Cloud security protects the applications, infrastructure, identities and data that businesses build, run and consume across public cloud, private cloud, software-as-a-service and hybrid environments. It is no longer a collection of configuration scanners. The category is converging around platforms that connect risk from code creation to production runtime, decide which exposures can become real attack paths and help security and engineering teams remove them before an adversary does.
Executive summary
Cloud security is structurally one of the fastest-growing parts of cybersecurity because its underlying attack surface expands with cloud consumption. Every new account, workload, container, application programming interface, data store, service identity and AI service creates another object to discover, configure, monitor and govern. Security demand therefore grows not only with the number of employees, but with machine activity and software complexity.
The core product category is the cloud-native application protection platform, or CNAPP. It brings together cloud security posture management, workload protection, cloud entitlement management, development-pipeline security, vulnerability management and increasingly data and runtime detection. CNAPP does not cover every cloud-security problem: SaaS governance, secure access, application delivery, backup and data recovery remain adjacent markets. But it is becoming the primary operating layer for securing infrastructure and applications from code to cloud.
The strongest architectures combine two observation methods. Agentless connections to cloud-provider APIs and snapshots give rapid, broad coverage without touching each workload. Agents, sensors and eBPF-based runtime controls provide deeper process-level telemetry and the ability to block malicious behaviour in real time. Agentless-only offerings can become posture dashboards; agent-only offerings can miss undeployed, ephemeral or unmanaged assets. The durable model is hybrid.
Competition is unusually broad. Google-owned Wiz leads with low-friction multicloud discovery and a powerful security graph. Palo Alto Networks connects CNAPP to cloud detection and response and the wider Cortex security-operations platform. CrowdStrike extends its endpoint sensor, threat intelligence and data layer into cloud workloads. Microsoft combines Defender for Cloud with Azure, Entra, GitHub and Sentinel. Sysdig and Aqua are runtime- and container-led specialists; Orca is an agentless pioneer; Qualys, TrendAI, Check Point, Fortinet, Tenable and Rapid7 approach the market from installed bases in vulnerability, workload, network or exposure management.
The category should sustain above-market growth, but the value will not be shared equally. Discovery and compliance features are becoming table stakes. Long-term differentiation lies in proprietary context, accurate prioritisation, runtime efficacy, developer workflow, data and identity visibility, remediation and the trust required to automate changes in production. The investment question is therefore not simply who sells CNAPP, but who can make cloud risk operational across both security and engineering.
What cloud security includes
Cloud security is best understood as a set of control planes rather than a single product. Infrastructure security governs networks, accounts, storage and compute. Workload security protects virtual machines, containers, Kubernetes clusters and serverless functions. Identity security determines what human and machine identities can do. Data security discovers sensitive information and controls how it is stored, accessed and moved. Application security tests code, dependencies, APIs and deployment artefacts. Security operations detects active attacks and coordinates response.
| Capability | Primary job | Typical evidence | Natural buyer |
|---|---|---|---|
| CSPM | Find misconfiguration, policy drift and compliance failures | Cloud APIs, asset metadata and configuration state | Cloud security and governance |
| CWPP | Protect running VMs, containers, Kubernetes and serverless workloads | Agents, runtime sensors, images and workload behaviour | Security operations and infrastructure |
| CIEM | Discover excessive or toxic cloud permissions | IAM roles, policies, entitlements and activity | Identity and cloud security |
| KSPM | Secure Kubernetes configuration and orchestration | Clusters, manifests, control-plane settings and runtime | Platform engineering and cloud security |
| IaC and supply-chain security | Stop flaws before infrastructure or software is deployed | Repositories, pipelines, templates, registries, packages and secrets | Developers, DevSecOps and application security |
| DSPM | Find sensitive data and understand exposure | Data stores, classification, access paths and movement | Data security and privacy |
| CDR | Detect and contain active cloud attacks | Runtime, control-plane, identity, network and audit telemetry | SOC and incident response |
| SSPM and CASB | Govern SaaS configuration, usage and data | SaaS APIs, identities, sessions and transactions | SaaS security, data security and access teams |
The acronyms describe different jobs, but their boundaries are dissolving. A publicly exposed workload may also contain a critical vulnerability, hold sensitive data and inherit an over-privileged service role. Looking at each condition separately creates four alerts; connecting them reveals one attack path. That graph-based context is the central promise of CNAPP.
