Are We There Yet? Lessons from the 10 Year Cloud Security Ride

Are We There Yet? Lessons from the 10 Year Cloud Security Ride

Speakers: James Berthoty, Founder, Lacatio

Conference: fwd:cloudsec

YouTube: https://www.youtube.com/watch?v=YrhHBhAh1Ns

Overview

James Berthoty's talk, "Are We There Yet? Lessons from the 10 Year Cloud Security Ride," offers a critical retrospective and forward-looking analysis of the cloud security landscape over the past decade. As the founder of Lacatio, a practitioner-focused analyst firm, Berthoty brings a unique perspective shaped by his extensive background in security operations, cloud security, and application security. The presentation aims to demystify the evolution of cloud security tools, explain their current architectural design, and identify the gaps that still need to be addressed.

The talk is particularly relevant for anyone involved in cloud security, from newcomers seeking foundational understanding to seasoned professionals navigating complex tool ecosystems. Berthoty tackles three core questions: "Why is my tool the way that it is?", "What's left to build in cloud security?", and "How should I select a cloud security tool?". By charting the progression through distinct "eras" of cloud security, he provides invaluable context for understanding the current market, the strengths and weaknesses of prevailing solutions, and the emerging trends that will define the next generation of defenses.

This article delves into Berthoty's comprehensive analysis, highlighting the journey from the "Wild West" of nascent cloud defenses to the consolidated, yet often disjointed, Cloud Native Application Protection Platform (CNAPP) era. It explores the challenges practitioners face with alert fatigue, lack of context, and the promise of advanced capabilities like Cloud Application Detection Response (CADR) and sophisticated auto-remediation. Ultimately, the talk serves as a call to re-evaluate how organizations approach cloud security, emphasizing strategic planning, architectural understanding, and a clear vision for remediation over merely acquiring more tools.

Background

▶ Watch: Introduction and overview of the 10-year cloud security ride (0:00)

The genesis of cloud security, as described by Berthoty, was a "Wild West" period characterized by the rapid emergence of two distinct types of solutions. On one side, vendors and open-source projects focused on container protection. The shift to containerization, particularly with the advent of cloud platforms, left a significant gap in traditional security tools designed for Windows or Linux hosts. Teams desperately needed runtime protection and vulnerability scanning for containerized infrastructure. Projects like Falco emerged to provide crucial runtime visibility, while Trivy became a foundational open-source tool for vulnerability scanning, so much so that, according to Berthoty, "80% of the tools that you were using were just wrappers around Trivy in the first place."

Concurrently, another wave of startups concentrated on posture management, specifically Cloud Security Posture Management (CSPM). These tools aimed to crawl cloud provider APIs to assess configurations and identify misconfigurations. For many practitioners, including Berthoty himself, who transitioned from traditional IT security roles (like Windows CIS admin) into cloud environments, CSPM tools were an immediate necessity. Faced with "an AWS dashboard that's just full of random IDs" and a bewildering array of services, the initial priority was simply to "help me learn my cloud, help me understand what's there." While posture tools gained rapid adoption and many were quickly acquired, runtime protection was initially "way ahead of the market," only later gaining prominence as organizations matured in their cloud adoption and recognized the need for deeper operational understanding and threat detection.

This early market dynamic set the stage for the subsequent CNAPP consolidation era. The rapid acquisition of smaller, specialized tools by larger security vendors created a landscape where the goal was to integrate disparate capabilities under a single umbrella. This consolidation was driven by the perceived need for a comprehensive platform, but it inadvertently led to challenges in tool design and practitioner utility, which Berthoty critically examines throughout his talk.

Key Findings

▶ Watch: Introducing the three distinct eras of cloud security (2:20)

Berthoty frames the evolution of cloud security through three distinct eras: the Wild West, CNAPP Consolidation, and Competing with the Blue Logo Company. Each era brought its own set of innovations, challenges, and lessons learned.

1. The Wild West (Early 2010s): This era saw the independent rise of container protection tools (like Falco for runtime, Trivy for vulnerability scanning) and posture management (CSPM) tools. While CSPM tools were quickly adopted due to the immediate need for visibility into complex cloud environments, container runtime protection was initially ahead of its time but has since become critically important. Many early posture tools were rapidly acquired, indicating market demand for basic cloud configuration visibility.

