The modern enterprise is a complex conundrum. Since the beginning of 2020, there has been a 50% increase in cloud usage. Modern Enterprises have grown organically, migrating to the cloud as needed often ending up with a heterogeneous mix of siloed security products managed by siloed security teams. Further, the infrastructure environment is ephemeral. A new persona has emerged such as DevSecOps. Enterprises can only secure what they see, and they need comprehensive visibility across all cloud-native workloads and applications.
Cloud-Native Applications are continuously developed and deployed (CI/CD), and modern enterprises lack a way to measure cumulative risk. This includes risks related to misconfigurations and mismanagement that lead to 99% of cloud security breaches for example lack of Identity and Access Management policy-related errors, unnecessary privileges, leaving default public access to sensitive services like MongoDB, Databases, etc.
Beginning in March 2020, there is a 630% increase in third-party attacks on cloud services. The kind of attacks that bad actors are going after are identifying the location of sensitive data, finding out how to exploit misconfigurations (users, identity, and infrastructure configuration), and exploiting vulnerabilities in software as a launching pad to expand and exfiltrate data. Security and Risk Management leaders need a cumulative risk measure across all vectors of cloud-native applications and workloads.
The spotlight is shining brightly on developers whose role has evolved and expanded from simply CI/CD to enable strategic business outcomes. Enterprises want to unleash their developers to develop compelling and compliant applications to enable strategic business outcomes. Security now needs to be integrated into the software development life cycle (SDLC), breaking the traditional silo’s between Security and DevOps teams. Enabling Infrastructure-as-Code best practices includes vulnerability assessment of images as soon as they are built so that only attested images are deployed, continuous monitoring, automated checks, version control, etc. This adds significantly to the complexity of managing cloud-native resources, and enterprises need a simpler way to leapfrog this complexity without significant investment in developer time and talent.
According to Gartner, “There is synergy in combining CWPP and CSPM capabilities, and multiple vendors are pursuing this strategy. The combination will create a new category of Cloud-Native Application Protection (CNAPs) that scan workloads and configurations in development and protect workloads and configurations at runtime.”