Xcitium offering
Security visibility from code to production cloud. CNAPP brings together application security, cloud posture, workload protection, governance and Kubernetes entitlement management.
Discuss your requirements ↗The CNAPP dashboard brings cloud accounts, asset findings and container image risks together.
Unified security for cloud applications and workloads
CNAPP analyzes events across IaaS, PaaS, and SaaS. CSPM assesses configuration and compliance, KIEM maps Kubernetes identity relationships, CWPP models workload behavior, and ASPM assesses application code and dependencies.
Stage 01
The platform analyzes workload events across IaaS, PaaS, SaaS, AWS, Azure, and Google Cloud, as well as private cloud environments such as Red Hat OpenShift and VMware Tanzu.
Output: Multi-cloud and hybrid environment context
Stage 02
CSPM checks configuration and drift; KIEM maps Kubernetes principals and service accounts; CWPP models workload behavior; ASPM scans source code, dependencies, and IaC risks.
Output: Configuration, identity, workload, and application findings
Stage 03
ASPM prioritizes application vulnerabilities by runtime exposure and exploitability. The KIEM graph shows relationships between identity entities and cloud resources.
Output: Application vulnerabilities ranked by runtime exposure and exploitability; identity relationship graph
Stage 04
CSPM supports one-click remediation for identified risks, while CWPP provides workload policies and real-time actions. GRC centralizes governance policies and compliance reporting.
Output: Remediation steps and compliance visibility
Capabilities
ASPM checks source without running applications, simulates attacks against live applications, analyzes open-source and third-party dependencies, and scans Terraform and Dockerfile IaC. Group findings by exploitability and exposure in the running environment.
Continuously check cloud configurations and policy violations without installing agents. Find deviations from an approved baseline and review alerts and reports; check impact and approval steps before applying changes.
Model cloud workload behaviour, monitor suspicious changes, and apply Zero Trust with network segmentation. CWPP covers running servers and applications; CSPM covers cloud configuration.
Centralize cloud governance policies, track framework alignment and report risk status. CNAPP supports CIS, HIPAA, PCI, SOC 2 and ISO 27001 reporting; certification and legal compliance require separate organizational assessment.
Scan Kubernetes identity configuration without installing agents, view relationships between identities and cloud resources as a graph, and investigate over-privileged principals and service accounts. Cluster owners should approve least-privilege changes.
Compare approaches
| Consideration | CNAPP view | Focused layer |
|---|---|---|
| Code and dependencies | See risks across development and release. | ASPM checks code, dependencies, and IaC templates. |
| Cloud configuration | Bring together posture across cloud accounts and services. | CSPM examines drift, policy violations, and alignment status. |
| Running workloads | Relate code, configuration, and runtime signals. | CWPP focuses on behaviour monitoring, policies, and segmentation. |
| Kubernetes identities | View cluster risks alongside cloud resources. | KIEM examines identity relationships and excessive permissions. |
Before you start
CNAPP brings together IaaS, PaaS and SaaS accounts, code repositories and Kubernetes clusters, covering AWS, Azure, Google Cloud, Red Hat OpenShift and VMware Tanzu. Include integrations, regions and resource types in the deployment plan.
Which cloud accounts, regions, clusters, and code repositories are in scope?
Which identities and permissions will scans use, and what data will they transmit?
How will findings be prioritized, and who approves automated remediation?
Which specific controls and evidence appear in compliance reports?
In practice
An engineering team deploys a containerized application across several clouds. Security wants to connect code and infrastructure configuration risks with the behavior of running workloads.
What your team gains
A connected view of risk from code through runtime.
Correlation across CSPM, CWPP, GRC, and Kubernetes entitlement signals.
Assess AWS, Azure, Google Cloud, OpenShift, and Tanzu environments, subject to deployment compatibility.
Before you decide
CNAPP combines ASPM, CSPM, CWPP, GRC and Kubernetes Identity & Entitlement Management (KIEM): code and dependencies, cloud configuration, workload behaviour, governance and Kubernetes entitlements. A pilot assesses integrations and resource coverage.
CNAPP covers IaaS, PaaS and SaaS; AWS, Azure and Google Cloud; and private cloud platforms such as Red Hat OpenShift and VMware Tanzu. Services and regions are defined in the deployment plan.
CSPM provides one-click configuration remediation. Define impact review, approval and rollback steps for each policy before changing production.
Next step
Tell us about your environment and priorities to discuss the right solution, pilot scope and rollout in Azerbaijan.
