Part 4 of 4 in the "Security Testing Landscape" series
The cloud security market has produced some of the worst acronyms in IT history. Here's the secret that makes them all click: these aren't tests — they're continuous monitoring platforms, and each one watches a different layer of your cloud.
The analogy that makes it permanent: your cloud is a house.
CSPM — Cloud Security Posture Management
Are the doors and windows locked?
CSPM watches your cloud configuration: public storage accounts, wide-open network security groups, disabled encryption, subscriptions without MFA. It continuously scans against benchmarks (CIS, well-architected frameworks) and flags drift the moment someone loosens a setting.
Answers: "Is my cloud set up wrong?"
Tools: Microsoft Defender for Cloud, Wiz, Prisma Cloud, Orca
CWPP — Cloud Workload Protection Platform
Is there an intruder inside a room?
CWPP watches the workloads themselves — VMs, containers, serverless functions: vulnerabilities inside them, malware, suspicious runtime behavior, file integrity changes. Think of it as EDR, but for cloud compute.
Answers: "Is something bad running inside my machines?"
Tools: Defender for Servers/Containers, CrowdStrike Falcon Cloud Security, Aqua, SentinelOne
CIEM — Cloud Infrastructure Entitlement Management
Who has too many keys?
CIEM watches identities and permissions: which users, service principals, and managed identities can do what. It hunts over-permissioned accounts, roles nobody has used in months, and toxic combinations like "this identity can read the secrets vault and is reachable from the internet."
Answers: "Who can do too much?"
Tools: Microsoft Entra Permissions Management, Wiz, Sonrai, Tenable (Ermetic)
CNAPP — Cloud-Native Application Protection Platform
The whole smart-home security system.
Here's the trick: CNAPP is not a new capability. It's the umbrella that bundles CSPM + CWPP + CIEM (plus IaC scanning and container scanning) into one platform with one dashboard. Its real power is chaining findings into attack paths:
vulnerable container + public exposure + admin identity = critical attack path, fix this first
That prioritization — attack paths instead of ten thousand isolated alerts — is why the entire market converged on CNAPP.
Answers: "Show me the actual attack paths across everything."
Tools: Wiz, Prisma Cloud, Orca, Defender for Cloud (full plans) — the same vendors, selling the full suite
EASM — External Attack Surface Management
Walking around the street outside, checking what a burglar sees.
EASM flips the camera: it scans your organization from the public internet, like an attacker with a browser and patience. It routinely finds assets you forgot existed — abandoned subdomains, exposed test APIs, expired certificates, shadow IT spun up by a team three years ago.
The uncomfortable, recurring outcome: EASM discovers things that aren't in your asset inventory at all.
Answers: "What can the internet see of mine?"
Tools: Microsoft Defender EASM, Censys, Palo Alto Cortex Xpanse — and Shodan for the manual version
The House, One Last Time
| Acronym | Watches | House analogy |
|---|---|---|
| CSPM | Settings/config | Doors and windows locked? |
| CWPP | Workloads | Intruder inside a room? |
| CIEM | Identities/permissions | Who has too many keys? |
| CNAPP | All of the above | The full smart-home system |
| EASM | The outside view | What the burglar sees from the street |
One final classification note: CSPM, CWPP, CIEM, and CNAPP are all white box — they read your subscriptions with granted access. EASM is the lone black box of the group, and that outsider's perspective is exactly what makes it valuable.
Series Wrap-Up
Across four posts, the entire landscape reduces to four questions:
- Is my application code safe? → App Security Testing (SAST, DAST, SCA…)
- Can someone actually break in? → Offensive assessments (VAPT, red teams, bug bounties)
- Are we designing, building, and proving it right? → Reviews and audits
- Is my cloud continuously watched? → CSPM/CNAPP family
Master which question each acronym answers, and you'll never nod along blankly in a security meeting again.
Top comments (0)