Depending on the implementation, those workloads may include virtual machines, containers, Kubernetes workloads, and some serverless functions. CWPP scope commonly spans vulnerability assessment, workload hardening, file or process monitoring, malware detection, network controls, and runtime threat detection; coverage is not standardized.
CWPP concentrates on the executing workload and its artifacts rather than only on the cloud account’s control-plane configuration. It may collect evidence through installed agents, host or orchestrator integrations, workload instrumentation, image and disk scanning, or cloud snapshots. These approaches have different strengths: snapshot analysis can find dormant software without deploying an agent, while runtime sensing can observe live processes and connections but must actually be present and compatible.
Key points
Before executionScan images, packages, secrets, and configuration; enforce approved sources; and reduce unnecessary software before deployment.
At deploymentWhere supported, assess or enforce hardened workload settings and integrate with native identity, admission, segmentation, and resource-control mechanisms.
During executionObserve processes, files, system calls, and network behavior where supported; alert or respond according to tested policy.
Across the lifecycleMap findings to workload owners, prioritize reachable risk, rebuild or patch affected artifacts, and verify that corrected versions are deployed.
Important limitationCWPP is not a uniform specification. Agentless, agent-based, and runtime approaches do not provide identical evidence, and short-lived, encrypted, privileged, or unsupported workloads can create blind spots.