Lesson 6 of 6 · 4 min read
Modern Security Platforms: Code, Cloud and Security Operations
In this lesson
TL;DR: Modern security platforms observe different parts of a system and exercise different authority. Map the asset, evidence source, enforcement point and owner before deciding which product category addresses the risk.
Before you read
Pick an answer before you read further. The lesson below explains it, and guessing first, right or wrong, helps the explanation stay with you.
1Can a SIEM finding, a CIEM permission graph and a DSPM label all prove that a particular file was read?
Start with the security decision
A security stack protects code, delivery systems, cloud resources, identities, data and running workloads. Product categories help describe those jobs, but vendors often cover several categories and use different boundaries. A logo under a category is a starting point for evaluation, not a guarantee of every capability.
For each decision, ask what asset is at risk, which actor can reach it, what the tool actually observes and which component enforces a repair or block. Keep prevention, detection and containment separate. A posture finding can identify a dangerous configuration without proving that it was exploited; a runtime alert can identify activity without proving that the effect was prevented.
- 1
1 · Code and delivery
- Source, dependencies, secrets, build identities and deployment plans.
becomes deployed state - 2
2 · Cloud and data posture
- Configuration, entitlements, data sensitivity and external exposure.
creates observable activity - 3
3 · Running workloads
- Host and container events, supported enforcement and sensor health.
requires evidence and authority - 4
4 · Security operations
- Normalized events, intelligence, investigation and authorized response.
Code and delivery
Source, dependencies, secrets, build identities and deployment plans.
Code and software delivery
| Category | What to learn | Dated product examples |
|---|---|---|
| ASPM | Application inventory, finding correlation, ownership and verified repairs | OX Security, Cycode, Apiiro |
| Code scanning | SAST input-to-operation analysis and authorized dynamic assessment | GitHub code scanning and CodeQL |
| SCA | Dependency identity, advisory applicability and reachability limits | Snyk and platform integrations |
| Pipeline security | Trigger, runner, token and promotion authority | Cycode and OX development integrations |
| Secret scanning | Detection, revocation, derived access and historical copies | GitHub, GitGuardian, Spectral, Checkov/Bridgecrew lineage |
| IaC scanning | Source templates, resolved plans and runtime drift | Checkov/Bridgecrew lineage, Snyk IaC |
The linked concepts contain primary product references checked November 2026. A scanner result needs a revision or artifact identity and coverage statement. The first applied path is Operate Application Security From Code to Deployment.
Cloud, identity and data
| Category | Evidence and boundary | Dated product examples |
|---|---|---|
| CSPM | Observed configuration and public-access paths | Orca, Aqua, Prisma/Cortex Cloud, Lacework/FortiCNAPP |
| CNAPP | A connected platform of cloud assessment and protection capabilities | Orca, Aqua, Palo Alto Networks, Fortinet, Upwind |
| CIEM | Effective cloud authority and usage evidence | Sonrai, Ermetic/Tenable Cloud Security, historical CloudKnox |
| DSPM | Data discovery, classification and exposure | Cyera, Sentra, Laminar/Rubrik, Polar/IBM |
| External exposure | Outside-in discovery, ownership and reachable assets | Censys, CyCognito, Qualys, Tenable, Rapid7 |
| Vulnerability assessment | Assessment depth, applicability and verified remediation | Qualys VMDR, Tenable, Rapid7 InsightVM; scoped endpoint inventory |
| AI-SPM | AI services linked to data, identities and tool effects | Verify actual AI asset discovery and posture scope |
CIEM is not SIEM. Cloud entitlement analysis answers what a principal may be able to do. A security event system handles observations of activity. Suspicious access to personal data requires both those views and supported data classification. A permission graph alone does not establish a disclosure count.
Use Review Cloud Exposure, Identity and Data Security to apply the categories. It includes compliance reporting and M&A integration, where incomplete inventory and premature trust create practical risk.
Runtime and security operations
| Category | Evidence and control | Dated product examples |
|---|---|---|
| CWPP and sensors | Host/workload assessment, supported events and enforcement | Upwind, Sysdig, Aqua, CrowdStrike |
| Container and Kubernetes security | Image identity, admission, workload grants and runtime evidence | Sysdig, Aqua, StackRox/Red Hat Advanced Cluster Security |
| CDR | Cloud identity, control-plane, data-plane and runtime investigation | Amazon GuardDuty, CrowdStrike, SentinelOne, Lacework/Fortinet |
| EDR and XDR | Endpoint observations and cross-domain correlations | CrowdStrike, SentinelOne |
| SIEM | Connectors, normalized events, rule windows and evidence | Google SecOps, Elastic Security |
| SOAR | Enrichment, scoped approval, response and reconciliation | Google SecOps SOAR and response integrations |
| Threat intelligence | Provenance, confidence, sharing and local corroboration | MISP, OpenCTI, Google Threat Intelligence, SpyCloud |
| YARA and retrohunting | Content rules and bounded historical searches | VirusTotal Livehunt and Retrohunt |
| Malware scanning | Analysis limits and sample confidentiality | Approved local analysis and distinct private-service workflows |
Study Build Security Operations From Events to Response, then apply the CRAFTY FALCON case. The name is a threat-actor designation in the cited CERT-In advisory, not a single vulnerability.
Read vendor names with their lifecycle
The linked primary references distinguish historical names from current product families. Bridgecrew joined Palo Alto Networks; Spectral joined Check Point; StackRox technology is associated with Red Hat Advanced Cluster Security; Ermetic joined Tenable; Laminar joined Rubrik; Polar joined IBM; Lacework joined Fortinet. CloudKnox is historical lineage, and the linked Microsoft notice records retirement of Entra Permissions Management. Check current documentation before procurement or deployment.
This map is a learning route, not a ranking or a claim about a company's interview questions. Evaluate products using the same owned or explicitly authorized synthetic scenario, including missing collection, stale evidence and failed response. Keep the resulting coverage and authority limits visible.
Check yourself
Say or write your answer first, then reveal. Explaining it from memory, in your own words, is the skill an interviewer is checking.
1How do you evaluate a product spanning several categories?
2What should a learner produce after the three courses?