The Platform PM

Glossary and sources

Field Guide

Cloud security (CNAPP): posture, workloads and permissions

10

Glossary and sources

7 min read · Chapter 10 of 10

Words that mean something else here

TermWhat you'd assumeWhat it means here
AgentAn AI agentUsually a host agent or sensor; also an AI agent, and part of product names ("AWS Security Agent", "Wiz Green Agent")
AgentlessNothing runs anywhereThe vendor's scanner reads your APIs and disk snapshots with roles you grant, including rights to create snapshots and keys
Finding, issue, exposure, alertSynonymsA finding is one check result; an issue (Wiz) or exposure finding (AWS) is a ranked combination; an alert is activity seen at runtime. Counts differ 10-1,000 times depending on the noun
CriticalUrgentA CVSS score, a contextual ranking (exposed and exploitable) or, under DORA, a provider the system depends on
WorkloadAn applicationWiz's billing unit: one running VM, container or serverless function
PostureOverall securityConfiguration at a point in time
Toxic combinationA chemistry termLow and medium findings that together make a critical path (Wiz's phrase; others say attack path)
Suppressed, muted, exempted, acceptedDifferent statesFour ways to say "known, not fixing"; they differ on expiry and on whether scores change
Shift leftDoing work earlierScanning in code and CI; more and more, also sending the fix to the developer as a pull request
LLMjackingHacking a modelUsing stolen cloud keys to run AI models on the victim's bill

What surprised me

Placeholders in your voice, drafted from the research and the earlier guides. Rewrite each with your own moment.

"Security tools find the problems." Every tool found them, by the tens of thousands. The weeks went into getting an engineer on another team to merge a fix for the twelve that mattered.

"Agentless won." It won the opening sale. By 2026 the same vendors were selling sensors again, because a disk snapshot can't see what's running.

"Attackers get in through misconfigurations." In the latest data, exploits led as the way in. What they could reach once inside still came down to identity and permissions.

"The cloud provider shares the risk." Every contract I read put configuration on the customer and capped the provider at a year of fees.

"The security tool is the safe part of the stack." In March 2026 a poisoned scanner handed attackers the keys it was meant to protect.

Sources

Undated entries were read on October 8, 2026; "search result" means seen only as a search snippet or summary. Company figures are self-reported unless they come from a filing or a regulator, and vendor research measures each vendor's own customers.

Cloud providers: documentation, pricing and contracts

Standards, regulators and courts

Breach cases

Industry surveys and vendor research

Market, companies and deals

Insurance

Field Guides are learning notes, not legal or compliance advice. Rules and fees change; check the cited primary sources before you act on anything here.