1. CNAPP Consolidation (Mid-2010s to Present): This era was largely defined by an "arms race" to bundle as many features as possible into a single platform. Berthoty credits Palo Alto Networks with essentially "inventing CNAPP" through the acquisition and integration of companies like RedLock and TwistLock, combining CSPM and container protection. This led to a proliferation of acronyms (e.g., DSPM for Data Security Posture Management, KSPM for Kubernetes Security Posture Management, CIEM for Cloud Infrastructure Entitlement Management) all being rolled into monolithic CNAPP offerings.

• Main Issues with CNAPP Consolidation:
• Agentless scanning as "work generation": Many tools promised security through scanning but primarily generated thousands of alerts without clear context or actionable remediation paths. Berthoty candidly shares his experience of fixing CSPM alerts only to have them reappear due to Infrastructure as Code (IaC) redeployments, highlighting a fundamental disconnect.
• Lack of container context: Early posture tools, built separately from container security, struggled to provide the necessary context for containerized environments, making remediation difficult for security teams.
• Disjointed tools for different personas: CNAPP platforms often combine features catering to disparate security personas—application security (code), cloud security (cloud infrastructure), and security operations (runtime). This leads to tools that are "very disjointed" and hard for a single team or individual to effectively utilize across all functions, creating significant training and operational hurdles for teams like SecOps analysts.

1. Competing with the Blue Logo Company (Current Era): In response to the CNAPP consolidation, vendors are now taking three paths:

• Giant Bundles: Offering comprehensive solutions that extend beyond cloud to include on-premises and multi-cloud environments, covering code, runtime, and vulnerabilities in one massive suite.
• Deep Specialization: Focusing on excelling in one specific area (e.g., runtime, code, or cloud posture) while offering adequate coverage in others.
• Buyer's Market: For organizations not requiring a "100% solution," there are many high-quality tools available that can achieve 80-90% of security goals at competitive prices, a significant shift from just five years ago.

Technical Deep Dive

▶ Watch: Recognizing Trivy and Falco's foundational open-source contributions (3:40)

Berthoty's technical deep dive unpacks the architectural and functional evolution of cloud security tools, starting from their foundational components and progressing to the complexities of modern CNAPP solutions and emerging capabilities.

In the "Wild West" era, the technical landscape was bifurcated. Container protection solutions focused on critical aspects like runtime protection and vulnerability scanning. Tools like Falco were instrumental in providing visibility into container execution, allowing for real-time detection of anomalous behavior. Trivy became the de facto standard for scanning container images and file systems for known vulnerabilities, forming the backbone for many commercial and open-source scanning tools. These solutions addressed the immediate challenge of securing ephemeral, dynamic container environments that traditional host-based security tools struggled to monitor.

Simultaneously, Posture Management (CSPM) tools were developed to address the sprawling configurations of cloud providers. Technically, these tools operate by making extensive API calls to cloud platforms (AWS, Azure, GCP) to enumerate resources, evaluate their configurations against security benchmarks (e.g., CIS Benchmarks), and identify misconfigurations. The early appeal of CSPM was its ability to bring order to the chaos of cloud deployments, offering a "help me learn my cloud" function. However, a significant technical challenge arose when these posture tools encountered Infrastructure as Code (IaC). Berthoty highlights the common scenario where a misconfiguration fixed manually would simply reappear because the underlying IaC (e.g., Terraform) would redeploy the vulnerable configuration, illustrating a critical disconnect between security findings and the development pipeline.

The CNAPP consolidation phase saw the ambitious integration of these disparate capabilities. The goal was to combine CSPM with container and workload protection, often adding Cloud Infrastructure Entitlement Management (CIEM) for identity and access, Data Security Posture Management (DSPM) for data-centric risks, and Kubernetes Security Posture Management (KSPM) for container orchestration. Technically, this meant attempting to correlate data from various sources: cloud APIs for posture, agents or sidecars for container runtime, and static analysis tools for IaC and application code. The speaker notes that this often resulted in "very disjointed tools" because the underlying data models and operational contexts for code security (AppSec), cloud infrastructure (CloudSec), and runtime operations (SecOps) are inherently different. For example, a SQL injection alert from a runtime agent on a specific pod requires a different skill set and context than a misconfigured S3 bucket.

