#455 - CNAPP and the Cloud Identity Problem with Mike Small

Most cloud security incidents trace back to the customer, and most of those trace back to identity. Jeff and Jim sit down with Mike Small, Senior Analyst at KuppingerCole, to unpack Cloud Native Application Protection Platforms (CNAPP) and why identity practitioners should care. Mike explains how identity controls in the cloud have become data defined in code, why ephemeral workloads break traditional scan-then-deploy security, and how CNAPP evolved from static configuration analysis into runtime monitoring and SOC integration. The conversation covers the shared responsibility model, SOC 2 attestations and complementary user entity controls, multi-cloud complexity, and why standards matter for portability and sovereignty. Mike also looks at CNAPP as a security plane for AI, agents as another layer of non-human identity, recent market consolidation, and the cloud as national critical infrastructure. Plus, a detour into amateur radio, Morse code exams, and low-power QRP contacts across the Atlantic.

Connect with Mike: https://www.linkedin.com/in/mikesmall01/

AI Identity and Agentic Trust: https://www.kuppingercole.com/blog/small/ai-identity-and-agentic-trust

Mike's other writing for KuppingerCole: https://www.kuppingercole.com/people/small

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Welcome and fall conference season

02:52 Introducing Mike Small

03:19 From engineer to identity software to analyst

05:07 What is CNAPP and why should IAM care?

07:21 Most cloud incidents are the customer's fault

11:00 Identity controls in the cloud are data

15:17 Static configuration analysis vs. runtime monitoring

19:34 Is CNAPP a product or a platform?

21:07 CSPM, CWPP, CIEM, KSPM and CNAPP capabilities

23:12 The shared responsibility model

27:46 Who defines secure? SOC 2 and complementary user entity controls

31:40 Multi-cloud and the case for standards

35:18 CNAPP as the security plane for AI

40:48 Where the CNAPP market heads next

44:34 Acquisitions and consolidation in cloud security

46:50 The cloud as national critical infrastructure

50:08 How sovereign is a sovereign cloud?

53:12 MCP and the speed of AI standards

53:39 Mike's passion for amateur radio

1:05:20 The CNAPP elevator pitch

1:06:14 Wrap up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Mike Small, KuppingerCole, CNAPP, Cloud Native Application Protection Platform, cloud security, CIEM, cloud infrastructure entitlement management, CSPM, CWPP, KSPM, shared responsibility model, least privilege, misconfiguration, runtime monitoring, SOC 2, complementary user entity controls, multi-cloud, non-human identity, NHI, AI agents, agentic AI, MCP, sovereign cloud, critical infrastructure, identity standards, MFA, amateur radio, IAM, identity and access management