Unified Cloud Security Categories

Definition CNAPP: Cloud-Native Application Protection Platform
Description: Unified protection for cloud-native apps across build, deploy and runtime.
Sub-categories:

CSPM (Cloud Security Posture Management): Cloud misconfig & compliance monitoring
CWPP (Cloud Workload Protection Platform): Workload & runtime protection
CIEM (Cloud Infrastructure Entitlement Management): Identity & permission risk control
UVM (Unified Vulnerability Management)
CDR (Cloud Detection & Response)
Container & Kubernetes Security: Kubernetes posture & configuration hardening
DSPM (Data Security Posture Management): Data discovery & access analysis
Cloud Compliance
AI-SPM (AI Security)

AINAPP

Definition AINAPP: AI-Native Application Protection Platform
Description: Integrates AI/ML deeply into application security to provide autonomous, adaptive protection.
Key Differentiators from CNAPP:

Autonomous response: AI can remediate, quarantine, or adapt defenses without human intervention.
Continuous learning: Security models improve over time by analyzing application behavior, network traffic, and threat intelligence.
Predictive risk management: Anticipates potential misconfigurations, permission issues, or workload vulnerabilities before they’re exploited.
Intelligent policy automation: Generates and adjusts security policies dynamically across multi-cloud or hybrid environments.
AI-driven threat detection: Automatically identifies unknown threats, anomalous behaviors, and zero-day vulnerabilities.

UVM

Definition UVM: Unified Vulnerability Management
Description: A centralized approach to identifying, correlating, prioritizing, and remediating vulnerabilities across cloud infrastructure, applications, workloads, and dependencies.
Sub-categories:

Cloud vulnerability management (IaaS & PaaS)
Workload vulnerabilities (VMs, containers, serverless)
Application & dependency vulnerabilities (SCA)
Container image scanning
Infrastructure-as-Code vulnerabilities
Runtime exposure & exploitability analysis
Vulnerability prioritization & remediation tracking

SASE

Definition SASE: Secure Access Service Edge
Description: Converged network + cloud security for remote and branch access.
Sub-categories:

CASB (Cloud Access Security Broker): SaaS access control
SWG (Secure Web Gateway): Secure web filtering
ZTNA (Zero Trust Network Access): Zero-trust app access
SD-WAN (Software-Defined Wide Area Network): Optimized, secure connectivity
DLP (Data Loss Prevention): Data leakage prevention

SSE

Definition SSE: Security Service Edge (a subset of SASE)
Description: Cloud-delivered security stack for web, SaaS, and private apps.
Sub-categories:

CASB: SaaS usage protection
SWG: Browser/web threat filtering
ZTNA: Zero-trust access control

ASM

Definition ASM: Attack Surface Management
Description: Unified visibility into all cloud assets, identities, and vulnerabilities.
Sub-categories:

Asset Inventory: Multi-cloud asset discovery
Identity Mapping: Accounts & entitlements visibility
Vulnerability Insights: Risk & exposure correlation

DSPM

Definition DSPM: Data Security Posture Management
Description: Cloud data discovery, classification, access analysis, and posture enforcement.
Sub-categories:

Data Discovery: Locate sensitive data
Classification: Label data by type/sensitivity
Access Analysis: Over-permissioned data insights
Posture Controls: Data risk reduction

SCA and SBOM

Definition SCA and SBOM: Software Composition Analysis and Software Bill of Materials
Description: Identifies vulnerabilities and license risks in open-source dependencies and provides full software bill of materials (SBOM) visibility across applications.
Sub-categories:

SCA: Dependency and open-source analysis
IaC Scanning: Secure infrastructure code
Build Pipeline Security: CI/CD integrity
Artifact Signing: Provenance and tamper protection

CxDR / XDR

Definition CxDR: Extended Cloud Detection and Response
Definition XDR: Extended Detection and Response (Cloud-inclusive)
Description: Correlated detection across cloud, identity, endpoints, and networks.
Sub-categories:

Cloud Detection: Cloud logs, runtime events
Identity Threat Detection: Abnormal identity usage
Endpoint Detection: Host-level attacks
Network Detection: Traffic anomalies

SSPM

Definition SSPM: SaaS Security Platforms / SaaS Security Posture Management
Description: SaaS posture management and behavioral monitoring.
Sub-categories:

Misconfiguration Checks: Hardening SaaS apps
Permission Monitoring: OAuth & user access
Anomaly Detection: Suspicious behavior & activity

CNAS

Definition CNAS: Cloud-Native Application Security
Description: Broad cloud-native app security merging CNAPP with AppSec and API security.
Sub-categories:

CNAPP Core: CSPM + CWPP + CIEM
AppSec: SAST/DAST/IAST testing
API Security: Discovery & runtime protection
Supply Chain: Code + CI/CD integrity

Unified Identity Security

Description: Comprehensive identity security across cloud and enterprise.
Sub-categories:

IAM: Identity lifecycle control
CIEM: Entitlement & permissions governance
ITDR: Identity threat detection & response

Unified API Security

Description: Full lifecycle API protection.
Sub-categories:

API Discovery: Shadow & unmanaged API mapping
Posture Assessment: Configuration hardening
Runtime Protection: API threat detection

AI Security Platforms

Description: Security for AI models, data pipelines, and runtime behavior.
Sub-categories:

Model Posture: Model configuration & exposure risks
Runtime Defense: Prompt injection & misuse detection
AI Supply Chain: Model lineage, dataset integrity