CSPM and CNAPP: Why Cloud Security Is the Biggest Line Item in Cybersecurity Budgets

The Misconfiguration Epidemic: Cloud’s Biggest Threat Is Not Hackers

Here is an uncomfortable truth that the cybersecurity industry has spent years dancing around: the majority of cloud breaches are not caused by sophisticated hackers exploiting zero-day vulnerabilities. They are caused by someone leaving the door open. Misconfigured cloud resources, from public S3 buckets to overprivileged IAM roles to unencrypted databases with default credentials, remain a leading cause of cloud data breaches in 2026, just as they were in 2020. The tools have changed, the cloud platforms have matured, but human error at the speed and scale of cloud deployment continues to outpace security controls.

The numbers are stark. Gartner has predicted that through 2025, 99% of cloud security failures will be the customer’s fault, not the cloud provider’s. IBM’s 2025 Cost of a Data Breach Report found that the global average cost of a data breach was $4.44 million, with phishing as the most common initial attack vector at 16% of breaches and an average cost of $4.8 million per phishing-initiated incident. Cloud misconfiguration, which IBM notes was not even a categorized threat vector in 2015, is now a leading target. Multi-environment breaches spanning cloud and on-premises systems were the costliest of all at $5.05 million on average and the slowest to contain at 276 days.

This epidemic has created the fastest-growing segment in cybersecurity: Cloud Security Posture Management (CSPM) and its evolution into Cloud-Native Application Protection Platforms (CNAPP). These tools promise to continuously scan cloud environments for misconfigurations, enforce security policies, and provide the visibility that organizations desperately lack as their cloud footprints expand across AWS, Azure, Google Cloud, and increasingly multi-cloud architectures.

---

From CSPM to CNAPP: The Market Convergence

CSPM emerged in the late 2010s as a focused solution to a focused problem: scanning cloud infrastructure configurations against security best practices and compliance standards. Early CSPM tools like Aqua Security, DivvyCloud (acquired by Rapid7 in 2020 for $145 million), and Palo Alto’s Prisma Cloud would check whether S3 buckets were public, whether security groups allowed unrestricted SSH access, and whether logging was enabled. Valuable, but limited in scope.

The market quickly recognized that misconfiguration was only one dimension of cloud security risk. Workload vulnerabilities, excessive permissions, insecure APIs, exposed secrets in code repositories, and runtime threats all contributed to the overall cloud attack surface. This drove the convergence into CNAPP, a term coined by Gartner in 2021 to describe platforms that unify CSPM, Cloud Workload Protection (CWPP), Cloud Infrastructure Entitlement Management (CIEM), Infrastructure as Code (IaC) scanning, and Kubernetes security into a single platform.

By 2026, the CNAPP market has grown into a segment that multiple research firms estimate at over $10 billion, with annual growth rates between 19% and 22%. Mordor Intelligence values the market at $10.9 billion in 2025 growing at a 20.8% CAGR to $28 billion by 2030, while Markets and Markets projects the market reaching $19.3 billion by 2027 at a 19.9% CAGR. The convergence thesis has been validated by customer demand: CISOs do not want to manage six separate cloud security tools from six different vendors. They want a single platform that can tell them, in one dashboard, what is misconfigured, what is vulnerable, who has excessive permissions, and what is being attacked right now across all their cloud environments. This demand has driven both explosive startup growth and aggressive acquisition strategies by incumbent security vendors.

---

The Market Map: Who Is Winning the CNAPP Race

No company has defined the CNAPP category more dramatically than Wiz. Founded in January 2020 by four Israeli entrepreneurs who previously co-founded Adallom (a cloud security company acquired by Microsoft in 2015), Wiz reached a $12 billion valuation in its May 2024 Series E round, raising $1 billion and making it the most valuable private cybersecurity company in the world. Wiz’s agentless scanning approach, which uses cloud provider APIs to analyze configurations, workloads, and permissions without deploying agents on individual machines, resonated with enterprises frustrated by the operational overhead of agent-based solutions. With ARR exceeding $500 million in 2024 and customers including 40% of the Fortune 100, Wiz became the defining CNAPP success story. Google initially offered $23 billion to acquire Wiz in July 2024, but Wiz declined, citing antitrust concerns and plans for an IPO. The story did not end there: in March 2025, Google and Wiz agreed to a $32 billion all-cash acquisition, the largest cybersecurity deal in history. The U.S. Department of Justice cleared the deal in November 2025, with the transaction expected to close in 2026.

Palo Alto Networks has built its CNAPP position through acquisition and integration. Prisma Cloud evolved from the 2018 RedLock acquisition ($173 million) and subsequent purchases of Twistlock and PureSec (2019), Bridgecrew (2021, $156 million), and Cider Security (2022, $300 million), forming the most comprehensive CNAPP platform from an established vendor. With Palo Alto’s installed base of over 70,000 enterprise customers and Next-Generation Security ARR reaching $5.6 billion in fiscal year 2025 (which includes Prisma Cloud alongside Prisma Access and Cortex), Prisma Cloud benefits from cross-selling dynamics that pure-play competitors cannot match.

CrowdStrike entered the CNAPP market through its Falcon Cloud Security module, leveraging its dominant position in endpoint detection and response (EDR) to extend protection to cloud workloads. CrowdStrike’s argument is compelling: the same adversaries that attack endpoints attack cloud infrastructure, so a unified platform that correlates endpoint and cloud telemetry provides better detection than siloed tools. The acquisition of Bionic in September 2023 for approximately $350 million added application security posture management (ASPM) capabilities, further expanding CrowdStrike’s cloud coverage.

