How it works

How a finding becomes a fix, step by step

Here's the order API's risk from the moment the code ships to the fix. Scanners find far more than any team can fix, so the work is picking the few risks that are both exposed and exploitable. Some get accepted as exceptions, and a fix made by hand in the console instead of in code tends to drift back.

1. Deployed: a resource is created by code (Terraform, CloudFormation or Bicep templates, run from a CI/CD pipeline) or by hand in the cloud console. Code can be scanned in the pull request, the cheapest place to catch a mistake. What can go wrong: resources created in the console skip that check, and no code describes them.
2. Found: the tool inventories every account through the cloud's APIs and checks each configuration against policy (a public bucket, a firewall rule open to the world, logging off). It looks inside workloads for vulnerable packages, secrets and malware, from a disk snapshot or an agent, and reads audit logs and runtime events for attacks in progress. What can go wrong: Microsoft's agentless scan runs once every 24 hours on running machines only, so a workload that lives less than a day can go unseen.
3. Prioritized: context is added. Is the resource reachable from the internet? Is the bug known to be exploited? Is the vulnerable package loaded? What can the attached identity do, and is sensitive data within reach? Datadog found only 18% of vulnerabilities rated critical by their CVSS score (the standard severity score) stayed critical once runtime context was added. What can go wrong: a queue sorted by CVSS sends engineers after bugs nobody can reach while a chain of medium findings stays open, and a rule written to cut noise can hide the inputs a detection engine needs (see Exceptions and reversals).
4. Assigned: the tool maps the resource to an owner using the account, tags, the repository that deployed it and the on-call schedule, then opens a ticket in Jira or ServiceNow, or a pull request. What can go wrong: an untagged resource with no link to a repository sits with nobody. In a 2021 Cloud Security Alliance survey, 70% said their security, operations and development teams weren't aligned on policy, and only 37% fixed a misconfiguration within a day.
5. Fixed: from most to least durable, a team can fix the shared infrastructure module (every future copy is fixed too), fix this one template, add a guardrail such as an AWS service control policy so the class of mistake can't recur, rebuild the image, rotate the key, or fix it in the console (fast, and likely to drift). The next scan verifies it. What can go wrong: at AWS a resolved finding flips back to new when the check fails again, and Security Hub's older posture product deletes active findings after 90 days, so an auditor asking for a year of history needs an export.

Two exits sit off that path. Accepted is a finding the team has decided not to fix, recorded as an exception. A good exception has an owner, a reason and an expiry date, and the tools don't all enforce that: AWS's "suppressed" status has no built-in expiry, while Microsoft's exemptions and Google's dynamic mute rules can expire. Drifted is a fix that didn't stick: an engineer fixes a Terraform-managed resource in the console and the next deployment puts the old setting back, or a console change never reaches code and the next environment built from code repeats the mistake.

Gartner's baseline for a full CNAPP, as vendors summarize its 2025 market guide, is posture, workload protection, entitlements, and infrastructure-as-code and container scanning, with attack-path correlation as what sets products apart. Vendors stretch the label over whatever else they sell.

Agentless or agents

Agentless means the vendor runs the scanner in its own account and reads yours through a role you grant: the APIs for configuration and permissions, and copies of your disks for what's installed. Microsoft's version analyzes each snapshot in the same region, deletes it within minutes and keeps only metadata. It still needs rights to create snapshots and, on AWS, encryption keys, so an outside party holds a lot of access either way.

The clouds settled on agentless as a default: Amazon Inspector has scanned EC2 machines without an agent since April 2024, and Microsoft's paid plans scan Azure, AWS and Google machines the same way. Then runtime came back. Wiz, born agentless, sells a runtime sensor and shipped forensics for it in May 2026, Palo Alto's Cortex Cloud pairs agentless scanning with its endpoint agent, and Unit 42 found high-severity runtime alerts twice as common as high-severity configuration alerts in 2024 (a vendor figure).

Meanwhile the graph stopped being a moat. AWS's Security Hub has drawn "potential attack paths" since December 2025, and Microsoft's paid posture plan has attack path analysis too. Orca sued Wiz in July 2023 over six patents on agentless scanning; on December 8, 2025 the US patent appeals board found the challenged claims unpatentable, and in early January 2026 both sides dropped their suits for good.

My default: agentless everywhere for coverage, and sensors on the production machines that face the internet or hold sensitive data.