#455 - CNAPP and the Cloud Identity Problem with Mike Small
Notas do episódio
Most cloud security incidents trace back to the customer, and most of those trace back to identity. Jeff and Jim sit down with Mike Small, Senior Analyst at KuppingerCole, to unpack Cloud Native Application Protection Platforms (CNAPP) and why identity practitioners should care. Mike explains how identity controls in the cloud have become data defined in code, why ephemeral workloads break traditional scan-then-deploy security, and how CNAPP evolved from static configuration analysis into runtime monitoring and SOC integration. The conversation covers the shared responsibility model, SOC 2 attestations and complementary user entity controls, multi-cloud complexity, and why standards matter for portability and sovereignty. Mike also looks at CNAPP as a security plane for AI, agents as another layer of non-human identity, recent market consolidation, and the cloud as national critical infrastructure. Plus, a detour into amateur radio, Morse code exams, and low-power QRP contacts across the Atlantic.
Connect with Mike: https://www.linkedin.com/in/mikesmall01/
AI Identity and Agentic Trust: https://www.kuppingercole.com/blog/small/ai-identity-and-agentic-trust
Mike's other writing for KuppingerCole: https://www.kuppingercole.com/people/small
Connect with us on LinkedIn:
Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/
Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/
Visit the show on the web at http://idacpodcast.com
00:00 Welcome and fall conference season
02:52 Introducing Mike Small
03:19 From engineer to identity software to analyst
05:07 What is CNAPP and why should IAM care?
07:21 Most cloud incidents are the customer's fault
11:00 Identity controls in the cloud are data
15:17 Static configuration analysis vs. runtime monitoring
19:34 Is CNAPP a product or a platform?
21:07 CSPM, CWPP, CIEM, KSPM and CNAPP capabilities
23:12 The shared responsibility model
27:46 Who defines secure? SOC 2 and complementary user entity controls
31:40 Multi-cloud and the case for standards
35:18 CNAPP as the security plane for AI
40:48 Where the CNAPP market heads next
44:34 Acquisitions and consolidation in cloud security
46:50 The cloud as national critical infrastructure
50:08 How sovereign is a sovereign cloud?
53:12 MCP and the speed of AI standards
53:39 Mike's passion for amateur radio
1:05:20 The CNAPP elevator pitch
1:06:14 Wrap up
IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Mike Small, KuppingerCole, CNAPP, Cloud Native Application Protection Platform, cloud security, CIEM, cloud infrastructure entitlement management, CSPM, CWPP, KSPM, shared responsibility model, least privilege, misconfiguration, runtime monitoring, SOC 2, complementary user entity controls, multi-cloud, non-human identity, NHI, AI agents, agentic AI, MCP, sovereign cloud, critical infrastructure, identity standards, MFA, amateur radio, IAM, identity and access management