Notifications
Clear all
Topic starter
25/06/2026 12:36 am
TL;DR: Cloud-native protection now has to extend from code to cloud to runtime, because static scanning alone cannot keep pace with modern workload risk across containers, functions, and hybrid environments, according to Aqua Security. That shift makes continuous enforcement and detection the decisive control surface for identity and workload security.
NHIMG editorial — based on content published by Aqua Security: Aqua News Q&A on AI workload protection, runtime security, and Trivy
Questions worth separating out
Q: How should teams govern workload security when applications keep changing after deployment?
A: Treat workload security as a lifecycle problem rather than a build-stage problem.
Q: Why do runtime controls matter more for containers and functions than static checks alone?
A: Because the main risk appears after the workload starts executing.
Q: What signals show that a cloud native security programme is too dependent on scanning?
A: Look for programmes that report build-stage findings but cannot explain live execution paths, privilege use, or response outcomes.
Practitioner guidance
- Map controls to runtime phases Break workload security into pre-deployment, active execution, and response phases.
- Tie permissions to workload identity Review which containers, functions, and platform services can reach data or call internal services at runtime.
- Correlate detection with execution context Feed workload identity, secret use, network activity, and process behaviour into detection rules so alerts reflect what the workload is actually doing.
What's in the full article
Aqua Security's full article covers the operational detail this post intentionally leaves for the source:
- The vendor’s breakdown of how its code-to-cloud-to-runtime model is organised across CNAPP capabilities.
- The article’s discussion of dynamic threat analysis and how it is positioned for live workload protection.
- The source’s environment coverage across Kubernetes, serverless, hybrid cloud, and multi-cloud deployments.
- The vendor’s own description of how its platform combines agent and agentless technology for production security.
👉 Read Aqua Security’s analysis of AI workload protection and runtime security →
AI workload protection and runtime security: what changes now?
Explore further
25/06/2026 9:31 am
Runtime visibility is now the dividing line between workable cloud security and checkbox scanning. Static analysis still has value, but it does not answer the core operational question of what a workload is doing after deployment. As cloud native stacks become more dynamic, the control failure is not the absence of findings. It is the inability to observe and act on live behaviour. Practitioners should treat runtime as the moment where governance either proves itself or fails.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to The 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments.
A question worth separating out:
Q: How can security teams apply lifecycle thinking to hybrid and multi-cloud workloads?
A: Use one governance model across containers, serverless services, and hybrid workloads, then adapt the control points to each environment’s runtime behaviour. The goal is consistency in identity, monitoring, and response, not identical tooling everywhere. That reduces blind spots when workloads move across platforms.
👉 Read our full editorial: AI workload protection shifts from scanning to runtime control
