Notifications
Clear all
Topic starter
24/06/2026 10:55 pm
TL;DR: Securing containerized cloud-native applications from development through production, with runtime protection positioned to reduce mean time to repair and business risk, is the focus of Aqua Security’s CNAPP. For IAM and cloud security teams, the main question is whether security control depth is matching the speed and sprawl of modern workload identity.
NHIMG editorial — based on content published by Aqua Security: Aqua News on runtime protection and CNAPP
Questions worth separating out
Q: How should security teams evaluate runtime protection for cloud-native workloads?
A: They should test whether the control can detect active misuse in production, not just surface configuration issues before release.
Q: Why do runtime controls matter more once applications are in production?
A: Because the real attack surface emerges when workloads have live credentials, network reach, and access to data or infrastructure.
Q: What do cloud teams get wrong about CNAPP and workload security?
A: They often treat posture management and runtime defence as the same thing.
Practitioner guidance
- Evaluate runtime controls against live workload behaviour Test whether detection rules can identify suspicious process launches, unexpected network destinations, and file access patterns after deployment.
- Tie runtime alerts to workload identity context Require alerts to include the service account, token source, or secret path involved so analysts can see which identity enabled the event.
- Review secrets exposure inside running workloads Inspect how secrets are injected, stored, and rotated in containers and functions, then verify that runtime tools can detect misuse if those secrets are accessed or replayed outside expected behaviour.
What's in the full article
Aqua Security's full article covers the operational detail this post intentionally leaves for the source:
- How Aqua positions runtime protection across containers, serverless, Kubernetes, and hybrid cloud use cases.
- The product-level framing for CNAPP integration across code-to-cloud security workflows.
- The specific platform claims around reducing mean time to repair and business risk.
- The broader use-case list for cloud security, compliance, and auditing in cloud-native environments.
👉 Read Aqua Security's article on runtime protection in CNAPP →
Runtime protection in CNAPP: what it means for cloud teams?
Explore further
25/06/2026 7:45 am
Runtime protection is becoming the control plane for cloud-native identity abuse. Pre-deployment checks can catch misconfigurations, but they do not describe what a workload will do once it has live credentials and active network reach. That matters because production is where secrets, service accounts, and cluster permissions become real attack paths, not theoretical ones. Practitioners should treat runtime visibility as a separate governance requirement, not an extension of scanning.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- A second finding from the same research shows that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which reinforces how often identity risk extends beyond the primary workload.
A question worth separating out:
Q: How can organisations connect runtime findings to IAM decisions?
A: They should map every meaningful runtime alert back to the service account, secret, or token that enabled it, then use that evidence in access reviews and entitlement cleanup. That makes runtime telemetry part of governance rather than a separate security queue.
👉 Read our full editorial: Aqua Security’s runtime protection focus and CNAPP implications
