Topic starter
18/08/2026 2:42 pm
TL;DR: CNAPP can reduce cloud security fragmentation only when posture, runtime, and delivery workflows stay separately governable, according to LEGIT Security. Cloud security operations need both baseline posture data and workload context to keep ownership clear and prioritisation accurate.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: “Scaling Security in Cloud-Native Environments with CNAPP”.
Key questions
Q: Why do cloud teams need both posture data and workload context?
A: Because a secure setting does not guarantee a secure workload, and a runtime alert does not explain whether the baseline configuration is already weak.
Q: What are the signs that cloud security centralisation is failing?
A: The main signs are duplicate findings, unclear ownership, alerts that cannot be tied to a specific application, and scanner coverage that depends on overly broad cloud permissions.
Q: What breaks when CNAPP and CSPM are treated as interchangeable?
A: Teams lose the distinction between posture control and runtime context.
Practitioner guidance
- Clarify control ownership across CNAPP and CSPM Document which team owns posture findings, runtime findings, and remediation approval so centralised tooling does not blur accountability.
- Map workload identity to scanner permissions Review the service accounts, roles, and API permissions that let CNAPP ingest cloud telemetry and confirm they are tightly scoped and audited.
- Use application context to prioritise remediation Group cloud alerts by application, environment, and exposure path so teams fix the highest-risk issues instead of the loudest ones.
Bottom line: CNAPP centralisation can reduce cloud security fragmentation, but it only works when posture, runtime, and delivery workflows remain separately governable.
Glossary terms: Cloud Native Application Protection Platform, Cloud Security Posture Management, Workload Identity, Agentless Scanning
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:26 pm
CNAPP centralisation is a governance problem before it is a tooling problem. Consolidating cloud controls only works when teams can still distinguish posture, runtime, and application risk at the point of decision. If those layers blur together, organisations may improve dashboard simplicity while weakening accountability for who owns misconfigurations, workload exposure, and remediation. The practical conclusion is that consolidation must preserve control clarity, not just reduce console count.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should cloud security teams balance agentless scanning with agent-based runtime protection?
A: Cloud security teams should use agentless controls for broad posture visibility and agent-based controls for runtime depth. Agentless scanning is well suited to discovering misconfigurations, exposed assets, and compliance drift across many accounts. Agent-based protection is better when teams need kernel or workload-level visibility, anomaly detection, and control over live threats such as zero-day exploits.
👉 Read our full editorial: CNAPP centralisation is reshaping cloud application security operations