AI Transforms Cloud Security: The Dynamic CNAPP Evolution

The tectonic plates of cybersecurity are shifting once again, and this time, the seismic event is driven by artificial intelligence.

For years, cloud defense has been a relentless game of catch-up, with each new technological wave — containers, serverless architectures, multicloud environments — forcing security teams to fundamentally rethink their strategies.

Now, AI is not just another wave; it’s a tsunami, accelerating this evolution at a pace that dwarfs anything seen before.

Traditional cloud-native application protection platforms, or CNAPPs, were designed for a simpler, more predictable world.

They offered a consolidated view, managing configurations and scanning for vulnerabilities.

The underlying premise was stability: see every asset, check every setting, fix misconfigurations before they could be exploited.

This model, while still vital for compliance and basic hygiene, is rapidly becoming a relic in the face of AI’s dynamic, often unpredictable, behavior.

AI models, autonomous agents, and complex data pipelines spin up resources, query sensitive data, and modify code in mere seconds.

A developer might deploy an agentic AI into production that performs tasks across multiple services, without fully grasping its myriad internal operations.

The static security posture of yesterday simply cannot comprehend, let alone secure, this fluid reality.

Few understand this emerging complexity better than Dror Kashti, co-founder and CEO of Sweet Security.

With a distinguished 25-year career in the Israel Defense Forces, culminating in leading a Cyber department within the legendary Unit 8200 and overseeing Project Nimbus—the IDF’s massive public cloud migration—Kashti has a unique vantage point on national-scale systems adapting to new operational realities.

His insight is stark: AI builds amazing capabilities, also for attackers.

But crucially, he adds, For years it was easier to be on the offensive side because you only needed one open door. But AI brings a new balance — it can finally give the defense an edge.

This perspective encapsulates a profound shift: the automation advantage long held by attackers is finally being challenged, as defenders begin to fight on equal terms.

The paradox of AI in security is undeniable: it is simultaneously the engine driving innovation and the very threat introducing new vulnerabilities.

Companies are harnessing machine learning to correlate incidents, improve detection, and prioritize risks (AI for security).

Yet, they are also grappling with how to protect the models, prompts, and data pipelines that power these systems (security for AI).

This duality demands more than just new tools; it requires a fundamental mindset change.

As Den Jones, founder and CEO of 909Cyber, sagely observes, AI will help the good guys keep the bad people out, find vulnerabilities, look at configurations and close open doors into the environment — but it will also help the bad guys, who are using AI for deepfakes and highly convincing phishing campaigns.

His words underscore why CNAPP innovation cannot afford to stop at mere compliance checks.

It must evolve into intelligent systems that learn, infer, and act autonomously, because the same algorithms defending networks are being weaponized to breach them.

Kashti echoes this sentiment regarding the cloud.

Rule-based logic, he argues, is fundamentally inadequate for systems that continuously learn and adapt.

It’s not about writing more rules, he explains.

When you add AI, you’re learning your own environment — how your agents behave normally — and that lets you distinguish the abnormal.

This behavioral insight, fueled by real-time runtime data, is the secret sauce.

It enables AI-enhanced CNAPPs to detect subtle, live shifts that static, snapshot-based tools inevitably miss.

The foundation of security is no longer a configuration file; it’s the live context of what applications, identities, and AI agents are actually doing in production.

Runtime telemetry—the granular data stream of system calls, API requests, prompt traffic, and data access patterns—becomes the raw material for this new form of intelligence.

Feeding this torrent of data into AI engines allows for correlation across thousands of disparate events, enabling security teams to cut through the noise and focus on what truly matters.

It’s the difference between seeing a solitary red dot on a vast map and understanding whether that dot signifies a harmless parade or an imminent invasion.

Recent funding rounds, such as Sweet Security’s $75 million Series B, are not just financial news; they are signposts pointing to this broader industry movement.

The race is on to embed real-time understanding into CNAPP platforms, moving beyond static posture checks, which have become mere table stakes.

The new frontier is continuous interpretation—AI systems that don’t just monitor risk, but deeply comprehend it in motion.

This evolution promises to transform how teams prioritize and respond, shifting the focus from chasing every minor misconfiguration to addressing the risks that genuinely threaten production environments.

AI acts as an intelligent filter, mitigating alert fatigue and empowering faster, more confident decision-making.

This technological leap also necessitates a significant cultural adjustment within organizations.

The biggest threats, Kashti warns, may not always originate from external adversaries.

The biggest risk isn’t always the attacker, he states, it’s the engineer who unknowingly pushes an unsafe AI agent into your environment.

Guardrails and sophisticated mapping tools that track the behavior of these internal AI agents are rapidly becoming as indispensable as firewalls once were.

The next generation of CNAPP will be defined by its ability to think and learn.

It will seamlessly fuse telemetry from human users, workloads, and AI systems to deduce intent, not just observe activity.

It will prioritize risks based on true impact, not simply rule counts, and it will respond automatically to deviations from its learned baseline.

Jones’ observation about AI helping both sides cuts to the very heart of this transformation: security will no longer be about merely keeping pace with change, but about proactively predicting it.

CNAPPs capable of interpreting runtime behavior across all entities—humans, traditional workloads, and the burgeoning army of AI agents—will forge this new defensive edge.

The fundamental shift from static posture to dynamic perception is already underway, and as AI continues to blur the lines between code and cognition, the victors in cloud security will be those who can defend not just at machine speed, but with machine understanding.