Security Platforms Explained by Mechanism: CNAPP, SASE, Bot Management, AI Firewalls, DSPM and EDR

Security interviews increasingly include "you use product X; how does it actually work?" The strong answer names the mechanism, what it can see, what it enforces, and where it is blind. Vendor names change through acquisitions (Google completed its purchase of Wiz in March 2026; Palo Alto Networks folded Protect AI into Prisma AIRS in 2025); the mechanisms do not.

Cloud security (CNAPP)

Posture comes from read-only API access; workload contents come from snapshots read outside the machine. The value is in joining them into attack paths: exposed VM plus exploitable bug plus a role that reads customer data. The scanner's own permissions make it a crown jewel. Full answer: how agentless cloud scanning works.

SASE and SSE

A provider's edge runs a secure web gateway, CASB, inline DLP and ZTNA close to users. You gain consistent policy anywhere; you hand the provider decrypted traffic, your inspection CA and an availability dependency. Pinned apps and privacy categories need deliberate bypasses. Full answer: SASE and SSE explained.

Bot management

Signals stack from cheap to fake (IP reputation) to expensive to fake (behaviour across a session), with JA4 TLS fingerprints and client-side checks in between. Legitimate agents can now prove identity with signed requests. Business rules such as purchase limits still belong in the application. Full answer: how bot management works, and for verified agents, how websites verify AI agents.

AI security platforms

Five jobs under one logo: discovery, model scanning, runtime prompt and response inspection, automated red teaming and agent controls. Evaluate each on your own data, especially the runtime filter, which is a classifier with error rates, not a boundary. Full answer: evaluating an AI security platform.

Data security (DSPM and DLP)

Discovery and validated classification first, then access mapping, minimisation and de-identification, then DLP at egress, then AI ingestion with labels that travel into the index. Full answer: the data security toolchain.

EDR

A privileged sensor turns operating-system events into local blocks and cloud analytics. The July 2024 CrowdStrike outage showed the cost of that privilege when content updates are not staged. Full answer: how EDR works and the 2024 outage.

Buying and running them

Every one of these platforms is privileged: the cloud scanner can read every disk, the SASE provider sees decrypted traffic, the EDR sensor runs in the kernel, and the AI firewall reads every prompt. Treat them as critical third parties. Ask where your data is processed and stored, how updates to detection content are staged, what happens when the service is unavailable, and how you export its logs. Evaluate on your own data rather than vendor demos, and assign an owner who reviews what each platform found each quarter. Consolidation is also a risk to plan for: products are merged, renamed or retired after acquisitions, so check the roadmap and contract terms before committing.

The interview pattern

For any platform, answer four questions in order: where does it sit, what can it see from there, what can it enforce, and what is it blind to. Then say which control elsewhere covers the blind spot. That structure works for products you have never used.