The shared-responsibility model
Public-cloud providers secure the underlying facilities, hardware, networking and service infrastructure. Customers remain responsible for how they configure and use those services: identities, permissions, data, applications, guest operating systems, network policies and encryption choices. The exact boundary changes with the service model. A customer manages much more of an infrastructure-as-a-service virtual machine than a fully managed database or software-as-a-service application.
This distinction explains why moving to AWS, Microsoft Azure or Google Cloud does not eliminate the security market. Hyperscalers can provide secure primitives and strong native controls, yet they cannot decide which employee needs access to a dataset, whether a storage bucket should be public, whether a third-party package is safe or whether an unusual API call reflects a business process or an intrusion. Cloud security is the layer that turns provider controls and customer context into policy and evidence.
The most useful mental model is not that the cloud is inherently less secure. It is differently secure. Infrastructure becomes programmable, identities become the perimeter and mistakes can be replicated globally in seconds. The same automation that makes cloud computing efficient also makes both defence and failure operate at machine speed.
From point tools to CNAPP
Early cloud-security programmes adapted familiar data-centre controls: firewalls, host antivirus, vulnerability scanners and central log management. As infrastructure became software-defined, CSPM emerged to inspect configurations through cloud APIs. Containers and Kubernetes created demand for cloud workload protection. Complex permissions created CIEM. Development teams added infrastructure-as-code, container-image and dependency scanning. Each solved a real problem, but the result was another fragmented security stack.
CNAPP is the consolidation response. industry research defines the category around an integrated, cloud-delivered platform that combines proactive and reactive controls across application development and production. Modern products connect to AWS, Azure, Google Cloud and Kubernetes; scan code and artefacts before deployment; map configurations, identities, vulnerabilities and data; observe runtime; and prioritise risks using their relationships.
The evolution matters because a list of vulnerabilities is not the same as risk. A severe vulnerability on an isolated test machine may be less urgent than a moderate flaw on an internet-facing workload holding customer data and reachable through a privileged service account. The platform’s economic value is its ability to reduce millions of technically valid findings to the handful of paths that could cause material loss.
How the architecture works
A CNAPP first discovers the estate. Read-only integrations query cloud control planes for accounts, subscriptions, resources, network paths, policies, identities, data services and audit logs. Snapshot technology can inspect virtual disks or images outside the live workload. Repository and CI/CD integrations analyse code, infrastructure templates, container registries and secrets before release. Optional agents or runtime sensors observe processes, system calls, files, memory and network activity inside production workloads.
The platform then normalises these inputs into a common asset and relationship graph. A graph may connect a developer to a repository, a pipeline to a container image, the image to a running cluster, the cluster to a service identity and that identity to a sensitive database. Threat intelligence, exploit availability, actual usage and runtime observations enrich the graph. Risk scoring should elevate reachable, exploitable and business-critical paths rather than merely counting weaknesses.
Finally, the system routes remediation to the right owner. A developer may receive a pull request fixing an infrastructure template; a cloud team may receive a least-privilege recommendation; the SOC may isolate a workload or revoke a token; management may see exposure by application or business service. The best products preserve one evidence chain from the original code flaw to the production asset and the corrective action.
Agentless breadth versus runtime depth
Agentless security connects through cloud APIs, audit logs and snapshots without installing software inside every protected workload. It can inventory an estate within hours, including dormant, short-lived and previously unknown resources. There is no host-performance impact and fewer deployment conflicts. This is particularly effective for configuration, permissions, vulnerability and data discovery.
Its weakness is time and depth. A snapshot shows a point-in-time state, not every process or memory action occurring between scans. APIs may be delayed, incomplete or limited by provider permissions. Agentless systems can often recommend a policy change or invoke a cloud control, but they do not naturally provide the same inline prevention as code running inside the workload.
Agents and runtime sensors provide continuous process-level visibility and immediate enforcement. They can identify exploitation, suspicious child processes, fileless behaviour, container drift and lateral movement while an application runs. Their cost is operational: deployment, version control, kernel compatibility, resource consumption and incomplete coverage of ephemeral or serverless services.
| Model | Strength | Weakness | Best use |
|---|---|---|---|
| Agentless | Fast, broad, low-friction discovery | Less continuous runtime detail and inline control | Posture, entitlements, data, vulnerability and attack-path mapping |
| Agent or sensor | Deep telemetry and real-time intervention | Deployment and maintenance overhead | Production runtime detection, prevention and forensics |
| Hybrid | Broad estate coverage plus depth where risk is highest | More complex architecture and packaging | Enterprise CNAPP and cloud detection and response |
The debate is therefore not likely to end with one method defeating the other. Hybrid coverage is the strategic destination. Agentless discovery establishes breadth; runtime evidence validates exploitability and enables response. Vendors that combine both in one data model are better protected from feature commoditisation than single-mode products.
