The term CNAPP exists because cloud security outgrew its first generation of point tools. Early cloud security meant running a CSPM to catch misconfigured storage buckets and a separate CWPP to agent the virtual machines, with yet another tool for containers and a fourth for infrastructure-as-code. Each tool produced its own list of findings, prioritised by its own logic, and a security team was left trying to stitch together what mattered across thousands of alerts. CNAPP consolidates this into a single risk view.
The unification is not just about fewer vendors. The defining capability of a CNAPP is prioritisation across the combined context. A misconfigured IAM role is a finding; a vulnerable library inside a container is a finding; an internet-exposed workload is a finding. But a vulnerable library inside an internet-exposed workload running under an over-privileged role, with a known exploit in the wild, is a single high-priority risk. CNAPPs surface that combined risk rather than three disconnected alerts, which is what lets a finite security team actually act.
Identity is central to modern CNAPP because cloud attacks are predominantly identity-driven. Attackers do not usually exploit a zero-day to get in; they steal a credential, abuse an over-permissive role, or chain together permissions until they reach sensitive data or administrative access. A CNAPP maps the identity graph — who can do what, from where, with what privileges — and flags the identities that represent the largest blast radius.
CNAPP is relevant to any organisation running production workloads in AWS, Azure, or GCP, and it becomes essential as cloud usage matures beyond a single team and account. Multi-cloud, multi-account, containerised, and Kubernetes-based environments generate the kind of scale and complexity that point tools cannot keep up with. The same platforms also feed the compliance conversation: CIS Benchmarks, ISO 27017/27018, PCI DSS, and the cloud controls in NIS2 and DORA all map onto CNAPP findings.
Passeca delivers CNAPP on the Wiz platform, covering AWS, Azure, and GCP with posture, workload, identity, data-risk, and IaC scanning. The engagement model is flexible — Passeca can implement and hand over, tune and operate as a managed service, or integrate CNAPP findings into SOC-as-a-Service for detection and response across the cloud estate. The aim is always the same: turn tens of thousands of findings into the handful of risks that genuinely matter.