#455 - CNAPP and the Cloud Identity Problem with Mike Small
Source: YouTube · Identity at the Center · published Oct 19, 2026 · 1:07:54
BLUF: Cloud-native application protection platforms (CNAP) are essential for securing cloud environments because the majority of security incidents result from customer-side identity and configuration failures rather than provider vulnerabilities 07:30.
Key Takeaways:
• CNAP consolidates various security tools into a single platform to manage the complexity of cloud infrastructure, addressing issues like misconfigurations that lead to breaches 05:55.
• Most cloud security failures are due to weak identity controls, such as lack of multi-factor authentication or excessive permissions, rather than flaws in the cloud provider's infrastructure 08:20.
• The rise of AI introduces new security challenges, particularly regarding non-human identities and agent access permissions, making CNAP increasingly critical for managing these risks 35:30.
• Standards are vital for preventing vendor lock-in and ensuring interoperability, but they currently lag behind the rapid evolution of cloud and AI technologies 32:30.
• Cloud infrastructure has become part of national critical infrastructure, requiring robust security measures and sovereign control over data and operations 47:50.
Closing Statement:
As cloud services become deeply embedded in global infrastructure, adopting CNAP solutions is no longer optional but a necessity for mitigating identity-based risks and ensuring operational resilience.
Sources:
- 07:30 Discussion on the shared responsibility model and customer fault in cloud incidents.
- 05:55 Definition and purpose of Cloud-Native Application Protection Platforms (CNAP).
- 35:30 Impact of AI on identity management and the need for CNAP.
- 32:30 The role of standards in cloud interoperability and avoiding vendor lock-in.
- 47:50 Cloud infrastructure as part of national critical infrastructure.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
This is Identity at the Center. [music] >> Welcome to the Identity at the Center podcast. I'm Jeff and that's Jim. Hey Jim. >> Hey Jeff. How are you? >> Oh, not so bad. Yourself? >> Uh, well, you almost forgot the the [laughter] part >> I did. >> It's been a while since sometimes. I was expecting that. You know, I this [clears throat] gives me a little thing. We put that little AI chatbot on our website and somebody at put a question in asking how does Jim or Jeff typically respond when they say how are you and it didn't get it right but that's probably an Easter egg. >> Okay. Well, maybe that's what threw you off. Maybe you got the chatbot living in your brain now. >> I do. I've spent a lot of time on that thing trying to get it right and I'm I think it's like 75% of the way there [snorts…