Read as
Why this module exists. Cloud Workload Protection Platforms (CWPP) cover the runtime-protection layer for VMs, containers, and serverless. While CSPM covers configuration, CWPP covers what is running. This module covers the CWPP landscape and the integration patterns.
CWPP vs CSPM
| CSPM | CWPP |
|---|---|
| Configuration of cloud resources | What is running on those resources |
| Public buckets, broad SGs, unencrypted volumes | Malware, intrusion, suspicious processes, file integrity |
| Agentless (mostly) | Agent or eBPF probe per workload |
Mature programmes deploy both. CNAPP (Cloud-Native Application Protection Platform) is the converged offering — CSPM + CWPP + CIEM (identity entitlement management) in one platform.
AWS / Azure / GCP audit?
Get a cloud posture review
IAM hardening, public-exposure mapping, IaC review, K8s audit. We map your actual blast radius — not what a CSPM dashboard guesses at.
Book cloud scoping call
Replies in 4 working hrs · India-only · Senior consultants