The attack surface has shifted
Misconfiguration remains important, but the modern cloud attack increasingly begins with identity. Human administrators, contractors, service accounts, API keys, OAuth tokens and machine identities can all provide legitimate-looking access. Google Cloud’s H1 2026 Threat Horizons report found identity issues were used for initial access in 83% of the major cloud and SaaS incidents in its H2 2025 response data; attackers targeted data in 73% of cloud-related incidents. These are vendor-observed cases rather than a universal breach census, but the directional lesson is clear: credentials and permissions are the cloud control plane.
The second shift is from stable servers to software supply chains. Code is assembled from open-source packages, container images, infrastructure templates and automated pipelines. A leaked secret or malicious dependency can move from a developer environment into production faster than a traditional ticketing process can respond. Security must therefore operate before deployment and retain the connection between code ownership and runtime exposure.
The third shift is towards data theft and control-plane abuse. Adversaries can use legitimate administration tools to enumerate storage, create access keys, disable logging or copy data without deploying conventional malware. They may also target backups, virtualisation and identity infrastructure to prevent recovery. Effective cloud defence needs audit, identity, data-flow and management-plane telemetry, not simply malware detection inside a virtual machine.
Finally, SaaS and third-party integrations have become part of the enterprise attack surface. Long-lived tokens, excessive application consent and vendor integrations can bypass the boundary of a cloud account. Cloud security increasingly overlaps with SaaS security posture management, identity threat detection, data security and third-party risk.
Market size and growth
Published market estimates should be treated as ranges because researchers define cloud security differently. Some include services, identity, network security, encryption, SaaS controls and compliance; others isolate CNAPP software. Grand View Research estimates the broad cloud-security market at $39.1 billion in 2025 and $43.8 billion in 2026, rising to $97.9 billion by 2033, a 12.2% compound annual growth rate. Its definition includes solutions and services across public, private and hybrid clouds.
CNAPP is smaller but faster-growing. Grand View estimates approximately $16.8 billion in 2026 and $38.0 billion by 2030, while another industry estimate from Mordor Intelligence places the category at $10.9 billion in 2025 and $28.0 billion in 2030. The spread is not evidence that one number is necessarily wrong; it reflects whether adjacent application security, data, identity, services and workload tools are counted. The credible conclusion is a low-to-mid-teens growth market overall, with the integrated CNAPP layer growing around 20% as point products consolidate.
| Market lens | Starting estimate | Forecast | What it captures |
|---|---|---|---|
| Broad cloud security | $39.1bn in 2025 | $97.9bn in 2033; 12.2% CAGR from 2026 | Solutions and services spanning identity, network, data, monitoring and compliance |
| CNAPP – Grand View | $16.8bn in 2026 | $38.0bn in 2030; roughly 21% CAGR | Integrated cloud-native application protection |
| CNAPP – Mordor Intelligence | $10.9bn in 2025 | $28.0bn in 2030; 20.8% CAGR | A narrower independent estimate of the same emerging category |
| Total information security | $244bn in 2026 | 11.6% constant-currency growth | industry research full global security-spending context |
The demand drivers are durable: continued cloud migration; faster application release cycles; multi-cloud complexity; regulatory evidence requirements; explosive machine-identity growth; more data and AI workloads; and the need to consolidate tools. Offsetting forces include hyperscaler-native bundling, feature convergence, open-source runtime tools and buyer pressure to reduce overlapping licences. Revenue growth can therefore remain strong while individual modules experience price compression.
