Glossary term
CNAPP
Also: Cloud Native Application Protection Platform
Gartner platform category that combines CSPM, CWPP, CIEM, KSPM, DSPM and IaC scanning into one tool. Answer to tool fragmentation in cloud security stacks.
Gartner coined the term in 2021. Idea: a shared asset and policy model across all cloud security disciplines, from code (IaC scan, secret scan) to runtime monitoring.
Market leaders: Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Lacework (acquired by Fortinet 2024), Sysdig, Orca Security. Microsoft Defender for Cloud positions itself as CNAPP for Azure-first customers.
In practice
Selection criteria: agentless vs agent-based detection, multi-cloud depth, K8s maturity, data-security maturity, integration with existing SIEM/SOAR, EU data residency for compliance.
Related terms
CSPM
Software category for continuous review of cloud configurations against security benchmarks (CIS, NIST, BSI cloud requirements). Finds misconfigurations like open S3 buckets, missing encryption, insecure IAM policies.
CWPP
Software category for protecting cloud workloads (VMs, containers, serverless) at runtime. Combines vulnerability scanning, config review, runtime monitoring, container and K8s security.
SSPM
Software category for reviewing SaaS configurations (Microsoft 365, Salesforce, Google Workspace, Slack, GitHub). Finds over-privileged apps, weak sharing settings, MFA gaps, external data flows.
CASB
Security layer between users and SaaS providing visibility (shadow IT discovery), data protection (DLP), compliance, and threat protection across SaaS apps. Four functions per Gartner: visibility, compliance, data security, threat protection.
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
Confidential Computing
Hardware-based isolation that keeps data encrypted during processing (data-in-use). Complements encryption at rest and in transit. Technologies: Intel SGX, Intel TDX, AMD SEV-SNP, ARM CCA, Nvidia H100 Confidential Computing.
Critical ICT Third-Party Provider (CTPP)
ICT third-party provider designated critical by the European Commission under DORA Art. 31, falling under direct supervision of one of the three European Supervisory Authorities (EBA, EIOPA, ESMA). First CTPP designations expected in 2025/2026.
CVE
Global identifier for publicly known security vulnerabilities in software and hardware. Format CVE-YYYY-NNNN, run by MITRE on behalf of CISA. More than 200,000 CVEs as of 2025.