Cloud Workload Protection and Automation
Domain 5 covers the workload layer: images, containers, Kubernetes and serverless functions, plus the automation that lets findings act instead of accumulating.
What is protected
- Images and registries: container images and VM images scanned for vulnerabilities, malware and embedded secrets, both in the CI pipeline and in the registry (ECR, ACR, GCR).
- Runtime: admission control for Kubernetes so a pod referencing a non-compliant image is rejected at deploy time, and runtime policies for container and function behaviour.
- Agentless scanning: snapshot-based inspection of existing VM fleets and images, giving vulnerability and malware coverage without installing an agent on every instance. It is periodic, not inline; it requires read permissions for snapshots and volumes.
Shift-left and gating
The value comes from blocking, not reporting. A pipeline step queries the platform after an image push, and the build fails if the image violates the assurance policy - for example any critical CVE with a fix available, or an image from an untrusted registry. The same policy enforced at admission keeps the cluster consistent with what the pipeline allowed.
Automation surfaces
CloudGuard exposes management APIs and a Terraform provider, and integrates with chat and ticketing tools, so onboarding, policy changes and remediation can be code-reviewed rather than clicked. Auto-remediation closes the loop for repeatable findings; webhooks push new findings into the team's existing workflow.
Worked example
A team builds an image, pushes it to a registry, and deploys with Kubernetes. They configure an assurance policy forbidding critical vulnerabilities with available fixes and untrusted base images. The pipeline queries the API after the push and fails the build, so the bad image never reaches the registry tag used by production. Admission control rejects any pod that references a violating tag, catching manual deploys. Agentless scanning then covers the older VM fleet that has no agent, on its scheduled cycle. Note that the agentless scan would not have blocked the original deploy - that is the pipeline and admission control's job.
Traps that cost marks
- Assuming agentless scanning provides real-time blocking; it is scheduled and snapshot-based.
- Relying on runtime scanning alone and letting vulnerable images into the registry in the first place.
- Forgetting that the scanning role needs snapshot and volume read permissions.
- Confusing web application firewall capability with workload protection.