Industry structure
Cloud security is not a clean winner-takes-all market because vendors enter from different control points. Hyperscalers own infrastructure APIs and can bundle native controls. Independent CNAPP vendors offer one view across multiple clouds. Endpoint companies bring workload agents and threat intelligence. Network-security vendors extend policy from firewalls and secure access into cloud applications. Vulnerability vendors bring asset discovery and exposure management. Application-security companies own developer workflows. Data and identity specialists protect the two assets attackers increasingly target.
industry research August 2025 CNAPP Market Guide formalised the category around lifecycle protection from development to production, while its planned first CNAPP Magic Quadrant is scheduled for October 2026. industry research Q1 2026 evaluation covered 14 significant providers and named Wiz, Sysdig and Qualys as Leaders; this result is useful but should not be mistaken for a complete market-share ranking. Different evaluations reward different combinations of posture, runtime, developer security, customer feedback and strategy.
Consolidation is reshaping the structure. Google completed its acquisition of Wiz in March 2026 after announcing the transaction a year earlier, bringing the best-known independent CNAPP franchise into a hyperscaler while committing to preserve multicloud support. Palo Alto has combined the next generation of Prisma Cloud with cloud detection and response in Cortex Cloud. Fortinet absorbed Lacework. IBM acquired Polar Security for data security posture management, while Palo Alto previously acquired Dig Security and Cider Security. The direction is consistent: posture alone is not enough, and cloud platforms are assembling code, data, identity and runtime.
Competitive landscape
Wiz and Google Cloud. Wiz changed the category by making multicloud discovery fast and agentless, then using a security graph to connect exposed resources, vulnerabilities, identities and data. This created rapid time to value and made cloud risk understandable to executives as well as practitioners. Google adds distribution, threat intelligence, security operations and AI infrastructure. The strategic tension is neutrality: customers want Wiz to remain equally effective across AWS, Azure, Google Cloud and Oracle Cloud even though it now belongs to one of those platforms.
Palo Alto Networks. Cortex Cloud combines CNAPP posture and code-to-cloud context with real-time cloud detection and response, the Cortex XDR agent and XSIAM security operations. Its advantage is breadth across network, cloud and SOC workflows, supported by a large enterprise sales channel. The challenge is delivering a coherent user experience and proving that platform bundles preserve best-of-breed depth.
CrowdStrike. Falcon Cloud Security extends CrowdStrike’s workload sensor, threat intelligence, identity context and cloud-scale data platform. It is naturally strong where a customer already uses Falcon on endpoints and servers or wants the same detection and response workflow across human and cloud workloads. Its strategic opportunity is to turn the endpoint beachhead into a broader cloud and exposure-management platform. Its challenge is matching the frictionless breadth and developer posture associated with cloud-native CNAPP specialists.
Microsoft. Defender for Cloud benefits from Azure distribution and integration with Entra identity, GitHub development, Defender XDR and Sentinel. It can be economically compelling for Microsoft-centric customers and has privileged native context. In heterogeneous environments, buyers must assess cross-cloud depth, licensing complexity and whether a platform optimised around Azure provides the clearest independent view.
Sysdig and Aqua Security. Both grew from containers and runtime. Sysdig’s heritage in Falco and cloud-native telemetry makes runtime truth central to its proposition; Aqua spans code, supply chain, Kubernetes and runtime controls. They can win complex cloud-native accounts that value deep detection and enforcement. The trade-off is competing against broader platforms with greater distribution and more established consolidation budgets.
Orca Security. Orca pioneered agentless workload inspection using cloud snapshots and built a graph-based approach similar in spirit to Wiz. It remains attractive where speed of deployment and broad visibility matter. As the market shifts towards real-time response, it must sustain differentiation in runtime, data and remediation without losing its simplicity.
Qualys, TrendAI, Tenable and Rapid7. These vendors approach CNAPP from vulnerability, workload or exposure management and can cross-sell into large installed bases. Qualys TotalCloud combines posture, workload, identity and remediation and was recognised as a Leader in industry research 2026 evaluation. TrendAI has long-standing workload-security depth. Tenable and Rapid7 connect cloud findings to wider exposure programmes. The debate is whether installed-base leverage outweighs the mindshare and product velocity of cloud-native specialists.
