TL;DR: Latio’s 2025 Cloud Security Market Report says 53% of practitioners want more Application Detection and Response, while 65% want better runtime visibility into AI models and applications, reinforcing the shift from posture-heavy CNAPP toward CADR, according to Oligo Security. Runtime context now matters because modern cloud risk is defined by what is executing, not just what is deployed.
At a glance
What this is: This is Oligo Security’s analysis of Latio’s 2025 Cloud Security Market Report, arguing that cloud security is shifting from posture-heavy CNAPP toward runtime-focused CADR because practitioners want more application-layer protection and AI runtime visibility.
Why it matters: For IAM, NHI, and cloud security teams, the shift matters because runtime context changes how you govern workload identities, application behaviour, and response decisions in dynamic environments.
Context
Cloud application detection and response is a runtime security approach that focuses on what workloads, applications, and AI systems are actually doing in production. Oligo Security’s reading of Latio’s market report is that this is displacing posture-heavy CNAPP because teams need visibility and control where execution happens, not only where configuration drift exists.
For identity practitioners, that change matters because cloud protection is no longer only about static entitlements or deployed assets. It increasingly depends on correlating runtime behaviour, workload context, and response actions across applications, services, and AI-driven workflows.
The article frames this as a market shift rather than a tool feature. That makes it relevant to organisations already using CNAPP, because the control boundary is moving toward runtime evidence and away from passive coverage alone.
Key questions
Q: What does it mean when cloud security moves from CNAPP to runtime protection?
A: It means security teams are prioritising live execution signals over static posture coverage when deciding what matters most. The practical shift is from asking whether a workload is configured well to asking whether it is behaving in a way that creates real attack opportunity in production.
Q: Why do posture-heavy cloud tools create so much alert fatigue?
A: Because posture findings often describe theoretical exposure without enough context to show whether something is exploitable, reachable, or active. Teams then spend time triaging conditions that may never affect production, while the runtime paths that actually matter remain harder to see.
Q: What breaks when cloud security cannot see application behaviour at runtime?
A: Teams lose the ability to distinguish meaningful risk from static configuration noise, which weakens prioritisation and slows response. In practice, that means vulnerable or suspicious execution can remain hidden inside an otherwise acceptable posture picture.
Q: Should security teams re-evaluate CNAPP if they already have runtime workload visibility?
A: Yes, if the current programme still treats posture visibility as the main control objective. Runtime visibility only changes outcomes when it informs detection, prioritisation, and response around live application behaviour rather than sitting beside existing CNAPP reports.
Technical breakdown
Why runtime context changes cloud workload protection
Runtime context combines telemetry from containers, operating systems, application code, and network activity to show what a workload is doing right now. In cloud environments, that matters because a deployed asset can be low risk in configuration terms and still be exploitable at execution time. CADR, as described by Latio, uses this context to separate noise from actionable behaviour and to connect application activity with security response. The architectural shift is from broad detection of possible exposure to an evidence model that is tied to actual execution. That is why runtime security is becoming the control plane for modern cloud workload protection.
Practical implication: Treat runtime evidence as the primary input for prioritisation, not a downstream supplement to posture findings.
Why application-layer visibility matters more than posture alone
Posture tools answer whether something is configured safely at rest. They do not reliably answer whether the application path being used in production is the one that creates risk. Latio’s report argues that many practitioners already have acceptable posture visibility but still lack meaningful application-layer protection and response. That gap becomes more pronounced in hybrid environments, where applications, services, and AI processes generate behaviour that static configuration snapshots cannot explain. From an identity perspective, runtime visibility also helps distinguish between legitimate service activity and suspicious execution patterns that may ride on valid access.
Practical implication: Prioritise controls that observe live application behaviour and can trigger response on exploitable execution paths.
How AI runtime behaviour changes detection and response
AI workloads introduce adaptive behaviour, new execution paths, and shifting resource use that are difficult to govern with posture-only controls. The article’s key point is not that AI is special in a branding sense, but that AI activity creates another runtime layer security teams have to observe. If a model, agent, or AI-enabled application is changing behaviour in production, security value comes from seeing that behaviour in context and acting on it while it is still occurring. That is a workload governance issue as much as a cloud detection issue.
Practical implication: Extend runtime monitoring to AI-enabled services so behaviour changes are visible before they become operational incidents.
