Topic starter
06/07/2026 9:35 am
TL;DR: Latio’s 2025 Cloud Security Market Report says 53% of practitioners want more Application Detection and Response, while 65% want better runtime visibility into AI models and applications, reinforcing the shift from posture-heavy CNAPP toward CADR, according to Oligo Security. Runtime context now matters because modern cloud risk is defined by what is executing, not just what is deployed.
Editorial analysis by NHI Mgmt Group, based on content published by Oligo Security: “The Future of Cloud Security is Runtime”.
Key questions
Q: What does it mean when cloud security moves from CNAPP to runtime protection?
A: It means security teams are prioritising live execution signals over static posture coverage when deciding what matters most.
Q: Why do posture-heavy cloud tools create so much alert fatigue?
A: Because posture findings often describe theoretical exposure without enough context to show whether something is exploitable, reachable, or active.
Q: What breaks when cloud security cannot see application behaviour at runtime?
A: Teams lose the ability to distinguish meaningful risk from static configuration noise, which weakens prioritisation and slows response.
Practitioner guidance
- Prioritise runtime telemetry over posture-only findings Use live application, container, OS, and network signals to rank what is actually exploitable in production rather than what is merely misconfigured on paper.
- Rebaseline cloud security controls around exploitable execution paths Map your current CNAPP findings to the workloads and services that can be reached and abused at runtime, then separate noise from conditions that would change response decisions.
- Extend monitoring to AI-enabled services and agents Include AI model behaviour, application interactions, and runtime context in detection workflows so security teams can observe adaptive behaviour as it happens.
Bottom line: The article argues that cloud security is moving away from broad posture coverage and toward runtime protection because live behaviour determines real risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:49 am
Runtime context is becoming the control boundary for cloud workload security. CNAPP was built to tell teams what exists and what is misconfigured, but modern cloud risk is increasingly decided by what executes. That changes the governance model from static exposure management to live behavioural control, especially in environments where workloads, applications, and AI systems interact continuously. Practitioners should treat runtime evidence as the point where cloud security becomes actionable.
A few things that frame the scale:
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Should security teams re-evaluate CNAPP if they already have runtime workload visibility?
A: Yes, if the current programme still treats posture visibility as the main control objective. Runtime visibility only changes outcomes when it informs detection, prioritisation, and response around live application behaviour rather than sitting beside existing CNAPP reports.
👉 Read our full editorial: Runtime cloud security is displacing CNAPP for workload protection