SentinelOne, Fortinet and Check Point. SentinelOne combines agentless CNAPP with agent-led workload protection and the Purple data and AI layer. Fortinet can integrate cloud protection with networking and its Lacework assets. Check Point brings network, workload and posture capabilities through CloudGuard. Each can be relevant to customers consolidating around an existing security relationship, but cloud must compete internally for engineering focus and externally against category specialists.
| Vendor group | Natural advantage | Key strategic question |
|---|---|---|
| Wiz / Google | Agentless multicloud graph, usability and rapid discovery | Can it retain neutrality and innovation inside Google? |
| Palo Alto Networks | CNAPP plus runtime, network and SecOps platform | Can breadth become a simpler, integrated operating model? |
| CrowdStrike | Runtime sensor, adversary intelligence, identity and SOC workflow | Can it close posture and developer-workflow gaps fast enough? |
| Microsoft | Azure, Entra, GitHub, Defender and Sentinel distribution | How strong and simple is the experience outside Microsoft? |
| Sysdig / Aqua | Container, Kubernetes and runtime depth | Can specialist efficacy overcome platform consolidation? |
| Orca | Low-friction agentless discovery and contextualisation | Can it add real-time control while preserving simplicity? |
| Qualys / Tenable / Rapid7 / TrendAI | Exposure-management or workload installed bases | Can incumbents establish cloud-native mindshare and workflow? |
| Hyperscaler-native tools | Native telemetry, integration and consumption channels | Will customers accept provider-specific views in multicloud estates? |
What creates a moat
Context is more defensible than scanning. Cloud APIs make basic asset and configuration discovery broadly available. A moat emerges when a vendor builds an accurate relationship graph across infrastructure, identities, vulnerabilities, data, code owners and runtime, then uses that context to rank what can actually cause loss. The graph improves as integrations, historical observations and customer workflows deepen.
Runtime evidence raises switching costs. Sensors embedded in production, tuned policies, behavioural baselines, forensic history and response playbooks become operational infrastructure. A vendor that can show which exposed vulnerability is executing in production can remove noise and justify a larger budget. Runtime is technically demanding, however, and poor performance or unsafe updates can destroy trust quickly.
Developer workflow creates distribution. The most valuable fix is often made in a code repository before deployment. Integrations with GitHub, GitLab, build systems, ticketing and infrastructure-as-code tools place security inside the engineering process. A finding that identifies the owning developer, proposes a safe correction and prevents recurrence is more valuable than another central dashboard.
Threat intelligence and data scale improve detection. Cross-customer observations can reveal attacker infrastructure, malicious packages and emerging techniques. Yet raw data volume is not automatically a moat: it must be normalised, labelled and converted into detections with low false-positive rates. Hyperscalers and large endpoint vendors have structural advantages in telemetry, while specialists can win through a cleaner data model and faster product execution.
Trust is the limiting resource. Cloud-security products often receive read access across an estate and, for remediation, powerful permissions to change production. Customers scrutinise architecture, data handling, software updates, regional processing, role separation and auditability. Trust compounds through reliable operation and can be lost through one incident.
Convergence with identity, data, SecOps and secure access
CNAPP is converging with identity because cloud permissions determine reachability. It is converging with data security because the consequence of an attack depends on what information is exposed. It is converging with security operations because posture must inform detection and response. It is converging with application security because cloud infrastructure is created in code. It also touches SSE and SASE, which govern how users access SaaS and internet applications, and cyber resilience, which protects and restores cloud data.
These adjacencies do not mean one vendor will own every control. The buyer’s architectural question is where integration creates a better decision. Combining vulnerability, public exposure, privilege and sensitive data clearly improves prioritisation. Combining unrelated features merely to offer a discount may create a larger contract without improving security. Successful platforms reduce hand-offs and duplicated data while keeping enough openness for specialist controls.
For the SOC, cloud context can turn an isolated alert into an incident: a newly created access key, an unusual console login, a changed security group and a large data transfer may be weak individually but decisive together. For developers, the same platform should trace the unsafe configuration back to its template and owner. The category’s destination is one risk narrative serving different teams, not one interface forced on everyone.
AI expands both the market and the attack surface
AI increases cloud-security demand through infrastructure, software creation and autonomous activity. Training and inference clusters create valuable data, model artefacts, notebooks, pipelines, APIs and high-cost compute resources. AI-assisted development increases code volume and release speed, which can multiply insecure configurations and vulnerable dependencies unless controls are embedded in the pipeline. Agentic systems add non-human identities that can call tools, access data and take actions continuously.
The new security unit is not only a workload; it is an AI system with a model, data, prompts, retrieval sources, plugins, agents and permissions. Cloud-security vendors are extending discovery to AI services and models, scanning for exposed endpoints and sensitive training data, mapping who can invoke an agent and observing runtime behaviour. This creates adjacency with AI security posture management and model-runtime protection, although definitions remain fluid and marketing is ahead of mature deployment.
