Cloud Security Graph

A cloud security graph is a unified, continuously updated graph model that represents all cloud assets, identities, configurations, relationships, and risks—and how they connect to one another.

It is the foundational intelligence layer that turns raw cloud telemetry into context-aware security insights.

A basic understanding of our glossary, compliance frameworks, job roles and unified cloud security categories is required.

Cloud Security Graph

1. Simple definition

A security graph in CNAPP is:

A relationship-aware data model that maps cloud resources, identities, permissions, configurations, runtime behaviors, vulnerabilities, and attack paths into a single connected graph.

Instead of isolated findings, CNAPP uses the graph to understand “what is connected to what—and why it matters.”

2. What the security graph contains

Nodes (entities)

• Cloud assets
  • VMs, containers, Kubernetes pods, serverless functions
  • Storage buckets, databases, queues
• Identities
  • IAM users, roles, service accounts
• Applications & workloads
  • Microservices, APIs
• Code & images
  • Repositories, container images
• Security findings
  • Vulnerabilities, misconfigurations, secrets
• External exposure
  • Public endpoints, internet-facing assets

Edges (relationships)

• Access relationships
  • Identity → resource permissions
• Network paths
  • Service → service connectivity
• Deployment lineage
  • Image → container → pod → cluster
• Trust relationships
  • Cross-account roles, third-party access
• Data flows
  • App → database → external service

3. Why CNAPP needs a security graph

Without a security graph:

• Findings are isolated
• Alerts lack business context
• Prioritization is noisy and manual

With a security graph:

• Risk is contextual
• Alerts are attack-aware
• Decisions are automated and explainable

4. Core capabilities enabled by the security graph

1. Risk prioritization

The graph answers:

• Is this vulnerability reachable?
• Is it internet-exposed?
• Does it have privileged access?

A critical CVE in an unreachable container is lower priority than a medium CVE in an internet-facing workload with IAM permissions.

2. Attack path analysis

The graph models end-to-end attack paths, for example:

Public API
→ Vulnerable container
→ Over-privileged IAM role
→ Access to production database

This enables:

• Pre-breach risk analysis
• Kill-chain mapping
• Proactive remediation

3. Identity & permission risk (CIEM)

The graph reveals:

• Excessive permissions
• Privilege escalation paths
• Lateral movement possibilities

Example:

“This pod can assume a role that can modify S3 buckets in another account.”

4. Blast-radius analysis

When something changes, the graph answers:

• If this workload is compromised, what else is impacted?
• What data, services, or environments are at risk?

5. Runtime + posture correlation

CNAPP connects:

• CSPM (configurations)
• CWPP (runtime behavior)
• CIEM (identity)
• ASM (exposure)

All through the same graph, not siloed engines.

5. Security graph vs inventory

Inventory is static.
Security graph is dynamic and relational.

6. How the security graph is built

• Continuous ingestion from:
  • Cloud APIs
  • Kubernetes
  • CI/CD pipelines
  • Runtime sensors
• Normalization across providers (AWS, Azure, GCP)
• Graph database or graph-like data model
• Real-time updates as cloud changes

7. Strategic importance in CNAPP evolution

The security graph is what enables:

• AI-driven CNAPP
• Agentic remediation
• Autonomous prioritization
• Predictive risk modeling

In modern CNAPPs, the graph is the product, not just a backend feature.

In short:

A security graph in CNAPP is the connected intelligence layer that understands how cloud assets, identities, exposures, and vulnerabilities interact—so security decisions are based on real attack paths, not isolated alerts.

From CNAPP to AINAPP

Here’s a detailed mapping of how the security graph concept translates from CNAPP into AI-native / AINAPP architectures. I’ll break it down in a structured way for clarity.

1. Core principle

• CNAPP Security Graph: Connects cloud assets, identities, vulnerabilities, exposures, and runtime data into a relational graph for context-aware security.
• AI-native / AINAPP: Extends this graph with autonomous reasoning, predictive modeling, and agentic actions using AI agents.

Think of it as: CNAPP = “graph-based situational awareness,” AINAPP = “graph + AI-driven decision-making and execution.”

2. Nodes & entities in AINAPP

AINAPP typically keeps all the CNAPP entities but adds AI-specific constructs:

In short, every node can have AI context and actionable insights attached.

3. Edges & relationships

AINAPP enriches CNAPP relationships:

4. AI-native capabilities enabled

1. Predictive risk analysis
   • CNAPP: “This vuln exists on an internet-facing container.”
   • AINAPP: “This vuln has a 70% chance of being exploited in the next 30 days, targeting high-value data.”
2. Autonomous attack path evaluation
   • CNAPP: Graph shows possible attack paths.
   • AINAPP: AI agents dynamically simulate attacks, rank paths by likelihood and impact.
3. Automated remediation (agentic security)
   • CNAPP: Alerts + recommendations.
   • AINAPP: AI agent can fix misconfigurations, rotate credentials, or quarantine workloads automatically.
4. Continuous learning & adaptation
   • AINAPP uses telemetry + threat intelligence to update node/edge risk scores and predict future risks.
5. Contextual orchestration
   • AI can coordinate across cloud, workloads, pipelines, and identity services for holistic action.

5. Security Graph → AI Layer Mapping

CNAPP Security Graph → AINAPP AI-Native Graph
-----------------------------------------------------
Static assets & configs → Assets + AI behavior models
IAM relationships → IAM + agentic delegation models
Vulnerabilities → Risk scores + exploitability predictions
Exposure paths → Predicted attack likelihood
Deployment lineage → CI/CD intent & drift modeling
Data flows → Data exfiltration & impact predictions
Alerts → Automated remediation actions

Essentially, AINAPP augments the CNAPP graph with “intelligence nodes” and “action edges.”

6. Why this is strategic

• CNAPP alone = situational awareness & human-driven remediation.
• AINAPP = autonomous, predictive, context-aware security operations at cloud speed.
• Security graph is the backbone; AI turns it from a map of risk into a self-driving security system.