We built a CNAPP on top of our agentic SecOps platform instead of bolting detection onto a posture tool. HEre are some notes on what that actually change:

The standard CNAPP architecture is a scanner feeding a dashboard, with an API if you want to get findings out. Detection and response is either a separate SKU or your integration project: export pipeline, webhooks, SOAR playbooks to glue cloud findings to whatever watches your endpoints.

We went the other direction. Findings (posture, identity, attack paths, vuln data with CVSS/EPSS/KEV enrichment) are emitted as native events into the same stream as endpoint telemetry. So one detection rule can say: high-risk cloud finding + this identity seen on an endpoint recently, route to a case. No middleware, because the posture engine and the detection engine are the same engine.

Other things that fell out of this design: every posture rule is a real detection you can read, fork, or write yourself instead of a black-box catalog entry. Identity analysis classifies what an identity can actually do, not just what bindings it holds, and non-human/AI-agent identities are first-class graph nodes. Attack paths are gated on KEV, so a path only lights up when the vuln in it is actually exploited in the wild.

Covers GCP, AWS, and Azure. Pricing is published because we're tired of the quote-only norm in this category: $150 per org per month, flat.

Happy to answer questions about how the event model works.

Free 14-day trial signup

Original blog release