Within a CNAPP context, projects are a logical organizational layer used to group, scope, and manage security data, controls, and workflows.
They are not cloud projects themselves (like a AWS/GCP project), but a security abstraction that maps to how teams build, deploy and own applications.
A basic understanding of our glossary, compliance frameworks, job roles and unified cloud security categories is required.
Projects: Group, Scope & Manage Security Data, Controls & Work
Definition
Projects in a CNAPP/AINAPP are:
Logical containers that group related assets, identities, risks, policies, and findings for a specific application, workload, team, environment, or business unit.
They define ownership, scope, and context for security operations.
Why projects exist
Projects solve several core CNAPP/AINAPP challenges:
- Reduce noise by scoping findings
- Align security with DevOps ownership
- Enable multi-team and multi-tenant operations
- Support environment separation (prod / dev / test)
- Drive accountability and remediation workflows
What a project typically contains
A project usually aggregates:
Assets & inventory
- Cloud accounts / subscriptions
- Kubernetes clusters & namespaces
- Containers & images
- VMs, serverless functions
- APIs, services, data stores
- AI models, pipelines, agents (AINAPP)
Security findings
- Misconfigurations
- Vulnerabilities
- Identity & access risks
- Runtime threats
- Compliance violations
- AI risks (model abuse, data leakage, prompt injection)
Policies & controls
- Security policies
- Compliance frameworks
- Risk thresholds
- Guardrails and enforcement modes
Context & metadata
- Environment (prod / staging / dev)
- Owning team or squad
- Application name
- Business criticality
- SLA / risk tolerance
How projects are commonly defined
Projects can be created based on:
Dimension | Example |
|---|---|
Application | Payments-API, Customer-Portal |
Team | Platform-Team, Data-Science |
Environment | Prod, Non-Prod |
Business unit | Finance, Healthcare, Retail |
Tenant / customer | MSSP or multi-tenant SaaS use |
AI workload | LLM-Chatbot, Fraud-Detection-Model |
Many platforms support nested or overlapping projects.
Projects vs inventory vs accounts
Concept | Purpose |
|---|---|
Inventory | What exists (all assets) |
Project | How assets are grouped and owned |
Cloud account / subscription | Where assets technically live |
Attack surface | What is exposed or reachable |
Issues | What is wrong |
Projects | Who is responsible and what context applies |
Projects sit above inventory, giving it meaning and accountability.
Role in security operations
Projects enable:
- Scoped dashboards and reports
- Team-specific alerts and tickets
- Per-project risk scoring
- Compliance views per app or environment
- CI/CD and runtime enforcement boundaries
- AI agent autonomy boundaries (AINAPP)
Example:
“Show all critical runtime threats in the Payments-API Prod project that violate PCI-DSS.”
CNAPP vs AINAPP nuance
In CNAPP
Projects primarily group:
- Cloud workloads
- Infrastructure risks
- DevSecOps ownership
In AINAPP
Projects additionally group:
- AI models and agents
- Training and inference pipelines
- Data sources and prompts
- Agent permissions and autonomy scopes
Projects become control boundaries for agentic security behavior.
Simple one-liner
Projects are logical security workspaces that group assets, risks, policies, and ownership around an application, team, or environment.