Cloud-Native Application Protection Platforms (CNAPP) consolidate cloud security capabilities previously sold as separate point products — Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWPP), Cloud Infrastructure Entitlement Management (CIEM), Kubernetes Security Posture Management (KSPM), and infrastructure-as-code scanning — into a single product covering the cloud-native application lifecycle from code to runtime. Core capabilities include multi-cloud posture scanning against benchmarks (CIS, NIST, PCI), agentless and agent-based workload vulnerability detection, permission and entitlement analysis (CIEM), attack-path graphing that correlates misconfigurations with exploitable vulnerabilities and excessive permissions, Kubernetes configuration and runtime protection, and IaC-time scanning. Leading vendors include Wiz, Palo Alto Prisma Cloud, Orca Security, Lacework, Aqua, Sysdig, Microsoft Defender for Cloud, and Uptycs.