Cloud Security Alliance Survey Finds Complexity of Multi-cloud Environments Driving Use of Cloud Native Application Protection Platforms

Platforms have emerged as critical security tool due to their ability to consolidate the capabilities of many security tools currently deployed by organizations

SEATTLE – Aug. 24, 2023 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today released the findings of the Cloud Native Application Protection Platform (CNAPP) Survey Report. Commissioned by Microsoft, the survey, which was developed to better understand the adoption rates and challenges faced by organizations in implementing CNAPPs, found that they have emerged as a critical category of security tooling in recent years. Much of their popularity, the survey found, has been driven by the complexity of comprehensively securing multi-cloud environments and their ability to consolidate the capabilities of the numerous security tools organizations current deploy, namely Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWP), and Cloud Infrastructure Entitlement Management (CIEM), network security, and secure DevOps.

“When considering the challenges facing today’s businesses, people and technology take center stage. On one hand, companies need to bolster the workforce with well-trained security professionals who understand their roles and responsibilities. On the other hand, there's a pressing need for effective technology and tooling that both addresses the rapidly evolving landscape of cybersecurity threats while effectively supporting security teams,” said Hillary Baron, lead author and Senior Technical Director for Research, Cloud Security Alliance. “It’s clear that today’s multi-cloud environments are increasingly complex, and enterprises must find ways to comprehensively address their security posture.”

“Many traditional security solutions still in use today just aren’t capable of adequately protecting increasingly dynamic and distributed multi-cloud strategies. As organizations navigate their path in the cloud, it’s imperative that they leverage solutions that offer an integrated approach to security. In doing so, they can better prepare themselves to handle the complex cybersecurity challenges of today and the future," said Adwait Joshi, Director of Cloud Security product marketing at Microsoft.

Among the survey’s key findings:

• Cloud Native Application Protection Platform: Three out of four organizations are opting to use CNAPP to protect their multi-cloud environment. A majority of organizations (75%) have either implemented or plan to implement CNAPPs in their cloud environments. One of the driving factors behind this move is the prevalence of multi-cloud strategies—84% of organizations reported that they utilize two or more cloud environments.
• Cloud Security Posture Management: Security teams are demanding clear-cut information for proper prioritization. A flood of security alerts has made it difficult for security teams to manage and prioritize security enhancements. Thirty-two percent of respondents disclosed that they're struggling with prioritizing security improvements due to the overwhelming—and often incorrect—information they receive. Moreover, 34% find themselves buried under security recommendations, while an equivalent percentage lacks contextual or actionable insights to make informed decisions.
• DevOps Security: Despite growing recognition the importance of DevOps security, expertise and talent shortages are hindering progress. Despite the trend toward shift-left security and DevSecOps, the incorporation of robust security measures within DevOps is still in its early stages, with significant obstacles hindering full integration. Currently, 51% of organizations are in the process of integrating security into their DevOps practices, with only 35% reporting complete integration. The primary challenges include lack of security expertise (46%), insufficient automation (43%), an excessive number of false positives (42%), and lack of actionable feedback (42%).
• Cloud Workload Protection: Challenges around incident response come back to people, process, and technology. The lack of manpower was identified as a significant challenge by 25% of respondents; an absence of formal response plans was reported by 29% of organizations; and 39% reported the lack of automation as a key challenge.
• Network Security: The most mature implementation, yet threat detection remains a challenge. Network security, out of all the categories, was the most mature. Forty-three percent of respondents reported full integration in a multi-cloud environment for network security, compared to just 28% CSPM. While the growing popularity of zero-trust strategies may be a key driver behind this level, organizations are still facing key challenges in network security, particularly concerning threat detection and the management of a large volume of security alerts.
• Cloud Infrastructure Entitlement Management: Misconfigurations top concern with permissions. Just under half (43%) of organizations identified misconfigurations of permissions as their top concern. This prevalent issue can have serious repercussions, potentially leading to unauthorized access and even catastrophic data loss. Misconfigurations can inadvertently expose sensitive data or grant unnecessary privileges, creating openings that could be exploited by malicious actors.

The survey, which was conducted in April 2023, gathered more than 1,200 responses from IT and security professionals from various organization sizes, industries, locations, and roles. Sponsors are CSA Corporate Members who support the research project’s findings but have no added influence on the content development or editing rights of CSA research.

Review the complete 2023 Cloud Native Application Protection Platform (CNAPP) Survey report.

About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa.

Media Contacts
Kristina Rundquist
ZAG Communications for CSA
[email protected]