any others I use. Where are you strongest, where are you weakest, and what's still on the roadmap?"
Why: Almost every CNAPP started life on one cloud and treats the others as second-class citizens. If you're a multi-cloud shop, depth matters more than breadth.
Good answer: Honest delta between clouds, named feature gaps, roadmap dates. Red flag: "We cover all clouds equally" (almost certainly false).
2. "Are you agentless, agent-based, or both? What does each approach actually see, and miss?"
Why: This is the most important architectural question in cloud security today. Agentless (snapshot scanning, API-based) is fast to deploy but misses runtime threats. Agent-based sees runtime but adds friction. Vendors lean on whichever is their strength.
Good answer: Honest discussion of trade-offs, hybrid options, what runtime visibility requires. Red flag: "Agentless gives you everything" (it doesn't, it can't see live exploits).
3. "Show me your prioritization model. If I have 100,000 cloud findings, how does your platform tell me what's actually exploitable in my environment?"
Why: Same problem as VM (Topic 5), only worse. Cloud generates findings at firehose volume. Without ruthless prioritization based on reachability, blast radius, and actual exposure, you get noise.
Good answer: Attack path analysis, internet exposure correlation, sensitive data + identity + vulnerability chains, risk scoring with transparent logic. Red flag: CIS benchmark pass/fail with no context.
4. "How do you reason about attack paths, for example, an over-permissive IAM role + an exposed workload + a vulnerable container + access to a sensitive S3 bucket?"
Why: Atomic findings (this bucket is public, this role is over-permissive) are far less useful than chained findings (this public bucket is reachable from this vulnerable workload via this over-permissive role, leading to PII). Modern tools must reason graphically.
Good answer: Native graph-based analysis, visualizable attack paths, blast-radius modeling. Red flag: Flat findings list without relational reasoning.
5. "How do you handle Kubernetes specifically, cluster posture, runtime, supply chain, admission control, and workload identity?"
Why: K8s is its own universe of risk. Many CNAPPs claim K8s coverage but really mean "we scan your cluster config." Real K8s security includes admission control, runtime threat detection, and image provenance.
Good answer: KSPM + runtime + admission controllers + image scanning + identity. Red flag: "We support Kubernetes" with no detail.
6. "What's your story on Infrastructure-as-Code (IaC) and shift-left? Do you scan Terraform, CloudFormation, ARM, Helm, etc., before deployment, and how do you integrate into CI/CD?"
Why: Catching misconfigurations before they ship is dramatically cheaper than after. But IaC scanning is often a half-baked feature added to legacy CSPM tools. Quality varies wildly.
Good answer: Native IaC scanning, native git/CI integrations, policy-as-code, developer-friendly remediation guidance. Red flag: "We scan post-deployment and notify you."
7. "How do you handle CIEM, discovering and right-sizing cloud permissions? Show me how you reduce permission sprawl in practice."
Why: Cloud IAM (especially AWS) is incomprehensibly complex. Most accounts have permission sprawl that would horrify an auditor. CIEM done well is one of the highest-ROI cloud security investments. Done badly, it's another report that gets ignored.
Good answer: Permission usage analysis, automated right-sizing recommendations, JIT access workflows, integration with the actual cloud IAM. Red flag: "We identify over-privileged roles" (and then what?).
8. "How do you detect runtime threats, cryptomining, lateral movement, container escapes, API abuse, and what's your false positive rate compared to your CSPM findings?"
Why: Posture tools find what could go wrong; runtime tools find what is going wrong. Both matter. Vendors strong on posture often weak on runtime, and vice versa.
Good answer: Named detection techniques, MITRE ATT&CK for cloud mapping, low-FP runtime telemetry, eBPF or kernel-level visibility. Red flag: "Our posture findings prevent runtime issues" (only partially true).
9. "How do you handle data security, knowing where sensitive data lives in my cloud, who can access it, and whether it's at risk?"
Why: DSPM has emerged as critical because cloud data sprawl is universal. Sensitive data ends up in dev databases, logs, snapshots, and forgotten S3 buckets. Tools that don't reason about data are missing the prize.
