GLOSSARY
Cloud security terms: a glossary for CNAPP buyers
Short answer
34 terms used across this site, each defined in two or three sentences. Vendor product names are described as the vendor describes them. Terms with an obvious next step link to the lesson or page that goes deeper.
Agent
Software installed on a workload or host that reports on it from the inside. In cloud security, agents and sensors provide runtime detection and, on some platforms, blocking.
Agentless scanning
Reading a workload without installing software on it, through cloud provider APIs and a view of the workload's storage. It is the fast route to broad coverage, but it does not see activity as it happens.
AI-SPM
AI security posture management: an inventory of models, AI services, pipelines and agents, with checks on how they are configured and exposed. Several platforms here list it as a module.
Air-gapped environment
An environment with no connection to the public internet, often used for regulated or classified work. Cloud-hosted security platforms usually cannot reach it; on the pages we reviewed, Aqua Security is the only platform here that names disconnected environments.
Attack path
A chain of findings that together let an attacker reach something valuable, for example an exposed VM whose identity can read a sensitive data store. Ranking findings by attack path shortens a fix list.
Azure Arc
Microsoft's service for managing servers outside Azure from Azure. Defender for Servers uses it to cover on-premises and other non-Azure machines.
Block storage
The virtual disks attached to cloud VMs and some container hosts. Agentless workload scanning reads a view of block storage to inspect a workload's file system.
CDR
Cloud detection and response: detecting and investigating attacks in cloud accounts and workloads, from cloud logs and runtime sensors.
CIEM
Cloud infrastructure entitlement management: finding identities and roles with more permissions than they use, across cloud accounts.
CNAPP
Cloud-native application protection platform: one product that combines posture management, workload scanning, identity and data checks, code scanning and runtime protection for cloud estates. Every platform on this site is a CNAPP.
Connector
The configuration that links a security platform to one cloud account, subscription or project, usually through a read-only role. Defender for Cloud uses connectors to add AWS and Google Cloud.
Container image
The packaged file system a container starts from. Scanning images finds vulnerable packages and secrets before and after deployment.
Coverage strip
This site's chart of eight environments, filled where a vendor's own pages name that environment. It shows what is published, not what was tested.
CSPM
Cloud security posture management: checking cloud configuration through provider APIs for risky settings such as public storage or open network rules. It is the lightest form of agentless coverage.
CWPP
Cloud workload protection platform: protection for the workloads themselves (VMs, containers, serverless), by scanning and at runtime.
DSPM
Data security posture management: finding where sensitive data sits in cloud storage and databases, and who can reach it.
eBPF
A Linux kernel technology that runs small, verified programs on kernel events without changing the kernel. Many cloud runtime sensors, including those from Orca, Wiz and Upwind, are built on it.
Falco
An open-source runtime threat detection project created by Sysdig and now a CNCF graduated project. Sysdig Secure builds its runtime detection on it.
Foundational CSPM
The free posture tier of Microsoft Defender for Cloud. Microsoft states that from 27 October 2026 it becomes opt-in for new Azure subscriptions.
Inventory
The list of every cloud resource a platform can see, by environment and type. A complete inventory is the first output of coverage and the baseline for every later check.
Kubernetes
The open-source system most teams use to run containers at scale. Coverage of Kubernetes means seeing clusters, nodes, workloads and their configuration.
Multi-cloud
Running workloads in more than one cloud provider. For this site's purposes, an estate with accounts in two or more of the environments on the coverage strip.
Organization-level connection
Connecting a security platform at the top of a cloud provider's account hierarchy so new accounts underneath are covered automatically.
PaaS
Platform as a service: managed cloud services such as databases, queues and app hosting, where the provider runs the servers. They are seen through cloud APIs rather than by reading a disk.
Path to first findings
This site's criterion for what must happen before a platform shows its first full inventory and findings: an API connection, a paid tier or an agent rollout.
Runtime protection
Detecting and, on some platforms, blocking malicious activity inside running workloads. It needs a sensor or agent.
Security Graph
Wiz's name for the model that links infrastructure, identities, data and AI resources into attack paths.
Sensor
Vendors' usual name for a lightweight runtime agent, often eBPF-based, that watches processes, network connections and file changes on a workload.
Serverless function
Code that a cloud provider runs on demand without a server the customer manages. Coverage means seeing the function, its code package, its permissions and its triggers.
SideScanning
Orca Security's name for its agentless approach. Orca says it reads workloads' runtime block storage and reconstructs the file system in a read-only view.
Trivy
An open-source vulnerability and misconfiguration scanner maintained by Aqua Security under the Apache-2.0 license.
Verified Exploit Paths
SentinelOne's name for attack paths its Offensive Security Engine has checked for exploitability.
Weighted total
The sum of each criterion score times its weight, divided by the sum of the weights. Every total on this site is computed this way, in code.
Workload
Anything that runs code in the cloud: a VM, a container, a Kubernetes pod, a serverless function or a managed service. Coverage is measured in workloads seen, not accounts connected.