IT Glossary · Cloud Security
A CNAPP — Cloud-Native Application Protection Platform — is a single product that combines the cloud security tools organisations used to buy separately: posture management to find misconfigurations, workload protection to defend running servers and containers, entitlement management to control who and what can do things in your cloud, and usually vulnerability and code scanning. The point is not the feature list but the join: one platform can connect a misconfiguration to the workload it exposes and the identity that could exploit it, which four separate tools cannot.
CNAPP exists because the older split stopped making sense. Teams bought CSPM to scan cloud configuration, CWPP to protect servers and containers at runtime, CIEM to untangle cloud permissions, and a scanner for container images — four consoles, four alert queues, and no way to tell which of ten thousand findings actually mattered. A CNAPP ingests all of it and reasons across it: this storage bucket is public, and it is reachable from this container, which runs a vulnerable library, using a role that can read the production database. That chain is one urgent finding; the same facts spread across four tools are four medium-severity tickets that nobody actions. Buying one is mostly a question of which half a vendor is genuinely good at. Vendors that grew from posture management are excellent at breadth, agentless coverage and attack-path analysis, and newer at runtime defence. Vendors that grew from endpoint or server protection are strong at runtime and weaker at cloud graph reasoning. Neither origin is wrong, but the mismatch between what a demo shows and what your team needs daily is where most disappointing CNAPP purchases come from. The second question is coverage boundary: most CNAPPs assume everything runs in a public cloud, and if half your estate is servers in an Indian data centre you need a platform that carries the same policy to them.
Indian cloud estates tend to be young, fast-growing and lightly governed — accounts created for a project and never closed, permissions granted broadly during a launch and never tightened, and Kubernetes clusters run by application teams rather than by a platform group. That is precisely the environment where a posture tool returns thousands of findings and nobody knows where to start, and where attack-path ranking earns its cost. Two India-specific buying notes. First, hybrid is the norm rather than the exception: most Indian mid-market companies still run meaningful workloads in a colocated data centre, so a CNAPP that only understands public cloud leaves half the estate on a different policy and a different console. Second, pricing is counted in units you must inventory before you can be quoted — cloud accounts, resources per account, Kubernetes nodes — and dormant accounts and over-provisioned clusters inflate the number. Cleaning up before procurement is the cheapest saving available on the whole purchase.
Related terms: CSPM, CWPP, CIEM, Kubernetes Security, Container Security, Attack Path Analysis, Shift Left, Cloud Misconfiguration
CSPM is one component of a CNAPP. CSPM alone tells you the cloud is configured badly — a public bucket, an open security group. A CNAPP adds runtime workload protection, entitlement analysis and vulnerability data, and correlates all of it so you learn which misconfiguration is actually reachable and exploitable. If you only need configuration compliance reporting, CSPM alone may be enough and is cheaper.
Not necessarily. On a single-cloud estate the native tools — GuardDuty and Inspector on AWS, Defender for Cloud on Azure — cover a lot with no procurement cycle, and are the sensible starting point. A CNAPP starts to pay when you add a second cloud, when you need the same policy on on-premise servers, or when the native findings volume has outgrown the team's ability to triage it.
Both, and the mix matters. Agentless scanning gives fast, broad coverage of configuration and vulnerabilities without touching the workload, which is how these tools deploy in days. Agents sit in the execution path and can actually stop something happening at runtime. Mature deployments use agentless everywhere for visibility and agents on workloads that matter — internet-facing services and anything holding regulated data.
On countable units rather than seats: cloud accounts, resources per account, workloads by instance size, Kubernetes nodes, and sometimes data ingested. Trend is the one major vendor with published rates you can check — its AWS Marketplace pay-as-you-go listing prices cloud risk management at $0.12 per 500 resources per cloud account per hour and container security at $0.168 per node per hour. The rest are quote-only in India.
Inventory first, and it will be worse than you expect — list every cloud account, who owns it, and what is still running in it. Turn on the native posture tooling to get a baseline, close or consolidate dormant accounts, then fix the small set of things that create real blast radius: public storage, over-permissioned roles, and anything internet-facing without patching. Buy a CNAPP once you know the size of the estate, not before, or you will be quoted for infrastructure you were about to delete.
Get a Trend Micro quote priced in INR with GST invoice — we size the licence, deploy it, and can run the console for you.