Berthoty then transitions to emerging features that are attempting to bridge these technical gaps:

• Code-to-Cloud Picture: This aims to create a "magical" association between source code repositories, deployed cloud assets, and potential attack vectors. The ideal scenario is to trace a deployed vulnerability back to a specific line of code in a specific file, enabling developers to fix the root cause. This requires sophisticated mapping and correlation across the entire software development lifecycle and deployment pipeline. The challenge lies in automating this correlation without extensive manual setup.
• Cloud Application Detection Response (CADR): This is a critical advancement in runtime security. Unlike traditional workload protection tools that might only report a process starting in a container, CADR deploys sensors inside the application at runtime. It observes function execution, call stacks, and traces across the application. This granular visibility allows for the detection of application-layer attacks (e.g., "this application or this function started this process") that would be invisible to lower-level runtime monitors. Berthoty emphasizes this as the "area of runtime security that has been missing the most."
• Auto-Remediation: While simple auto-remediation (like unchecking "public" for an S3 bucket) has existed, advanced auto-remediation aims to integrate with the code-to-cloud picture. For container vulnerabilities, Berthoty suggests a pragmatic approach: "rebuilding your containers every night will handle most vulnerabilities for most systems." The technical challenge is for tools to intelligently recommend and automate such actions, rather than just suggesting version upgrades that might break dependencies.
• AI Prioritization and AI Red Teaming: AI is being leveraged in various ways, from fuzzing applications with DASH tools and Nuclei templates to performing attack simulations and prioritizing alerts. The technical implementations vary widely, from external "outside-in" testing to more integrated attack simulation platforms.
• Preventative Security: This focuses on shifting left and preventing issues before deployment or exploitation. Key technical controls include Service Control Policies (SCPs) and Permission Boundaries in cloud environments. These allow organizations to set guardrails at the organizational unit or account level, defining maximum permissions or disallowed actions. Berthoty acknowledges the difficulty of implementing SCPs without "breaking things" and the lack of robust "access analyzer equivalent" tools for pre-deployment testing across multi-cloud environments. Solutions in this space aim to provide a unified plane for managing these preventative controls across different cloud providers and integrate them with network and application layer segmentation.

Finally, Berthoty addresses AI Security. He argues that for AI workloads running on cloud infrastructure (e.g., Bedrock API calls, self-hosted containers), existing CNAPP capabilities (posture checks, runtime detection) are largely applicable. However, for AI interactions happening outside the traditional cloud workload model (e.g., SaaS-based workflows like Glean, or specialized AI services), new mechanisms like proxies for interception or specific hooks and agent intents might be required, indicating a potential need for specialized tools depending on the architectural deployment of AI.

Demo / Proof of Concept

▶ Watch: The CNAPP consolidation era begins, invented by Palo Alto (5:20)

James Berthoty's presentation focuses on a high-level, analytical overview of the cloud security landscape and its historical evolution, rather than demonstrating specific tools or proof-of-concept exploits. He discusses various types of tools and emerging features, such as Code-to-Cloud solutions, CADR, and auto-remediation, explaining their conceptual functionality and the problems they aim to solve. While he mentions the "nice demo of a code to cloud picture" that sales engineers might set up, the talk itself does not include a live demonstration or a technical proof-of-concept.

Defensive Implications

▶ Watch: Critique: Disjointed CNAPP tools due to diverse personas (6:20)

Berthoty provides crucial guidance for security practitioners and organizations navigating the complexities of cloud security, emphasizing strategic planning over reactive tool acquisition.

1. Strategic Tool Selection: The "best" cloud security solution is not a universal truth but "the one that best fits your budget, environment, and priorities." Organizations should resist the urge to buy the most feature-rich CNAPP without understanding their specific needs. Many solutions today offer 80-90% of the desired capabilities at a more accessible price point than groundbreaking tools of just five years ago.

1. Understand Your Architecture First: Before engaging with vendors, thoroughly map out your infrastructure and architecture. "Don't let the vendor be the one that's explaining to you how your architecture works." This foundational understanding is critical for making informed buying decisions and assessing a tool's true applicability.

