Notifications
Clear all
Topic starter
18/08/2026 2:45 pm
TL;DR: CNAPP visibility can improve posture, but it does not validate whether an environment can withstand adaptive, AI-driven exploitation, according to CRACKEN. As autonomous attack paths become easier to simulate and chain, resilience testing, not dashboard hygiene, becomes the meaningful control signal.
NHIMG editorial — based on content published by CRACKEN: Why CNAPP Fluff Won't Save You: The Case for Red AI Cloud Security
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams prove that cloud controls are actually resilient?
A: Teams should test whether a real attacker can chain exposed secrets, over-permissioned identities, and workload access into meaningful compromise.
Q: Why do CNAPP findings not equal validated security?
A: CNAPP mainly shows posture, coverage, and drift.
Q: What breaks when security teams rely on isolated dashboards and metrics?
A: Isolated dashboards produce fragmented truth.
Practitioner guidance
- Validate exploitability of exposed cloud identities Use adversarial testing to prove whether public secrets, service accounts, or tokens can actually be used to reach sensitive resources.
- Map cloud posture findings to identity blast radius Tie each high-risk cloud finding to the identity or credential that would make it exploitable, including API keys, workload identities, and delegated agent tokens.
- Test AI agent and workload privileges as production identities Treat autonomous agents and cloud workloads as active identities with scope, lifecycle, and revocation requirements.
What's in the full article
CRACKEN's full blog post covers the operational detail this post intentionally leaves for the source:
- How the vendor frames automated exposure validation for red-team style cloud testing
- Examples of offensive AI copilot workflows used to validate dormant APIs and legacy systems
- Claimed performance metrics, including speed, false positive reduction, and scale figures
- The article's own mapping of its approach to OWASP ASI, EU AI Act, and CISA references
👉 Read CRACKEN's analysis of why CNAPP posture does not prove resilience →
CNAPP posture versus resilience: what AI-driven attackers change?
Explore further
18/08/2026 3:28 pm
Posture management fatigue is now a governance problem, not just a tooling problem. Cloud leaders often treat high CNAPP coverage as evidence that risk is under control, but posture scores do not prove resilience. The article exposes a common failure mode where teams confuse asset visibility with validated resistance to attack. In identity-heavy environments, that confusion is especially dangerous because service accounts, API keys, and agent privileges can remain exploitable even when dashboards look healthy. The practitioner conclusion is clear: measure exploitability, not just coverage.
A question worth separating out:
Q: Which controls matter most when AI agents act in cloud environments?
A: The priority controls are identity scope, secret lifecycle, privilege boundaries, and revocation. AI agents can behave like software identities, so teams need to know exactly what they can access, how long access lasts, and how quickly it can be removed when behaviour drifts out of scope.
👉 Read our full editorial: Red AI cloud security shows why CNAPP posture is not resilience
