It’s 2024, almost every organisation has a cloud footprint, using one or more Cloud Service Providers, and most still struggle with the well-known cloud security risks. 

From visibility gaps, lack of security controls, compliance challenges or the fear of a data breach that almost seems certain with 80% of cloud breaches happening in Cloud. 

Read more about top cloud risks here: https://insights.integrity360.com/what-are-the-main-cloud-security-threats-in-2024 

The confusion – the rise of the FLAs! 

For years the industry seemed to be struggling to find a strong answer to these challenges. Most security vendors approach cloud security from their legacy background point of view. For example, a company focused on Identity will promote IAM and CIEM solutions as the answer, while for Network Security vendors they focus on Cloud Firewalls and WAF solutions, or endpoint security vendors evolving to CWPP, which made the last few years the most confusing to security professionals who struggled to find the optimal solution to secure their cloud environments. 

An interesting pattern appeared: for every challenge, the industry responded with an FLA – a Four-Letter Acronym! CSPM, CWPP, CIEM, KSPM, WAAP, DSPM, SSPM, to name a few. While there is a real need for the capabilities delivered by these solutions, it’s unrealistic and impractical to expect organisations to select, procure, manage and integrate all these different tools to address their new security requirements – not to mention limited budgets and resources.   

Then many tech start-ups appeared in the picture, each trying to find an innovative solution to one or more of these risks. Hundreds of security tools that have a very narrow focus on one cloud security challenge. A tool for securing container images, another for CI/CD pipeline security, one more for API security, and another one to check the cloud workloads vulnerabilities, one to control Identities and entitlements… , you get the picture. 

Can the answer be another acronym?

It may seem obvious, but almost all of the cloud security tools are – on abstract level – just another SaaS. It’s a software application hosted in cloud, so why not cover all the required capabilities to secure cloud environments? Another obvious answer: vVision, logic and ability to execute - just like any other software application. 

Gartner provided a theoretical answer in 2021: Cloud Native Application Protection Platform (CNAPP). The name may not fully reflect the intended purpose of that solution, but in summary, a CNAPP goal is to protect the enterprise cloud applications from development to runtime – and that covers cloud management, workloads, data, identities, code, and every asset in an enterprise cloud environment. 

And as expected with any new technology trend, many security vendors including Cloud Service Providers tried to relabel their existing cloud security tools as CNAPPs, giving the lack of standard market definition of what are the expected capabilities of a CNAPP. 

In Integrity360, we have tested and evaluated more than 30 cloud security solutions that are labelled as CNAPP, to provide our clients with the best Cloud Security solutions. We partnered with the top cloud security companies to ensure we have the right portfolio that covers every client use case, selecting the most suitable solution that caters for our clients’ security requirements, cloud estate, and different business needs.  

Integrity360 and Orca Security

Orca Security is one of our main strategic cloud security partners, as they offer a unique holistic approach to cloud security, with one single platform securing every layer of the cloud tech stack: infrastructure, applications, CI/CD pipeline, Identities & entitlements, and data. 

Orca Security platform delivers 100% visibility and coverage of the entire cloud estate on day 1, ingesting loads of data and making it consumable and actionable so that teams can use it to support decision making. adding rich context for cloud security findings as attack vectors, rather than siloed alerts. In summary, Orca Security platform provides all the capabilities required from a CNAPP solution with an intuitive UX and quick time-to-value, and more. 

Reach out to us or contact your Integrity360 account manager, for a complimentary Cloud Risk Assessment, that gives you unprecedented visibility of all your cloud risks – and see if it is the answer to secure your cloud.