Notifications
Clear all
Topic starter
11/06/2026 11:12 pm
TL;DR: Cloud workload protection platforms can improve visibility, vulnerability discovery, and runtime monitoring across VMs, containers, and serverless workloads, but Orca Security argues that CWPP alone leaves gaps in asset inventory, secrets exposure, and attack-path context. The governance issue is broader than workload defence: modern cloud estates need unified risk context, not isolated point controls.
NHIMG editorial — based on content published by Orca Security: cloud workload protection and why CWPP alone is not enough
Questions worth separating out
Q: How should teams secure cloud workloads without overloading operations?
A: Start with broad inventory and exposure mapping, then apply deeper runtime controls only to workloads that handle sensitive data, privileged operations, or internet-facing services.
Q: Why do cloud workloads create identity and access risk?
A: Because workloads often run with more access than they need, and those permissions can be combined with stored secrets or exposed services to create lateral movement paths.
Q: What breaks when cloud workload protection stops at vulnerability scanning?
A: Teams lose the connection between a vulnerable asset, the secrets it can reach, and the identities it can impersonate.
Practitioner guidance
- Map workload coverage by exposure tier Create a live inventory of VMs, containers, and serverless functions, then flag which assets are internet-accessible, unpatched, or missing owners.
- Tighten secrets handling around sensitive workloads Search for stored secrets in workloads that handle regulated data or privileged operations, then remove plaintext storage and rotate any exposed credentials.
- Align workload alerts with identity scope Review the IAM permissions attached to high-risk workloads and remove unnecessary access to storage, APIs, and administrative functions.
What's in the full article
Orca Security's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step CWPP deployment considerations for agent-based, sensor-based, and agentless models.
- Product-level explanation of SideScanning and how the platform reconstructs runtime context.
- Vendor-specific feature comparisons for vulnerability scanning, secrets detection, and risk prioritisation.
- Platform guidance for combining CWPP with CNAPP capabilities across multi-cloud estates.
👉 Read Orca Security's guide to cloud workload protection and CNAPP →
Cloud workload protection and CNAPP: where CWPP falls short?
Explore further
12/06/2026 7:47 am
Cloud workload protection fails when visibility stops at the workload boundary: The article correctly treats inventory, runtime monitoring, and secrets detection as connected controls, not separate disciplines. That matters because a workload is rarely the endpoint of risk in cloud estates. It is usually the place where identity, data, and configuration failures converge. Practitioners should treat CWPP as one layer in a wider cloud governance model, not as the whole answer.
A few things that frame the scale:
- 69% of organisations now have more machine identities than human ones, according to The Critical Gaps in Machine Identity Management report.
- 53% of organisations have experienced a security incident directly related to machine identity management failures.
A question worth separating out:
Q: Should organisations prefer agentless CWPP or sensor-based monitoring?
A: Most organisations should use agentless CWPP for broad coverage and add sensor-based monitoring where runtime depth is essential. The right choice depends on workload criticality, deployment speed, and whether the main problem is blind spots or insufficient behavioural detail.
👉 Read our full editorial: Cloud workload protection is not enough without CNAPP visibility
