Gartner describes the challenge of securing cloud native applications thus: “Rather than treat development and runtime as separate problems — secured and scanned with a collection of separate tools — enterprises should treat security and compliance as a continuum across development and operations, and seek to consolidate tools where possible”. *
That’s where CNAPP comes in. The goal of CNAPP is to provide complete end-to-end security for cloud native environments. Instead of using different point solutions that only solve specific security issues and need to be manually stitched together, organizations should use an integrated platform approach.
According to the Gartner innovation insight report, CNAPP is “an integrated set of security and compliance capabilities designed to help secure and protect cloud native applications across development and production” *. There are several major benefits of this. Critically, by sharing context between development and production, CNAPP is able to gain a full view of application risk to consistently secure applications across their entire life cycle.
CNAPP is a unified platform that combines the capabilities of several existing cloud security categories, mainly “shift left” artifact scanning, cloud security posture management (CSPM) and Kubernetes security posture management (KSPM), IaC scanning, cloud infrastructure entitlements management (CIEM), and runtime cloud workload protection platform (CWPP).