Topic starter
24/06/2026 10:55 pm
TL;DR: Securing containerized cloud-native applications from development through production, with runtime protection positioned to reduce mean time to repair and business risk, is the focus of Aqua Security’s CNAPP. For IAM and cloud security teams, the main question is whether security control depth is matching the speed and sprawl of modern workload identity.
Editorial analysis by NHI Mgmt Group, based on content published by Aqua Security: “Aqua News Aqua Security Goes All In On Runtime Protection”.
Key questions
Q: How should cloud teams govern workload risk after deployment?
A: Cloud teams should treat runtime as the control point where workload permissions, process behaviour, and response actions are actively governed.
Q: Why do build-time controls fall short for container security?
A: Build-time controls cannot see the permissions, network relationships, and runtime behaviour that appear only after release.
Q: What are the signs that cloud-native security is too narrow?
A: The clearest sign is when teams can describe image scanning in detail but cannot explain how they detect or contain malicious behaviour once workloads are running.
Practitioner guidance
- Define runtime as a separate control objective Map the controls that must operate after deployment, including behavioural detection, policy enforcement, and response paths for live workloads.
- Inventory workload permissions in production Review the cloud permissions, service-to-service access, and inherited identities that become active only when containers start running.
- Test whether agentless visibility covers live behaviour Verify which runtime events are visible without agents and where you still need deeper process-level telemetry.
Bottom line: Cloud-native security becomes materially different once workloads are running, because production-time behaviour creates risk that build-time controls cannot fully see.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:45 am
Runtime protection is the missing control plane in many CNAPP programmes: build-time security reduces known defects, but it does not govern what a workload does once it is live. That gap matters because modern cloud risk is increasingly operational, not just structural. Practitioners should treat runtime as the point where cloud security either becomes real or remains theoretical.
A question worth separating out:
Q: What happens when CNAPP focuses only on pre-deployment checks?
A: The programme may reduce known defects, but it leaves live workload behaviour under-governed. That creates a gap between approval and execution, which is where many cloud incidents become expensive. Runtime controls are the layer that limits blast radius when something slips past the build pipeline or changes state after deployment.
👉 Read our full editorial: Aqua Security’s runtime protection focus and CNAPP implications