NHI Mgmt Group analysis
Runtime context is becoming the control boundary for cloud workload security. CNAPP was built to tell teams what exists and what is misconfigured, but modern cloud risk is increasingly decided by what executes. That changes the governance model from static exposure management to live behavioural control, especially in environments where workloads, applications, and AI systems interact continuously. Practitioners should treat runtime evidence as the point where cloud security becomes actionable.
CADR reflects a deeper shift from posture coverage to exploitability judgment. The article’s central claim is that broad visibility is no longer enough if it does not separate noise from material risk. That means security programmes have to decide whether they are optimising for inventory completeness or for response quality. The practical conclusion is that runtime context now carries more governance weight than passive alert volume.
Application-aware security is overtaking infrastructure-only thinking. Latio’s framing shows that application-layer behaviour is where cloud security decisions increasingly concentrate, not just at the network or platform edge. That matters because identity, access, and workload trust all become more conditional when execution patterns are observed in real time. The practitioner takeaway is that cloud protection models need to follow application behaviour, not stop at deployment state.
Runtime security is the point where cloud, workload, and AI governance converge. The article ties together application execution, hybrid environments, and AI behaviour under one operating model. That makes runtime not just a detection layer but a common language for SecOps, AppSec, and cloud governance teams. The field implication is clear: organisations that keep treating CNAPP as the end state will miss the operational centre of gravity moving to live execution.
From our research library:
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
What this signals
Runtime security is becoming a governance question, not just a detection question. As cloud environments get more dynamic, the useful control is the one that can tell you whether a workload path is live, reachable, and relevant right now. That makes runtime evidence the better basis for security operations than posture alone.
Application behaviour is now a first-class signal in cloud programmes. Teams that still separate cloud, AppSec, and AI monitoring will miss how quickly those layers converge in production. The programme implication is to build shared triage around execution context, not around tool silos.
For practitioners
- Prioritise runtime telemetry over posture-only findings Use live application, container, OS, and network signals to rank what is actually exploitable in production rather than what is merely misconfigured on paper.
- Rebaseline cloud security controls around exploitable execution paths Map your current CNAPP findings to the workloads and services that can be reached and abused at runtime, then separate noise from conditions that would change response decisions.
- Extend monitoring to AI-enabled services and agents Include AI model behaviour, application interactions, and runtime context in detection workflows so security teams can observe adaptive behaviour as it happens.
- Align AppSec, CloudSec, and SecOps on runtime evidence Use a shared operational view of live behaviour so remediation decisions, escalation thresholds, and containment actions are based on the same execution data.
Key takeaways
- The article argues that cloud security is moving away from broad posture coverage and toward runtime protection because live behaviour determines real risk.
- That shift matters because runtime context helps teams separate exploitable conditions from static noise across workloads, applications, and AI-enabled services.
- Practitioners should re-centre cloud control design on live execution, shared triage, and response based on what is actually happening in production.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API10 — Unsafe Consumption of APIs | Runtime cloud protection often hinges on controlling how services consume upstream APIs. |
| Recommendation — Review API consumption paths and restrict unsafe integrations that can only be judged safely at runtime. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Runtime cloud governance still depends on permission scope and authorisation quality. |
| Recommendation — Validate that runtime response is aligned to actual permissions and entitlements, not just posture findings. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The article’s runtime focus maps to adversary use of live execution paths to access and disrupt systems. |
| Recommendation — Map runtime detections to credential access and impact techniques so response reflects how attacks unfold in production. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud runtime security depends on controlling identities that operate workloads and services. |
| Recommendation — Use IAM governance to keep workload access aligned with observed runtime behaviour and service ownership. | ||
Key terms
- Cloud Application Detection And Response: Cloud Application Detection and Response is the practice of identifying suspicious behaviour inside live cloud applications and workloads, then containing that behaviour before it spreads. It focuses on runtime signals such as unusual access, API misuse, and escalation paths that scan-time posture tools cannot see.
- Runtime Security: Runtime security is the practice of detecting and constraining malicious behavior while software is executing. It focuses on live workload activity, not just code quality or pre-deployment checks, so teams can contain abuse after a system is already running.
- Workflow-level Visibility: Workflow-level visibility is the ability to reconstruct how data moves across a sequence of actions rather than inspecting isolated events. It matters when an AI agent reads, transforms, and forwards data in separate steps, because single-event monitoring often misses the full policy violation.
- Posture-heavy CNAPP: Posture-heavy CNAPP describes cloud security programmes that emphasise configuration and inventory findings more than live execution protection. The limitation is not coverage alone, but the lack of context needed to decide what is truly active or exploitable.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 6, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org