1. Plan for Remediation: Acknowledge that buying a security tool means "you're just going to buy like 2,000 alerts." A robust remediation strategy is paramount. This includes:

• Defining Ownership: Clearly identify who will be responsible for fixing alerts. A budget for a tool without an allocated team or process for remediation is ineffective.
• Categorizing Alerts: Separate remediation strategies for vulnerabilities, misconfigurations, and runtime alerts.
• Misconfigurations: These can range from simple two-second fixes to multi-year architectural overhauls requiring significant investment.
• Vulnerabilities: Develop a realistic strategy for patching and automation. Berthoty suggests that for containers, "rebuilding your containers nightly will handle most vulnerabilities for most systems," simplifying a common challenge.
• Runtime Alerts: Integrate these into your existing Security Operations (SecOps) team workflows, ensuring they have the context and training to understand complex alerts from containerized or serverless environments.

1. Embrace Preventative Security: Actively implement Service Control Policies (SCPs) and Permission Boundaries within cloud environments. These are powerful mechanisms for setting organizational guardrails and defining maximum permissions, significantly reducing the attack surface. While challenging to implement without "breaking things," their long-term value in preventing misconfigurations and unauthorized actions is immense. Look for vendors who can help manage these complex policies across multi-cloud environments and integrate with network and application layer segmentation.

1. Leverage Emerging Capabilities:

• Code-to-Cloud: Prioritize solutions that can effectively map deployed assets back to source code, enabling developers to fix issues at the source (IaC, application code) rather than just patching deployed instances. This addresses the "fixing the wrong thing" problem caused by IaC redeployments.
• Cloud Application Detection Response (CADR): Invest in tools that offer deep application-layer visibility at runtime. CADR's ability to see function execution and call stacks provides crucial context for detecting sophisticated application attacks, moving beyond just process monitoring.
• Intelligent Auto-Remediation: Seek out tools that offer nuanced auto-remediation, understanding that a simple "check box" fix isn't always appropriate. Focus on strategies like automated container rebuilds for vulnerability management where applicable.

1. Start with Open Source: Before investing in commercial tools, "Run a Prowler scan. Run open source scans first to get a taste of how am I going to actually deal with the amount of noise that's going to come through." This helps set realistic expectations for alert volume and the effort required for remediation.

1. Empower Practitioners: Recognize that if an alert is unclear, "90% of the time it is the tool that is making it hard to tell what's happening. It's not you." This perspective empowers security teams to push back on overly complex or poorly contextualized tools, advocating for solutions that truly aid in detection and response.

1. AI Security as Workload Security: For AI workloads running on cloud infrastructure, treat them as any other workload. Existing CNAPP capabilities for posture checks and runtime detection should apply. However, consider specialized approaches (proxies, hooks) for AI interactions outside this traditional model, such as SaaS-based AI services.

Key Takeaways

• Cloud security has evolved through distinct eras: From the "Wild West" of early container and posture tools to the current "CNAPP consolidation" and "competing with blue logos" phases, understanding this history explains current tool architectures.
• CNAPP consolidation created feature-rich but often disjointed tools: The drive to bundle every cloud security feature led to platforms that can be difficult for different security personas (AppSec, CloudSec, SecOps) to use effectively, generating overwhelming alert volumes without sufficient context.
• Effective tool selection requires deep self-understanding: Organizations must first define their architecture, budget, and priorities, and establish clear remediation strategies for vulnerabilities, misconfigurations, and runtime alerts before purchasing any cloud security tool.
• Emerging features like Code-to-Cloud and CADR are crucial for advanced defense: The ability to link deployed assets to source code and gain deep application-layer runtime visibility (CADR) are key to addressing root causes and detecting sophisticated attacks.
• Preventative controls are powerful but complex to implement: Service Control Policies (SCPs) and Permission Boundaries are vital for setting guardrails, but their implementation requires careful planning and testing to avoid disrupting operations.
• AI security largely aligns with existing cloud security principles for workloads: For AI running on cloud infrastructure, existing CNAPP posture and runtime capabilities are often sufficient, though specialized approaches may be needed for external or SaaS-based AI interactions.

About the Speaker(s)

James Berthoty is the founder of Lacatio, a practitioner-focused analyst firm dedicated to explaining the actual capabilities of security tools, moving beyond abstract market quadrants. With a decade of hands-on experience, James has worked across various domains including security operations, cloud security, and application security. His background as a practitioner deeply informs his perspective on the practical challenges and solutions in the security landscape, making his insights particularly relevant for those on the front lines of cloud defense.