Cloud workload protection (CWPP) is software that watches the programs a company runs in the cloud while they are running, and stops them when they start doing something harmful. A workload is any program running on a server. In the cloud, it may run on a virtual machine, a rented computer made of software, or inside a container. CWPP stands for cloud workload protection platform.
Most modern apps run in containers. A container is a packaged piece of an app that holds the code and everything the code needs to run. A Kubernetes platform starts and stops thousands of them across many servers. Many containers run for only a few minutes before they are replaced. The page on containers and Kubernetes explains them in more detail.
CWPP watches each container from the server it runs on. A small program on each server observes every process that starts, every file that changes and every network connection. On Linux, this is often done with eBPF, a feature of Linux that lets a program observe the operating system from inside, without changing it. CWPP also learns what each container normally does. A container that runs a checkout service starts the same few programs every time. Anything else is suspicious.
Consider an insurance comparison website in Gurugram whose app runs in 600 containers. At 2:14 a.m., an attacker uses a known flaw in the web software of one container. A command shell opens inside the container. A shell is a program for typing commands, and this container has never started one. Within seconds, the shell starts downloading a program that mines cryptocurrency on the company's servers, at the company's cost. CWPP stops the shell, stops the container and sends an alert to the SIEM. Kubernetes starts a clean copy of the container, so customers notice nothing.
CWPP also uses information from before the app went live. Container image scanning lists the known flaws in each container image. CWPP then shows which of those flaws are in code that actually runs, so the team can fix those first. CWPP can also find passwords left in plain text inside a container. These belong in secrets management.
How is it different from its neighbours? Endpoint detection and response (EDR) protects laptops and long-running servers. CWPP is built for containers that start and stop every few minutes. Cloud security posture management (CSPM) checks the settings of the cloud account. CWPP watches the programs inside it. Some CWPP products also limit which containers may connect to which, a cloud form of micro-segmentation.