AI also improves defence. Copilots can explain findings, generate queries, summarise incidents and recommend fixes. More advanced agents can investigate attack paths, propose least-privilege policies or create remediation pull requests. The economically meaningful step is not natural-language search; it is reducing analyst and developer work while preserving accuracy and approval controls.
Autonomous remediation must be constrained. An incorrect cloud change can interrupt production across regions. The winning architecture will combine machine speed with policy boundaries: read-only discovery by default, scoped credentials, simulation, human approval for high-impact changes, complete audit trails and reliable rollback. Vendors that own rich context and enforcement points are well placed, but they must prove safety rather than merely attach an AI label.
Latest developments
Cloud identity has become the priority. The Cloud Security Alliance ranked inadequate identity and access management as the leading cloud threat in its 2026 assessment. Google’s latest cloud incident data likewise attributes most initial access in the observed major cloud and SaaS cases to identity issues. This shifts budgets towards entitlement analysis, machine-identity governance, token protection and behavioural detection, and makes CIEM less of a standalone feature than a foundation of CNAPP.
Runtime is returning to the centre. The first CNAPP wave was led by rapid agentless discovery. Buyers now want proof that a risk is active and controls that can stop exploitation. Palo Alto’s move from Prisma Cloud towards Cortex Cloud, Sysdig’s runtime-led positioning and the expansion of endpoint vendors into cloud workloads all reflect the same shift. Posture identifies possible paths; runtime establishes whether the path is being used.
Cloud and SOC platforms are merging. Cloud alerts without application, identity and infrastructure context are hard to investigate in a general SIEM. Conversely, a CNAPP without incident workflow can become another dashboard. Vendors are therefore connecting cloud detection to XDR, SIEM and automated response. industry research 2026 XDR research also treats cloud and identity as critical native detection surfaces, reinforcing convergence from the security-operations side.
The category has moved into strategic M&A. Google’s completed Wiz acquisition is the clearest evidence: cloud security is now important enough to influence hyperscaler differentiation, not merely attach to a security budget. The transaction also removes the largest independent pure-play from the market and raises the strategic value of remaining scaled platforms. It may encourage closer partnerships or further acquisitions involving runtime, data, AI and application-security specialists.
AI infrastructure is creating a new premium surface. CrowdStrike reported cloud-conscious intrusions rose 37% in its 2026 Global Threat Report, including a much faster increase in state-linked activity. Google observed attackers targeting data in nearly three-quarters of its cloud-related incident sample. Both are vendor datasets and should be interpreted accordingly, but together they show why high-value model data, compute and machine identities are attracting sophisticated adversaries.
The cloud-security operating model
Technology alone does not resolve cloud risk because ownership is distributed. Developers create applications, platform teams operate shared infrastructure, identity teams manage access, data teams govern information and the SOC responds to attacks. A central cloud-security team can define policy and provide the platform, but remediation must reach the team that owns the resource. The practical model is central guardrails with federated accountability.
Good programmes begin with inventory and business context, establish secure defaults, enforce critical controls in deployment pipelines and reserve runtime intervention for high-confidence threats. They measure the age and reachability of material attack paths rather than the gross number of findings. They also distinguish between a compensating control and a permanent fix: blocking an exposed port may reduce immediate risk, but correcting the infrastructure template prevents recurrence.
Cloud security should improve engineering velocity rather than become a late approval gate. Developers need concise findings, ownership, evidence, a recommended code change and a way to suppress false positives transparently. Security teams need governance, exceptions, cross-cloud visibility and assurance that critical risks cannot silently persist. Products win adoption when they serve both constituencies without forcing developers to become security analysts.
How to evaluate cloud-security platforms
- Coverage: Does the platform discover every relevant account, subscription, cluster, SaaS integration, data store and AI service across the customer’s actual estate?
- Context: Can it connect internet exposure, exploitability, permissions, data sensitivity, runtime and business ownership into one attack path?
- Runtime: Does it detect and prevent active exploitation across VMs, containers, Kubernetes and serverless services with acceptable overhead?
- Code-to-cloud traceability: Can a production risk be mapped to the repository, pipeline, template and developer who can fix it?
- Identity and data depth: Does the product understand effective permissions, machine identities, toxic combinations and sensitive-data reachability?
