CyberGlossary

Cloud Security

CWPP (Cloud Workload Protection Platform)

Also known as: Workload protection

Definition

A platform that protects cloud workloads — virtual machines, containers, and serverless functions — across their entire lifecycle, from build to runtime.

CWPP focuses on the workload itself rather than the cloud account: it scans images and IaC for vulnerabilities and secrets, hardens the OS, enforces application allow-listing, monitors host and container behaviour, and detects runtime threats such as cryptominers or container escapes. CWPPs work across hybrid and multi-cloud environments because the workload may run on EC2, on-prem VMs, EKS pods, or Lambda. They commonly combine agent-based telemetry (eBPF, kernel modules) with agentless snapshot scanning. Together with CSPM and CIEM, CWPP is now usually delivered as one of the pillars of a CNAPP.

Examples

  • SentinelOne Singularity Cloud or Sysdig Secure scanning container images and detecting runtime drift.
  • Microsoft Defender for Servers monitoring EC2 and on-prem VMs for malware and exploits.

Related terms