Field Guide
Cloud security (CNAPP): posture, workloads and permissions
06
Market and trends
4 min read · Chapter 6 of 10
Who holds the power
Power follows whoever controls the data the tools read, the bill they're paid from and the engineers who make the fix.
- Cloud providers hold the APIs and logs, the free tier, the bill, the commitment and the marketplace rules, and since March 2026 Google owns Wiz. Their weakness is that buyers are wary of a cloud grading its own homework.
- Security platforms (Palo Alto, CrowdStrike, SentinelOne, Check Point, Fortinet, Tenable) hold the enterprise security budget and fold cloud into bigger deals through credit pools. CrowdStrike's cloud line is about 15% of its $5.84 billion of ARR.
- Independent CNAPP vendors hold multicloud neutrality, the graph and the CISO relationship, and depend on marketplaces whose rules the clouds write. Wiz's neutrality is now a promise to be defended contract by contract.
- Observability vendors hold an agent on every host and the engineers' daily tools, and are small in security revenue; that convergence is in Observability: metrics, logs and traces.
- Engineers and platform teams hold the fix. Whoever routes findings into their pull requests and trackers gets used daily, and vendors pay for that path: Wiz bought the remediation startup Dazz (about $450 million) in 2024, and Tenable bought Vulcan Cyber for $150 million in January 2025.
- Auditors decide which exceptions pass. Insurers gatekeep through MFA and endpoint-detection attestations; as far as I can tell they don't yet read posture data at scale, though Google lets customers share theirs with insurers for quotes.
- Regulators are splitting, with the EU, the UK and New York tightening while the SEC has eased off.
Tailwinds and headwinds
These are the forces I'd expect everyone in this industry to watch over the next couple of years. Each one helps some players and hurts others, and the clouds end up on the winning side of most of them.
Tailwinds:
| What's changing | Who gains | Who loses |
|---|---|---|
| Companies are putting AI models and agents into their clouds, and in a 2026 budget survey AI topped security leaders' list for new money. | Platforms that sell an AI security module (Palo Alto, CrowdStrike, Wiz, SentinelOne, Check Point); the clouds | Standalone AI posture startups; CNAPP vendors slow to cover the clouds' AI services |
| Exploits became the most common way in during 2025, and attackers increasingly use a bug before its patch exists. | Runtime vendors that can see and block (Sysdig, Upwind, SentinelOne, CrowdStrike, Wiz's sensor); exposure ranking (Wiz, Tenable, Cortex Cloud) | Posture-only tools; app teams, whose backlog now carries more risk per item |
| Buyers want fewer vendors and pay through pooled credits, so cloud security is sold inside bigger platform deals. | Palo Alto, CrowdStrike, Wiz, Microsoft, Datadog | Single-layer specialists (Orca, Aqua, Sysdig); buyers at renewal, once one vendor holds the leverage |
| Service accounts, keys and now AI agents far outnumber people, and in Google's data for late 2025, identity compromise was behind 83% of the cloud and SaaS breaches Mandiant investigated. | Palo Alto (CyberArk), CrowdStrike, Cisco (Astrix), Tenable (Ermetic); platforms whose graph maps permissions | Standalone permissions tools; buyers paying per identity |
| Cloud and AI infrastructure keep growing, and most tools bill per workload, resource or host, so the bill grows without a new sale. | The clouds, whose meter sits on their own bill; per-workload and per-host vendors (Wiz, Orca, Upwind, Datadog, Sysdig) | Buyers on per-unit meters; tools priced per seat or at a flat fee |
Headwinds:
| What's changing | Who gains | Who loses |
|---|---|---|
| The clouds give the basics away, sell the rest on their own bill, and since March 2026 Google owns Wiz. | AWS, Microsoft, Google; partners AWS resells through Security Hub Extended (CrowdStrike, Upwind, SentinelOne, CyberArk, Chainguard) | Independent posture vendors (Orca, Aqua, Sysdig, Fortinet); Wiz in AWS and Azure accounts, if buyers doubt its neutrality |
| The median security budget didn't grow at all in 2026, so new tools have to replace old ones. | Platforms with credit pools (CrowdStrike, Palo Alto); the clouds, paid from commitments; AI security, which gets the new money | Point tools at renewal (Orca, Aqua, Sysdig); managed security providers on fixed-scope contracts |
| AI models now find vulnerabilities cheaply, and Anthropic's code-scanning preview knocked about 11% off several security stocks in a day in February 2026. | AI model labs; Microsoft; vendors that own runtime and the fix (Wiz, Datadog, CrowdStrike) | Code scanners priced per developer (Snyk, Veracode); posture-only tiers; penetration-testing services |
| Teams fix only a small share of what tools find, which weakens the case for a findings-heavy tool at renewal. | Vendors that can show fixes closed (Wiz with Dazz, Tenable with Vulcan) and managed remediation services | Findings-heavy tools priced at a premium; CISOs defending renewals |
| Since May 2025, whether a buyer can pay from its AWS commitment depends on whether the vendor runs on AWS, and Microsoft and Google have similar rules. | Vendors hosted on the buyer's main cloud (Wiz, CrowdStrike and Upwind in AWS shops); Security Hub Extended partners; the clouds | Vendors selling into a different cloud's commitment; buyers with estates across several clouds |
The one thing I'd watch is the first vendor to publish how many of its AI-drafted fixes actually get merged. Remediation agents could be the biggest force here by 2028, and nobody has outcome data yet.