Engineering

Security

What is CNAPP?

A CNAPP (Cloud-Native Application Protection Platform) is a cybersecurity solution that provides protection for cloud-native applications. In recent days and with the growing adoption of cloud, more applications are designed as cloud-native applications that run on cloud infrastructure and often have complex architectures that can be difficult to secure. A CNAPP solution detects and responds to various security threats such as vulnerabilities in containers and microservices, attacks on application programming interfaces (APIs), the underlying cloud infrastructure, and data breaches.

Overview

Cloud-Native Application Protection Platforms are cybersecurity solutions that provides protection for cloud-native applications. In recent days and with the growing adoption of cloud, more applications are designed as cloud-native applications that run on cloud infrastructure and often have complex architectures that can be difficult to secure. A CNAPP solution detects and responds to various security threats such as vulnerabilities in containers and microservices, attacks on application programming interfaces (APIs), the underlying cloud infrastructure, and data breaches.

Why do you need a CNAPP?

As cloud adoption grows, cloud footprint grows and cloud-native application design grows as well. To secure cloud estates, organizations need to ensure the security of their cloud-native applications. Traditional security measures, such as firewalls and intrusion detection systems, are no longer enough to fully protect infrastructure and cloud-native applications. CNAPP solutions provide a comprehensive security and targeted approach to securing cloud-native applications by thinking from a holistic perspective that encompasses the cloud platform and unique challenges that come with cloud-native applications and larger cloud footprints.

CNAPP solutions offer benefits with monitoring cloud-native applications and infrastructure, a more targeted approach to cloud threat detection and response, compliance management including unique cloud compliance challenges, and overall security benefit of reducing risk of cyber attacks and data breaches. With cloud, there are unique challenges that a CNAPP solution solves by combining application protection with an understanding of cloud infrastructure and how cloud infrastructure is woven in application and platform design. CNAPP solutions can help with overall security best practices and compliance with relevant regulations, especially with cloud.

Open Source CNAPP

In What is an Infrastructure Data Lake, we covered what is an infrastructure data lake and how to get started with building your own. With that foundational infrastructure data lake, we can now build your own open-source CNAPP with standard SQL queries and views that you can monitor, visualize, and customize to your specific needs.

CloudQuery pulls information from various sources that contribute to a holistic view for an effective CNAPP. As your organization grows and evolves with different technologies and architectures, your infrastructure data lake can grow with you by adding various sources. Check out CloudQuery to see how to build a customizable open-source CNAPP.

Want to see CloudQuery in action? Schedule a demo with our team or check out the platform documentation to learn more.

Got feedback or suggestions? Join the CloudQuery community to connect with other users and experts, or message our team directly here if you have any questions.

Try CloudQuery yourself

Self-hosted, open source, and free to start. Or schedule a demo to see the managed version.

Related posts

Engineering

Security

What is a Cloud CMDB (and is it needed)?

Traditional CMDBs struggle in cloud environments. Learn why “Cloud CMDBs” aren’t what they seem and how a modern cloud governance platform fills the gap.

Yevgeny Pats

Yevgeny Pats

February 19, 2025

Engineering

Security

What is ASM?

Learn about Attack Surface Management and how to build an open source ASM on top of your infrastructure data lake.

Joe Karlsson

Joe Karlsson

November 5, 2024

Engineering

Security

What is an Infrastructure Data Lake?

An infrastructure data lake is a centralized repository for all configuration metadata from your cloud infrastructure.

Joe Karlsson

Joe Karlsson

November 5, 2024

Engineering

Security

What is a security data fabric?

Learn what “data fabric” and “security data fabric” really mean, why they might be confusing, and explore clearer alternatives.

Yevgeny Pats

Yevgeny Pats

August 2, 2024

AWS

Azure

GCP

Security

How Do You Run CloudQuery Without Static Credentials?

Workload identity federation for GCP and Azure, RDS IAM auth, and Lakebase OAuth let self-hosted CloudQuery syncs run without stored static credentials.

Ben Bernays

Ben Bernays

September 28, 2026

Engineering

We benchmarked our ETL tool and synced 1 million rows in 2 seconds on a MacBook

We benchmarked our ETL tool and synced 1 million rows in 2 seconds on laptop hardware, which is 68% faster than enterprise platforms.

Joe Karlsson

Joe Karlsson

August 27, 2026

AWS

Security

Tutorials

Finding AWS Unrestricted Outbound Access in 2026: EC2, Lambda, and Beyond

Find EC2, Lambda, and ECS Fargate resources with unrestricted outbound access in AWS using SQL. Why egress controls still break attack chains in 2026.

Joe Karlsson

Joe Karlsson

May 5, 2026

AWS

Security

Tutorials

AWS IAM Identity Center with Google Workspace as an IdP: 2026 Step-by-Step Guide

Set up AWS IAM Identity Center with Google Workspace: SAML authentication, SCIM user provisioning, and group sync with CLI or ssosync. Updated for 2026.

Joe Karlsson

Joe Karlsson

May 5, 2026

GCP

Security

Tutorials

Creating Cross-Project Service Accounts in GCP (Console + gcloud CLI)

Create a GCP service account that reads across all your projects with one credential. Covers gcloud CLI, org-level vs.

Joe Karlsson

Joe Karlsson

May 5, 2026

Own your pipeline.
Own your data.