What is CWPP?
A Cloud Workload Protection Platform (CWPP) is a security solution that protects the workloads running in cloud environments, including virtual machines, containers, and serverless functions. The term was originally defined by Gartner to describe tools that secure the compute layer, meaning the places where application code actually executes. It works consistently across public, private, hybrid, and even on-premises infrastructure, so a workload is protected no matter where it runs.
What is a cloud workload?
- Virtual machines: Traditional compute instances such as EC2 or Azure VMs.
- Containers: Packaged application components running on Docker or Kubernetes.
- Serverless functions: Short-lived code that runs on demand, such as AWS Lambda.
- Databases and other processes: Any resource or task that runs to support an application.
Why are traditional tools not enough?
- Cloud is dynamic: Workloads are spun up and down constantly, so static, perimeter-based tools cannot keep pace.
- No fixed boundary: Cloud environments lack a clear network edge, so security has to focus on the individual workload rather than the perimeter.
- Agents cannot cover everything: Some workloads are ephemeral or unmanaged, which is why many modern CWPPs offer agentless scanning alongside agent-based options.
What does a CWPP actually do?
- Vulnerability scanning: Checks workloads for known weaknesses before and after deployment.
- Runtime protection: Monitors behavior during execution to detect and block threats such as malware, crypto-mining, and privilege escalation in real time.
- Threat detection and response: Can isolate a compromised workload, block malicious traffic, and trigger remediation.
- Compliance support: Helps enforce standards like PCI DSS, ISO 27001, and NIST across workloads.
How does CWPP relate to CSPM and CNAPP?
- vs. CSPM: CWPP protects what runs inside the workload, while CSPM checks how the surrounding cloud is configured. They cover different layers and are stronger together.
- Part of CNAPP: CWPP is a core component of a Cloud-Native Application Protection Platform, which combines workload protection, posture management, and identity security into one platform.
