CMDashCybersecurity Maturity Dashboard

← All landscape areas

Cloud Security · Advanced

Cloud Workload Protection (CWPP)

Protects VMs, containers, and serverless workloads.

8 options listedTypical cost: $25k-$250k/yrPROTECT (PR) / DETECT (DE)

Overview

CWPP secures running workloads with vulnerability scanning, runtime protection, and integrity monitoring across hybrid and multi-cloud. It extends endpoint-style defense to ephemeral cloud compute. Charged per workload, vCPU, or sensor-hour. Commonly consolidated into CNAPP suites.

Workload runtime protection as the cloud estate matures.

Advantages

Runtime protection for VMs/containers/serverless
Sysdig strong on containers (Falco)
CrowdStrike extends the endpoint model to cloud.

Trade-offs

Agent overhead and coverage gaps
ephemeral workloads are tricky
often forces a CNAPP suite purchase.

Vendors & tools in this area

CrowdStrikeCommercial

Cloud-native endpoint/identity/cloud leader; premium platform.

WizCommercial

Agentless CNAPP leader; risk graph, fast UX.

Palo Alto Prisma CloudCommercial

Cloud/SASE + CNAPP suite (Prisma) - broad, premium.

AquaCommercial

Cloud-native and container security; runtime protection.

SysdigCommercial

Container/cloud security built on Falco; runtime insight.

FalcoOpen source

CNCF runtime threat detection.

TrivyOpen source

Images/IaC/deps/secrets scanner (Aqua).

SentinelOne Singularity Cloud Workload SecurityCommercial

AI-driven runtime CWPP built on SentinelOne's EDR/XDR engine.

Start free trial Browse the full atlas

Cloud Workload Protection (CWPP) — Cybersecurity Landscape Atlas — CMDash