Good answer: Native data discovery and classification, cross-referenced with access paths and exposures, sensitive-data-in-attack-path scoring. Red flag: "We integrate with DSPM tools" (= they don't do it).
10. "How does your pricing scale, by accounts, workloads, vCPUs, scanned data, or something else? What's the realistic 3-year cost as my cloud grows?"
Why: Cloud security pricing is opaque and often punitive as you grow. Vendors love quoting initial pricing while hiding scaling clauses. Get a 3-year TCO model in writing.
Good answer: Transparent unit pricing, predictable scaling, no penalty for cloud growth, clear definitions. Red flag: "Pricing depends on your usage" with no calculator.
11. "How do you handle multi-account, multi-tenant, multi-organization environments, including M&A scenarios, separate business units, and shared services?"
Why: Real enterprise cloud is messy, dozens to thousands of accounts, organizational units, separately governed business units. Many tools assume a clean single-org structure and fall down at scale.
Good answer: Native multi-org support, role-based access aligned to your org structure, hierarchical policy management. Red flag: "You can configure per-account."
12. "How do you handle remediation, automated, semi-automated, or just findings + tickets? And who's accountable for fixing what?"
Why: Findings without remediation are wallpaper. The question is whether your cloud team can act on them, whether your platform can auto-fix some, and how that integrates with developer workflows.
Good answer: Tiered remediation (auto for low-risk, human-approved for medium, ticketed for high), integration with PR workflows, ownership tagging. Red flag: "We give you the visibility; you handle the rest."
13. "How do you secure your own access to my cloud? What permissions do you require, where do you store credentials, and what's your blast radius if you're breached?"
Why: Every CSPM/CNAPP needs read access (often broad) to your cloud accounts. A breach of the vendor = a breach of your environment. This question separates security-mature vendors from the rest.
Good answer: Least-privilege role models, no stored credentials (assume role / OIDC federation), customer-controlled access, transparency on internal access controls. Red flag: "We require admin/owner-level access" or vague permission descriptions.
14. "If I leave you, what happens to my historical findings, custom policies, exceptions, and trend data? Can I export everything in a usable format?"
Why: Cloud security trend data (posture improvement, MTTR for misconfigs) is valuable to maintain across vendor changes. Most CNAPPs use proprietary formats that don't port. Get exit terms clear.
Good answer: Open standards (OCSF, CycloneDX), bulk export, transition support. Red flag: "Our customers don't typically leave."
🎯 The Meta-Test
- Q2, Q3, and Q4 are the modern cloud security litmus test. Vendors who can't answer these well are selling 2018-era CSPM with new branding.
- Q7 and Q9 are the "where are the actual breaches happening" test. Identity sprawl and data exposure are the new perimeters.
- Q10 and Q13 are the trust test. A vendor with opaque pricing and broad permissions is asking you to take on too much risk.
💡 Honest Observation
For "regular" companies, the cloud security market has become genuinely confusing because of three trends:
- CNAPP consolidation is a double-edged sword. Buying one platform is operationally simpler than 6 point tools, but you're betting on one vendor being good at everything, which they almost never are. The right answer for many mid-market shops is a strong CNAPP for posture + a separate runtime/EDR-cloud tool for workload protection.
- Agentless is overhyped. It's fast to demo and deploy, which makes it a sales engine, but it's snapshot-based and blind between scans. If runtime threats matter to you (they should), you need agents somewhere in your stack. Vendors selling "agentless everything" are optimizing for sales cycles, not security outcomes.
- The real cloud security gap is operational, not technological. Most companies don't lack tools, they lack cloud expertise on the security team. A CNAPP without engineers who understand IAM, networking, and Kubernetes is an expensive dashboard. Budgeting for skills (or managed services) is usually higher leverage than buying another tool.
For mid-market organizations, the practical sequence is usually:
- Get CSPM right first, close the obvious misconfigurations, especially internet exposure and IAM
- Add CIEM, right-size permissions before adding more workloads
- Add runtime/CWPP, once posture is under control, defend the running things
- Layer in DSPM, once you know what's running, know where the sensitive data is
The vendor pitch ("buy our CNAPP and you're covered") is rarely the right starting point. Start with the highest-ROI capability for your cloud maturity, not the shiniest platform.
