CLOUD SEC 101
Cloud Sec 101: how to get every cloud workload in view
Short answer
Nine lessons in three tracks: seeing the estate, choosing a platform and running coverage. Each takes a few minutes and links to the rankings and vendor pages it draws on. Start with what full coverage means if you are comparing cloud security platforms for the first time.
Which lesson should you start with?
Start with Seeing the estate if you are new to CNAPPs. Go to Choosing a platform if you already have a shortlist, and to Running coverage once a platform is connected.
Track 1: Seeing the estate
What full coverage means, and the two ways a platform sees a workload: from outside without an agent, and from inside with a sensor.
LESSON 1 · 3 MIN READ
What full cloud coverage means, and why vendors mean different things by itFull coverage has three parts: every environment, every workload type and enough depth on each. How to tell which part a vendor is talking about.
LESSON 2 · 3 MIN READ
How agentless scanning works, and what it cannot seeAgentless scanning reads workloads without installing software on them. The two main approaches, what they can and cannot see, and how vendors describe them.
LESSON 3 · 2 MIN READ
Runtime sensors and agents: what they add after agentless coverageA runtime sensor runs on the workload and sees what happens as it runs. What eBPF sensors do, which vendors lead on runtime, and what a sensor costs you in rollout.
Track 2: Choosing a platform
Mapping your own estate first, reading what vendors name, and testing coverage in a trial.
LESSON 4 · 2 MIN READ
Map your cloud estate before you trial a cloud security platformBefore you trial a cloud security platform, write down your environments, workload types and owners. A one-page map that makes every vendor answer the same questions.
LESSON 5 · 2 MIN READ
What a vendor's list of named clouds tells you, and what it does notSome cloud security vendors name every cloud they support; others say multi-cloud and stop there. How to read both, and what to ask when a cloud is not named.
LESSON 6 · 2 MIN READ
How to test coverage in a cloud security platform trialA trial plan focused on coverage: connect the same accounts to each platform, time the first inventory, plant known findings and count what each one misses.
Track 3: Running coverage
Turning the first inventory into a fix list, deciding when to add a sensor, and keeping coverage complete as the estate grows.
LESSON 7 · 2 MIN READ
From inventory to fix list: the first week after connecting a cloud security platformThe first full inventory produces thousands of findings. How attack paths and risk context turn them into a short fix list, and what to fix first.
LESSON 8 · 2 MIN READ
When to add a runtime sensor after agentless coverageAgentless coverage first, sensors where they pay off. How to decide which workloads get a runtime sensor, and in what order, once the inventory is complete.
LESSON 9 · 2 MIN READ
Keeping cloud security coverage complete as the estate growsNew accounts, new clouds and acquisitions open coverage gaps. How to catch them: organization-level connections, a monthly reconciliation and a rule for new environments.
Where are the definitions?
34 terms, from agentless scanning to workload, each in two or three sentences.
Where are the quick answers?
23 questions about coverage, buying, each platform and how this site scores.