What Is CWPP?

A cloud workload protection platform is the product category that consolidated a set of previously separate agents — server antivirus, host intrusion detection, file integrity monitoring, container runtime security — into one tool that works across virtual machines, containers and serverless functions in any cloud.

The underlying practice is covered separately in cloud workload protection. This entry is about the tooling category, what it consolidated and what buying one actually involves.

What the category consolidated, and why

Before these platforms, protecting a mixed estate meant a different agent per workload type and per environment, each with its own console and its own gaps. A virtual machine had an endpoint agent, containers had something else or nothing, and serverless functions had no coverage at all because no agent could run there.

The consolidation argument was consistency: one policy, one view, one set of findings across every workload type, including the ones that cannot host an agent. That argument largely held, which is why the category then got absorbed in turn into CNAPP.

Agent and agentless, and why you need both

Agentless scanning reads disk snapshots through the cloud provider's API. It deploys in hours, covers everything including workloads nobody told you about, and needs no cooperation from application teams — but it is a point-in-time view and it cannot see behaviour.

Agents see runtime: the process that spawned unexpectedly, the file that changed, the outbound connection nobody intended. They also require deployment into every workload, add overhead, and cannot run in some serverless contexts at all.

The practical answer is agentless everywhere for coverage and vulnerability visibility, agents on the workloads that matter most for runtime detection. Organisations that pick one exclusively either miss behaviour or miss half the estate.

Evaluating one honestly

Two questions separate these products more than any feature list. First, what proportion of your estate can it actually cover — which operating systems, which container runtimes, which serverless platforms, and what happens with the legacy systems that are usually the most exposed.

Second, what does it do when it detects something? Alerting is table stakes; the meaningful differences are whether it can isolate a workload, whether that action is safe to automate in your environment, and whether the telemetry reaches the people who would respond.

A platform generating high-quality detections into a console nobody watches out of hours produces exactly the same outcome as no platform at all, which is why the response path deserves as much evaluation attention as the detection engine.

Finally, check how the platform handles workloads it cannot reach. Every estate contains systems that will never take an agent — appliances, embedded systems, platforms the vendor does not support — and a tool that simply omits them from its coverage figure produces a reassuring number and a misleading one.

Where to start

Establish what proportion of your running workloads currently have any protection at all. The gap between that number and one hundred per cent is a better guide to your actual risk than the detection capability of whichever product you are evaluating.

See cloud security best practices. GuardsArm runs cloud security assessments.