Multi-Cloud Complexity Driving Use of Cloud Native Application Protection Platforms
August 28, 2023

The Cloud Native Application Protection Platform (CNAPP) has emerged as a critical category of security tooling in recent years. According to the CNAPP Survey Report, commissioned by Microsoft, CNAPP's popularity has been driven by the complexity of comprehensively securing multi-cloud environments and their ability to consolidate the capabilities of the numerous security tools organizations current deploy, namely Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWP), and Cloud Infrastructure Entitlement Management (CIEM), network security, and secure DevOps.

"When considering the challenges facing today's businesses, people and technology take center stage. On one hand, companies need to bolster the workforce with well-trained security professionals who understand their roles and responsibilities. On the other hand, there's a pressing need for effective technology and tooling that both addresses the rapidly evolving landscape of cybersecurity threats while effectively supporting security teams," said Hillary Baron, lead author and Senior Technical Director for Research, Cloud Security Alliance. "It's clear that today's multi-cloud environments are increasingly complex, and enterprises must find ways to comprehensively address their security posture."

"Many traditional security solutions still in use today just aren't capable of adequately protecting increasingly dynamic and distributed multi-cloud strategies. As organizations navigate their path in the cloud, it's imperative that they leverage solutions that offer an integrated approach to security. In doing so, they can better prepare themselves to handle the complex cybersecurity challenges of today and the future," said Adwait Joshi, Director of Cloud Security product marketing at Microsoft.

Among the survey's key findings:

Cloud Native Application Protection Platform

Three out of four organizations are opting to use CNAPP to protect their multi-cloud environment. A majority of organizations (75%) have either implemented or plan to implement CNAPPs in their cloud environments. One of the driving factors behind this move is the prevalence of multi-cloud strategies — 84% of organizations reported that they utilize two or more cloud environments.

Cloud Security Posture Management

Security teams are demanding clear-cut information for proper prioritization. A flood of security alerts has made it difficult for security teams to manage and prioritize security enhancements. 32% of respondents disclosed that they're struggling with prioritizing security improvements due to the overwhelming—and often incorrect—information they receive. Moreover, 34% find themselves buried under security recommendations, while an equivalent percentage lacks contextual or actionable insights to make informed decisions.

DevOps Security

Despite growing recognition the importance of DevOps security, expertise and talent shortages are hindering progress. Despite the trend toward shift-left security and DevSecOps, the incorporation of robust security measures within DevOps is still in its early stages, with significant obstacles hindering full integration. Currently, 51% of organizations are in the process of integrating security into their DevOps practices, with only 35% reporting complete integration. The primary challenges include lack of security expertise (46%), insufficient automation (43%), an excessive number of false positives (42%), and lack of actionable feedback (42%).

Cloud Workload Protection

Challenges around incident response come back to people, process, and technology. The lack of manpower was identified as a significant challenge by 25% of respondents; an absence of formal response plans was reported by 29% of organizations; and 39% reported the lack of automation as a key challenge.

Network Security

The most mature implementation, yet threat detection remains a challenge. Network security, out of all the categories, was the most mature. 43% of respondents reported full integration in a multi-cloud environment for network security, compared to just 28% CSPM. While the growing popularity of zero-trust strategies may be a key driver behind this level, organizations are still facing key challenges in network security, particularly concerning threat detection and the management of a large volume of security alerts.

Cloud Infrastructure Entitlement Management

Just under half (43%) of organizations identified misconfigurations of permissions as their top concern. This prevalent issue can have serious repercussions, potentially leading to unauthorized access and even catastrophic data loss. Misconfigurations can inadvertently expose sensitive data or grant unnecessary privileges, creating openings that could be exploited by malicious actors

Methodology: The survey, conducted in April 2023, gathered more than 1,200 responses from IT and security professionals from various organization sizes, industries, locations, and roles. Sponsors are CSA Corporate Members who support the research project's findings but have no added influence on the content development or editing rights of CSA research.

Share this

Industry News

September 21, 2023

Red Hat and Oracle announced the expansion of their alliance to offer customers a greater choice in deploying applications on Oracle Cloud Infrastructure (OCI). As part of the expanded collaboration, Red Hat OpenShift, the industry’s leading hybrid cloud application platform powered by Kubernetes for architecting, building, and deploying cloud-native applications, will be supported and certified to run on OCI.

September 21, 2023

Harness announced the availability of Gitness™, a freely available, fully open source Git platform that brings a new era of collaboration, speed, security, and intelligence to software development.

September 20, 2023

Oracle announced new application development capabilities to enable developers to rapidly build and deploy applications on Oracle Cloud Infrastructure (OCI).

September 20, 2023

Sonar announced zero-configuration, automatic analysis for programming languages C and C++ within SonarCloud.

September 20, 2023

DataStax announced a new JSON API for Astra DB – the database-as-a-service built on the open source Apache Cassandra® – delivering on one of the most highly requested user features, and providing a seamless experience for Javascript developers building AI applications.

September 19, 2023

Oracle announced the availability of Java 21.

September 19, 2023

Mirantis launched Lens AppIQ, available directly in Lens Desktop and as (Software as a Service) SaaS.

September 19, 2023

Buildkite announced the company has entered into a definitive agreement to acquire Packagecloud, a cloud-based software package management platform, in an all stock deal.

September 19, 2023

CrowdStrike has agreed to acquire Bionic, a provider of Application Security Posture Management (ASPM).

September 18, 2023

Perforce Software announces BlazeMeter's Test Data Pro, the latest addition to its continuous testing platform.

September 18, 2023

CloudBees announced a new cloud native DevSecOps platform that places platform engineers and developer experience front and center.

September 18, 2023

Akuity announced a new open source tool, Kargo, to implement change promotions across many application life cycle stages using GitOps principles.

September 14, 2023

CloudBees announced significant performance and scalability breakthroughs for Jenkins® with new updates to its CloudBees Continuous Integration (CI) software.