Decision guide · Cloud Security Posture and CNAPP
Choosing CSPM or CNAPP: consolidating the cloud-security stack
Cloud security stacks historically consist of 3-7 single tools. Gartner coined CNAPP in 2021 as the consolidation category. The tool decision becomes a platform decision with a 5-7 year horizon.
TL;DR
The CNAPP market is consolidating into a manageable number of platforms. For most organisations, cutting tool sprawl weighs more than the last percentage point of depth in any single discipline.
Who owns this decision
CISO with cloud architecture. Application owner and DevSecOps in the steering group.
Key criteria to weight
Multi-cloud depth
AWS, Azure, GCP, OCI, Alibaba; vendors are not equally deep everywhere.
Agentless and/or agent-based
Agentless gives fast coverage. Agents give deeper runtime visibility.
K8s and container maturity
KSPM and container runtime are the fastest-growing sub-segment.
Data security (DSPM)
Data Security Posture Management is becoming mandatory in 2026/2027.
EU data residency and SIEM integration
Findings must not be processed only in the US.
TCO and consolidation lever
CNAPP should replace 3-5 tools.
Step-by-step decision flow
- 1
Cloud inventory and workload map
Which clouds, which workload types, which current tools.
- 2
Use-case definition
Misconfig detection, runtime threat detection, IAM right-sizing, K8s posture, IaC pre-deploy, data discovery.
- 3
Vendor longlist
Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Microsoft Defender for Cloud, Lacework, Sysdig, Orca Security, Aqua Security.
- 4
PoC with real workloads
30-60 day trial in own cloud.
- 5
Memo and consolidation plan
Decision memo plus sunset list of replaced tools.
Compliance note
NIS2 Art. 21 (e), DORA Art. 9, ISO 27002 A.5.23, BSI C5.
Common pitfalls
- CNAPP is introduced but old tools keep running. Double cost.
- Agent strategy unclear. The tool does not cover everything.
- Findings stream into the SOC but no one prioritises. CNAPP fatigue.
- DSPM is ignored. Data risks remain blind.
FAQ
When is CSPM alone enough, when do I need CNAPP?
Single cloud, few workload types, no K8s: native CSPM enough. Multi-cloud, K8s, deep runtime detection: CNAPP.
What role does DSPM play in CNAPP?
DSPM finds sensitive data in cloud stores and rates access and encryption. In 2026/2027 DSPM becomes mandatory in CNAPP.
EU hosting for CNAPP, what do I have to check?
Telemetry endpoint region, finding storage region, key custody, support data access.
Related decision guides
- InfrastructureHow to make a sovereign cloud migration decision
- SecuritySIEM platform and SOC build: a structured decision guide
- ComplianceHow to reach NIS2 readiness as a mid-market or enterprise operator
- ComplianceHow to reach DORA readiness as a financial entity
- SecurityHow to choose an EDR or XDR platform in 2026
Related comparisons
- DecisionOS vs Excel and slide decksSpreadsheets work until the second stakeholder shows up.
- DecisionOS vs RFP toolsRFP tools automate Q&A. DecisionOS runs the decision.
- DecisionOS vs procurement suitesProcurement suites execute the purchase. DecisionOS makes the decision.
- DecisionOS vs NotionNotion stores knowledge. DecisionOS produces decisions.
- DecisionOS vs ConfluenceConfluence is a wiki. DecisionOS is a decision record.
Relevant industries
- Banken & FinanzdienstleisterBanken entscheiden unter DORA, MaRisk, BAIT gleichzeitig. DecisionOS liefert das Memo, das alle drei Prüfer akzeptieren.
- VersicherungenVersicherer entscheiden unter DORA + Solvency II + VAIT gleichzeitig. Ein Memo-Format für alle drei.
- TelekommunikationTelko entscheidet unter NIS2 + TKG §165 + BSI-Sicherheitskatalog gleichzeitig. Ein Memo, das alle Prüfer akzeptieren.
- Manufacturing & IndustrialManufacturing is a NIS2 important entity. OT security and supply-chain diligence are mandatory. The decision memo is the audit standard.
- Pharma & Life SciencesPharma IT is regulated IT. Validation (CSV/CSA) and audit trail are not optional. The decision memo is the mandatory front-end documentation.