- Remediation: Can it propose or execute safe changes, integrate with tickets and pull requests, and verify that a fix persists?
- Security operations: Are cloud events correlated with endpoint, network, SaaS and identity evidence, and can the SOC contain them quickly?
- Architecture and trust: What privileges, agents, snapshots and data transfers are required? How are updates, regions, tenancy and audit handled?
- Economics: Is pricing tied to resources, workloads, identities, data or platform credits, and does it remain predictable as cloud usage scales?
- Outcomes: Does the product reduce material exposure and remediation time, or merely produce more findings?
The investment debate
| Bull case | Bear case |
|---|---|
| Cloud, data and AI consumption expand the number of resources, identities and interactions that require protection. | Hyperscalers can bundle more native security and use infrastructure relationships to compress specialist pricing. |
| CNAPP consolidates several point products, allowing leaders to capture a larger wallet and improve retention. | Core posture, vulnerability and compliance features are becoming standardised across vendors. |
| Identity-led and malware-free attacks make cross-domain cloud context more valuable, supporting platform economics. | Broad suites can accumulate features without achieving best-of-breed depth or a coherent workflow. |
| Runtime, data, developer and SOC integrations create high switching costs after deployment. | Agents introduce operational risk, while API access and graphs are replicable unless prioritisation is demonstrably better. |
| AI agents create an enormous new machine-identity and governance surface and can increase automated security usage. | Hyperscalers and model providers may build important AI controls natively, narrowing third-party opportunity. |
| Security automation can convert labour savings into measurable return on investment. | Unsafe remediation or noisy AI can damage production and customer trust, limiting autonomy. |
The central tension is attractive category growth versus value migration. Cloud estates will keep expanding, but basic scanning will not necessarily retain premium pricing. Vendors must move up the stack from finding issues to proving exploitability, orchestrating fixes and stopping attacks. The same convergence that increases a leader’s addressable market can also reduce the number of independent suppliers a customer needs.
Google’s ownership of Wiz strengthens cloud-security validation but complicates the pure-play landscape. Palo Alto and CrowdStrike have the clearest public-platform routes from CNAPP into runtime and security operations. Microsoft benefits from distribution and native context. Qualys offers profitable exposure through asset and vulnerability workflows, while private specialists such as Sysdig, Aqua and Orca retain differentiated technical positions. Zscaler and Netskope benefit more indirectly as SaaS, data and user access converge with cloud policy; Rubrik benefits where the priority is cloud data resilience and recovery.
For investors, leading indicators include cloud-resource growth, net expansion of platform customers, attachment of runtime and data modules, adoption beyond the vendor’s home domain and evidence that remediation time is falling. Reported annual recurring revenue is more valuable when it reflects multiple integrated workflows rather than discounted shelfware.
What to watch
- Wiz after Google: multicloud neutrality, product velocity and integration with Google Security Operations.
- Runtime attachment: whether customers move from posture-only deployments to real-time cloud detection and prevention.
- Machine identity: discovery, ownership and least privilege for service accounts, workloads and AI agents.
- AI security: whether model, data and agent controls become paid production workloads or remain features and pilots.
- Code-to-cloud remediation: measurable developer adoption and closed-loop fixes rather than more central alerts.
- Data context: the degree to which DSPM becomes native to CNAPP and improves prioritisation.
- Pricing: movement from opaque modules or ingestion charges towards predictable resource- and outcome-aligned models.
- Hyperscaler response: deeper native bundling versus continued support for independent multicloud ecosystems.
- Platform consolidation: further acquisitions across runtime, application security, identity and data.
- Operational trust: service reliability, safe content delivery, scoped privileges and audited autonomous remediation.
Bottom line
Cloud security has progressed from guarding a new location to governing a programmable business system. The old question was whether a cloud resource was configured correctly. The modern question is whether a chain connecting code, infrastructure, identity and data can be exploited, whether it is active now and which team can break that chain safely.
CNAPP is becoming the centre of this architecture, but the winning platform must do more than assemble acronyms. It needs agentless reach, runtime depth, an accurate relationship graph, developer adoption, identity and data context, security-operations integration and trusted remediation. That favours vendors with a clear control point and a credible path across adjacent domains.
The long-term market remains attractive because cloud and AI increase both productive activity and machine risk. The enduring winners will be those that turn a continuously changing estate into a small number of comprehensible decisions—and can act on those decisions without slowing the business or breaking production.