Cloud-native application protection (CNAPP)
Platforms that combine posture, workload, identity and code-to-cloud risk analysis for cloud environments in one product.
23 vendors · alphabetical
- ABIR NetworksABIR Networks sells penetration testing, cloud security, risk consulting and compliance services.Ownership not established
- AlphabetAlphabet sells a full suite of security products and services to protect workloads and meet digital sovereignty requirements.Ownership not established
- Aqua SecurityAqua Security sells a cloud native application protection platform that secures applications from development through production, along with a Secure AI product for AI applications.Privately held · primary category
- CrowdStrikeCrowdStrike sells the Falcon platform, a set of security products and services that the company says combines security data, AI intelligence, automation and expertise to stop breaches.Public (NASDAQ: CRWD)
- CyscaleCyscale is an agentless cloud-native application protection platform (CNAPP) that automates the contextual analysis of cloud misconfigurations, vulnerabilities, access, and data.Ownership not established · primary category
- Data TheoremData Theorem sells application security products that secure code, mobile apps, APIs and cloud.Ownership not established
- FidelisFidelis sells a range of solutions that includes XDR, NDR, EDR and CNAPP, offered for proactive cyber defense.Ownership not established
- LaceworkLacework is a cloud security services provider that automates cloud security at scale for cloud and container workloads.Privately held · primary category
- Orca SecurityThe Orca Cloud Security Platform discovers risks across code, cloud, runtime, and AI.Ownership not established · primary category
- Palo Alto NetworksPalo Alto Networks sells network security, security operations, cloud security, identity security, AI security and observability platforms, along with threat intelligence and incident response services.Public (NASDAQ: PANW)
- PlerionPlerion calls Pleri its primary AI security agent.Ownership not established · primary category
- QualysQualys provides the Enterprise TruRisk Platform, an end-to-end solution for all aspects of IT, security and compliance.Ownership not established
- RAD SecurityRAD Security sells AI Workers that investigate, triage, and act on threats across a customer's entire stack.Ownership not established · primary category
- SentinelOneSentinelOne sells an AI-native platform with unified protection across endpoint, identity, AI, and cloud.Ownership not established
- Skyhigh SecuritySkyhigh Security sells Hybrid Mesh SSE, which decouples policy management from enforcement location, so that a security policy authored once is enforced across a mesh of local gateways, virtual appliances, and global cloud points of presence.Ownership not established
- Sweet SecuritySweet Security agents learn how each application, agent and workload should behave.Privately held · primary category
- SysdigSysdig delivers real-time defense for cloud, containers, and AI agents.Privately held · primary category
- TenableTenable sells Tenable One, a platform that unifies security visibility, insight and action across an attack surface.Ownership not established
- Trend MicroTrend Micro is a cybersecurity company whose TrendAI business sells enterprise security, including TrendAI Vision One.Public (TSE: 4704)
- UptycsUptycs sells a unified security analytics platform for continuous threat exposure management across cloud, workloads, containers, and endpoints.Ownership not established · primary category
- UpwindUpwind sells security for cloud workloads, APIs and agents, combining their context with runtime intelligence to identify critical risks and catch new attacks in real time.Privately held · primary category
- WizWiz sells a cloud and AI security platform that connects code, cloud, and runtime into a single security graph.Owned by Google since 2026 · primary category
- XcitiumXcitium sells a zero trust cybersecurity platform that protects endpoints, networks and cloud workloads from zero-day threats by isolating unknown files until they are analyzed and given a verdict.Ownership not established