7 Common Requirements in This Category

Question

Accepted Answer

Technical buyers typically look for: 1. Cloud and Workload Coverage Support for the major cloud providers, containers, Kubernetes, serverless, and managed services. A deployment model that fits how workloads actually run (agents, sidecars, eBPF, agentless, or a mix) and can be operated by platform and SRE teams without excessive friction. 2. Build-Time and Pipeline Integration Scanning of IaC templates, container images, and deployment manifests. Integration with SCM and CI/CD systems. Policy-as-code so cloud and security policies can be versioned, tested, and reviewed like application code, with clear ownership for engineering teams. 3. Posture and Vulnerability Management Detection of cloud misconfigurations, exposed services, and unpatched packages or images. Normalisation and deduplication of findings across accounts, clusters, and regions, allowing security and platform teams to work from a single, prioritised view. 4. Identity and Entitlement Awareness (CIEM) Visibility into cloud identities, roles, and permissions. Detection of over-privileged principals, unused access, and risky trust relationships between services and accounts, with enough context for both security engineers and cloud owners to make changes confidently. 5. Risk Correlation and Attack Path Analysis Grouping of findings into risk scenarios. For example, an internet-exposed workload, a vulnerable image, a privilege escalation path, and access to sensitive data. Clear explanation of impact and likely entry points so leadership can understand the risk and teams can agree on priorities. 6. Runtime Visibility and Protection Telemetry from workloads and orchestration layers. Anomaly detection for processes and network flows. Optional enforcement controls that align with existing incident response and change management processes, so operations teams are not surprised by blocking actions. 7. Operational Fit and Reporting Integrations with ticketing, messaging, SIEM, and SOAR. Role-aware dashboards for security, platform, and application teams. Reporting that can be reused for audits, customer assessments, and executive updates, showing how cloud risk is trending over time. With Cybermatch, CNAPP platforms are compared against these criteria so teams can quickly see which vendors align with their cloud footprint, delivery practices, and risk priorities before investing in a PoC.

CNAPP (Cloud Native Application Protection Platform)

Vendor shortlist

What we evaluate

Frequently asked questions