Cloud-Native Application Protection Platforms (CNAPP)

Acquired by Google. Wiz is the leader in having an all-in-one cloud security platform by expanding into CTEM, ASPM, and Runtime capabilities all within a single dashboard. Their posture and vulnerability capabilities remain the strongest, but their Code and Defend offerings are competitive in their own right.

Upwind has built CNAPP from the ground-up around runtime insights provided from a network focused endpoint agent. They provide unique features like API security, alongside vulnerability prioritization and scanning, and the more generic CNAPP feature sets.

The core of Sweet Security is powerful incident detection and response capabilities for cloud environments. They have since created a larger CNAPP platform expanding more into vulnerability management, posture, and identity capabilities

Every organization using AWS should absolutely turn on GuardDuty as their first cloud security step. They provide awesome base level protections and detections at a low price. An especially amazing check the box runtime protection tool.

Orca offers the standard suite of CNAPP features with a focus on agentless scanning. They're a good all around CNAPP offering mostly focused on the posture side.

Stream Security provides real time cloud context for enterprise security operations teams. The solution fills in the missing configuration gaps with most existing EDR and SIEM approaches to cloud security by providing real time information about how the cloud environment is changing to detect and respond to threats faster.

AccuKnox began with the open source project KubeArmor and has since built into a larger CNAPP platform. Their specialization is runtime protection policies for Kubernetes, which allows for granular rules on which processes can access which files.

Tenable offers a robust ecosystem of vulnerability scanning solutions, most recently consolidated with their Tenable One Exposure Management platform. Tenable offers scanning from cloud to DAST to network scanning, and is widely deployed across enterprises in order to consolidate different scanners. Their exposure management platform has done a great job bringing together their various data points, creating a more unified experience that the platform had been missing.

SentinelOne was one of the first major security providers to normalize their data into a data lake architecture, and the benefits are more clear than ever: giving customers a single place to manage all of their security programs, from EDR to CNAPP to AI Security. Consolidating this data enables teams to run cross-domain investigations without stitching integrations between separate products, and gives Purple AI (their agentic analyst) a unified data plane to reason across instead of guessing at relationships between siloed tools.

Cyscale checks all the boxes for a CNAPP, but their tracking of user identities stands out in the space. They have great visualizations, and have an agent for K8s support. A strong entry in the CNAPP market.

Aqua Security built a lot of the open source projects that power modern cloud security, and can go feature for feature with most other CNAPP platforms. The downside of the CNAPP has been the UI/UX, and the focus has always been on container protection more than holistic cloud security features.

Cortex Cloud is a security operations platform that integrates cloud and application security capabilities into their larger security operations offerings. This provides a single hub for managing first and third party findings across vulnerabilities and runtime events.

Datadog offers a complete suite a security offerings that are a great fit for developer focused teams not looking for the most mature details in each area. They offer most scanning types, runtime detections, and a full SIEM, and you're probably already sending them your logs. It's a great runtime choice to meet developers where they work, but the UX is built primarily for developers.

ARMO has all of the features of a CNAPP, but with a special emphasis on runtime security and Kubernetes. Their open source Kubescape is a great tool for scanning Kubernetes clusters, and their paid offering provides true CADR runtime protection and compliance features.

CrowdStrike's container runtime technically works, but deployment, maintenance, and usefulness do not compare to other tools at the time of testing. CrowdStrike's Windows offerings remain dominant in the space, but their CNAPP and container security solutions are difficult to recommend.

Sysdig created the first runtime cloud protection tool with the open source project Falco, and has since built a trusted, enterprise ready, runtime oriented CNAPP platform. The tool is strongest at runtime protection, but offers the standard suite of CNAPP features, and is especially a good choice for regulated industries.

GCP Security Command Center is a supplemental cloud security offering provided natively in the GCP platform. It has great vulnerability and posture scanning capabilities, but lacks a runtime agent for real-time protection. That said, it can be a great extension of cloud security capabilities especially for SOCs.

Check Point's CNAPP offering was closed down in favor of a partnership with Wiz. The platform was actually more competitive than most, but fell just short of competitive offerings.

Deepfence is a great no-frills CNAPP with a ton of optionality. Their Open Source ThreatMapper scans for malware, vulnerabilities, misconfigurations, and secrets. Their paid offering, ThreatStryker, adds eBPF runtime protection - including network and quarantine responses. Their open source is an unbelievable value for a free offering.

Plerion has built a competitive CNAPP offering for smaller teams who don't need all of the features, primarily on the posture side. Alongside CSPM, they provide attack maps, IaC scanning, Secret scanning, and vulnerability scanning. They link findings to assets in a clean and intuitive way. Currently there is no agent based runtime protection.

Uptycs biggest strength is its biggest weakness - it undoubtedly has the most features of any CNAPP platform, from ASPM to container runtime. However, that creates a corresponding UI bloat that's as bad as it gets for these platforms. As a certified Kubernetes enjoyer though, their cluster visibility with Kubequery is quite good.

Runtime-first CNAPP and CADR platform that uses eBPF sensors to validate which vulnerabilities are actually exploitable, detect app-layer attacks in real time, and reveal what AI workloads are doing in production.

Lacework built on top of an alert based approach rather than more traditional scanning models. That has the benefit of reduced noise and a faster reactive approach, but at the cost of surfacing a lot of alerts to security that they don't have the ability to fix.

Defender for Cloud has a lot of comparative features to dedicated CNAPPs, but it's a beast to setup and maintain. It's a good starting point for larger companies who don't have an appetite for a more focused solution, and are addicted to collecting the highest E license as possible.

Firemon has assembled a unique collection of cloud security features - CSPM, JIT AWS access, and alerting off cloudtrail events. While they don't have the full feature set of larger CNAPPs, they provide smart features at an aggressive price. They offer CSPM scanning for free.