Topic starter
18/08/2026 2:42 pm
TL;DR: CNAPP is being positioned as a way to unify cloud security controls across multi-cloud, Kubernetes, and application pipelines, according to LEGIT Security, but the real value is operational: fewer silos, better context, and faster prioritisation only work if teams keep posture, runtime, and developer workflows aligned. The shift matters because cloud scale exposes governance gaps faster than tool sprawl can hide them.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: “Scaling Security in Cloud-Native Environments with CNAPP”.
Key questions
Q: What breaks when CNAPP and CSPM are treated as interchangeable?
A: Teams lose the distinction between posture control and runtime context.
Q: Why do cloud teams need both posture data and workload context?
A: Because a secure setting does not guarantee a secure workload, and a runtime alert does not explain whether the baseline configuration is already weak.
Q: What are the signs that cloud security centralisation is failing?
A: The main signs are duplicate findings, unclear ownership, alerts that cannot be tied to a specific application, and scanner coverage that depends on overly broad cloud permissions.
Practitioner guidance
- Clarify control ownership across CNAPP and CSPM Document which team owns posture findings, runtime findings, and remediation approval so centralised tooling does not blur accountability.
- Map workload identity to scanner permissions Review the service accounts, roles, and API permissions that let CNAPP ingest cloud telemetry and confirm they are tightly scoped and audited.
- Use application context to prioritise remediation Group cloud alerts by application, environment, and exposure path so teams fix the highest-risk issues instead of the loudest ones.
Bottom line: CNAPP centralisation can reduce cloud security fragmentation, but it only works when posture, runtime, and delivery workflows remain separately governable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:26 pm
CNAPP centralisation is a governance problem before it is a tooling problem. Consolidating cloud controls only works when teams can still distinguish posture, runtime, and application risk at the point of decision. If those layers blur together, organisations may improve dashboard simplicity while weakening accountability for who owns misconfigurations, workload exposure, and remediation. The practical conclusion is that consolidation must preserve control clarity, not just reduce console count.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should cloud security teams balance agentless scanning with agent-based runtime protection?
A: Cloud security teams should use agentless controls for broad posture visibility and agent-based controls for runtime depth. Agentless scanning is well suited to discovering misconfigurations, exposed assets, and compliance drift across many accounts. Agent-based protection is better when teams need kernel or workload-level visibility, anomaly detection, and control over live threats such as zero-day exploits.
👉 Read our full editorial: CNAPP centralisation is reshaping cloud application security operations