Topic starter
11/06/2026 12:01 am
TL;DR: Cloud security maturity is still best understood as a layered progression, starting with CSPM and CIEM for visibility and entitlement control before moving into CWPP, DSPM, runtime detection, AI security, and AppSec, according to Orca Security. The lesson is that programmes fail when they try to defend what they have not mapped, and identity context has to lead.
Editorial analysis by NHI Mgmt Group, based on content published by Orca Security: “Where to Start Your Cloud Security Program: CSPM, CWPP, or Runtime Data? A Modern Guide to CNAPP Maturity”.
Key questions
Q: How should security teams start a cloud security programme when visibility is incomplete?
A: Start with CSPM and CIEM because they answer the first governance questions: what exists, where it sits, and which identities or permissions already create exposure.
Q: Why does cloud entitlement sprawl create risk even when teams have access visibility?
A: Visibility alone does not reduce risk if it is not connected to certification and revocation.
Q: What breaks when organisations jump straight to CNAPP without baseline visibility?
A: They get correlation without context.
Practitioner guidance
- Establish cloud asset inventory first Use CSPM to build an accurate map of cloud assets, accounts, and exposure before moving to deeper controls or prioritisation exercises.
- Run entitlement analysis alongside posture checks Use CIEM to surface excessive permissions, unused access, shadow identities, and rogue service accounts as part of the same governance view.
- Sequence workload and data controls after visibility Introduce CWPP and DSPM once inventory and entitlement baselines are stable, so workload and data findings can be interpreted in context.
Bottom line: Cloud security maturity starts with knowing what exists and who can reach it, not with the most advanced detection layer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 22 hours ago by NHI Mgmt Group
12/06/2026 6:32 am
Cloud security maturity is an identity and visibility problem before it is a platform problem. CSPM and CIEM are not just two more categories in a tool stack; they establish the asset map and entitlement map that later controls depend on. When those maps are missing, workload, runtime, and AI layers inherit blind spots that are already baked into the programme. Practitioners should treat discovery and entitlement clarity as the organising principle for cloud governance.
A few things that frame the scale:
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: How do runtime detection and application security fit into a cloud maturity model?
A: They work best after posture, identity, and data context are established. Runtime tools need a baseline to judge behaviour, and AppSec only becomes operationally useful when code can be traced to the cloud workloads and identities it actually influences.
👉 Read our full editorial: Cloud security maturity starts with visibility, not CNAPP
This post was modified 22 hours ago by NHI Mgmt Group