Other significant CNAPP players include Orca Security (agentless pioneer valued at $1.8 billion in its 2021 Series C extension), Sysdig (runtime-focused with open-source Falco as its competitive moat, named a Leader in the Forrester Wave for CNAPP in Q1 2026), and Microsoft Defender for Cloud (which benefits from native Azure integration and is included in many enterprise licensing agreements). Lacework, once valued at $8.3 billion, was acquired by Fortinet in 2024 for an estimated $200 to $230 million after a dramatic valuation decline, underscoring how quickly market conditions shifted. The market is consolidating: smaller CSPM vendors without a credible CNAPP path are being acquired or marginalized.

---

The Real-World Impact: When Misconfiguration Becomes a Breach

Case studies illustrate why CSPM/CNAPP adoption has become urgent. The healthcare sector has been particularly hard hit: nearly 57 million patient records were exposed across healthcare data breaches in 2025 alone, according to the U.S. Department of Health and Human Services. Blue Shield of California disclosed that a misconfigured Google Analytics implementation had shared member data with Google Ads for nearly three years, affecting up to 4.7 million individuals. Serviceaide, a California-based IT service management company, inadvertently exposed nearly half a million patient records through a cloud misconfiguration. These incidents follow a consistent pattern: a configuration error goes undetected for months or years, exposing data at a scale that a targeted hack rarely achieves.

The Toyota data exposure incident, disclosed in May 2023, became the canonical reference case. A cloud misconfiguration had left vehicle location data of 2.15 million Japanese T-Connect customers exposed for nearly a decade, from November 2013 to April 2023. The cause was a cloud system that had been set to public instead of private and was never reviewed. Toyota cited insufficient data handling rules as the root cause. This case became a reference point for why continuous posture management, rather than point-in-time audits, is essential. A CSPM tool conducting daily scans would have flagged this exposure on day one.

Overprivileged IAM roles represent another category of misconfiguration with outsized impact. Organizations routinely discover developer service accounts with administrative privileges spanning entire cloud environments, credentials exposed in public GitHub repositories, and automation accounts with permissions far exceeding their actual usage. CIEM capabilities within CNAPP platforms specifically address this risk by mapping actual permission usage against granted permissions and recommending least-privilege policies. The pattern is consistent: misconfiguration-driven breaches expose larger data sets and cost more to remediate than targeted attacks because the exposure window is typically measured in months, not hours.

---

Where the Market Is Heading: AI, Runtime, and Platform Wars

The next phase of CNAPP evolution is defined by three trends. First, AI-powered remediation is moving from concept to production. Rather than simply alerting on misconfigurations, CNAPP platforms are beginning to generate and, in some cases, automatically apply fixes. Wiz’s AI remediation capabilities, powered by integrations with Amazon Bedrock and Azure OpenAI Service, generate copy-paste remediation steps in Terraform, CloudFormation, Pulumi, and other infrastructure-as-code formats, reducing mean time to remediation from days to minutes. Palo Alto and other vendors offer similar AI-assisted remediation within their platforms. The risk of automated remediation breaking production environments is real, so most deployments currently require human approval, but the direction is clear.

Second, runtime protection is emerging as the critical differentiator. CSPM and static analysis tell you what is misconfigured; runtime security tells you what is being exploited right now. Sysdig’s runtime-first approach, built on the open-source Falco project (a CNCF graduated project with over 175 million downloads, used by more than 60% of the Fortune 500), has gained traction with organizations that need to detect active attacks within containerized environments. CrowdStrike’s correlation of runtime cloud telemetry with endpoint data provides cross-domain visibility that pure CNAPP players struggle to match.

Third, the platform consolidation war is reshaping the market’s structure. Google’s $32 billion acquisition of Wiz, once it closes, will make Google Cloud a CNAPP heavyweight overnight. This shifts the competitive landscape: instead of three megavendors (Palo Alto Networks, CrowdStrike, and Microsoft) pursuing a “single platform” strategy where CNAPP is one module within a broader security platform, Google enters as a fourth major player with the category-defining CNAPP product. The question is no longer whether an independent CNAPP champion can survive against platform juggernauts. The answer arrived in March 2025 when Wiz chose acquisition over independence. The remaining question is whether Sysdig, Orca, or another pure-play vendor can maintain relevance as the megavendors consolidate the market, or whether CNAPP will follow the same trajectory as EDR, where CrowdStrike won as an independent disruptor before becoming a platform itself.

---

Sources & Further Reading

• Gartner – Is the Cloud Secure?
• IBM Cost of a Data Breach Report 2025
• IBM Newsroom – 2025 Data Breach Report Key Findings
• Wiz $1 Billion Funding Round and $12 Billion Valuation
• Google Announces Agreement to Acquire Wiz
• DOJ Clears Google $32B Acquisition of Wiz – TechCrunch
• Wiz Walks Away from Google’s $23B Acquisition Offer – TechCrunch
• Palo Alto Networks FY2025 Financial Results
• CrowdStrike Acquires Bionic for ASPM
• Toyota Cloud Data Exposure – BleepingComputer
• Toyota Data Breach Reflection – Cloud Security Alliance
• Markets and Markets – CNAPP Market Report
• Mordor Intelligence – CNAPP Market Size
• Sysdig Named Leader in CNAPP – Forrester Wave Q1 2026
• Orca Security Series C Funding Announcement
• Lacework Acquisition by Fortinet – BankInfoSecurity
• Rapid7 Acquires DivvyCloud – TechCrunch
• Wiz AI-Powered Remediation with Amazon Bedrock
• HIPAA Journal – Largest Healthcare Data Breaches of 2025