Topic starter
06/07/2026 9:45 am
TL;DR: Static scanners and posture tools struggle to keep pace with short-lived containers, serverless, and multi-cloud environments, leaving a runtime visibility gap that Oligo Security says is now driving demand for Cloud Detection & Response and Application Detection & Response. The core issue is whether controls can see what is actually executing in production, not how many issues they can enumerate beforehand.
Editorial analysis by NHI Mgmt Group, based on content published by Oligo Security: “Bridging the Runtime Gap: Insights from Frost & Sullivan’s 2025 Cloud / Application Runtime Security Report”.
Key questions
Q: What breaks when cloud native security relies only on static scanning?
A: Static scanning misses the conditions that emerge after deployment.
Q: Why do runtime controls matter more for cloud-native workloads than snapshot tools?
A: Runtime controls matter because cloud-native risk is created by live execution, not just by the presence of a misconfiguration.
Q: How should security teams prioritise application security findings in cloud environments?
A: Security teams should prioritise application findings by combining severity with exposure, reachability, ownership, and business impact.
Practitioner guidance
- Prioritise runtime detection for ephemeral workloads Map container, serverless, and Kubernetes assets to runtime controls first when their lifespan is shorter than your scan-and-review cycle.
- Correlate identity and workload signals during execution Join cloud entitlement events, API activity, and workload execution context so investigators can see when a live process becomes exploitable.
- Reduce noise by triaging only live exploit paths Separate dormant findings from issues that actually load, execute, or touch production data so engineering time goes to active exposure.
Bottom line: Cloud-native environments create a mismatch between static assurance and live execution, and that mismatch is where modern risk concentrates.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:01 am
Runtime visibility is now a governance boundary, not just a detection layer. Cloud-native programmes cannot treat pre-deployment checks as sufficient proof of control when workloads are short-lived and execution is continuous. The decisive question is whether the organisation can see what is actually running, not merely what was approved. Practitioners should treat runtime observability as a core identity and workload governance control.
A few things that frame the scale:
- Kubernetes production adoption has surged from 66% in CNCF's 2023 survey to 82% in 2025.
A question worth separating out:
Q: What is the difference between posture checks and runtime enforcement in cloud security?
A: Posture checks tell you whether a system is configured according to policy at a point in time. Runtime enforcement decides whether an action is allowed while the workload is actually executing. Both matter, but they solve different problems. Posture management helps find misconfiguration. Runtime enforcement stops malicious or unexpected behavior before it can move, escalate, or affect data.
👉 Read our full editorial: Runtime security gaps in cloud-native environments are widening