#455 - CNAPP and the Cloud Identity Problem with Mike Small

<p>Most cloud security incidents trace back to the customer, and most of those trace back to identity. Jeff and Jim sit down with Mike Small, Senior Analyst at KuppingerCole, to unpack Cloud Native Application Protection Platforms (CNAPP) and why identity practitioners should care. Mike explains how identity controls in the cloud have become data defined in code, why ephemeral workloads break traditional scan-then-deploy security, and how CNAPP evolved from static configuration analysis into runtime monitoring and SOC integration. The conversation covers the shared responsibility model, SOC 2 attestations and complementary user entity controls, multi-cloud complexity, and why standards matter for portability and sovereignty. Mike also looks at CNAPP as a security plane for AI, agents as another layer of non-human identity, recent market consolidation, and the cloud as national critical infrastructure. Plus, a detour into amateur radio, Morse code exams, and low-power QRP contacts across the Atlantic.</p><p><br></p><p><br></p><p>Connect with Mike: https://www.linkedin.com/in/mikesmall01/</p><p><br></p><p>AI Identity and Agentic Trust: https://www.kuppingercole.com/blog/small/ai-identity-and-agentic-trust</p><p><br></p><p>Mike&#39;s other writing for KuppingerCole: https://www.kuppingercole.com/people/small</p><p><br></p><p>Connect with us on LinkedIn:</p><p><br></p><p>Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/</p><p><br></p><p>Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/</p><p><br></p><p>Visit the show on the web at http://idacpodcast.com</p><p><br></p><p><br></p><p>00:00 Welcome and fall conference season</p><p>02:52 Introducing Mike Small</p><p>03:19 From engineer to identity software to analyst</p><p>05:07 What is CNAPP and why should IAM care?</p><p>07:21 Most cloud incidents are the customer&#39;s fault</p><p>11:00 Identity controls in the cloud are data</p><p>15:17 Static configuration analysis vs. runtime monitoring</p><p>19:34 Is CNAPP a product or a platform?</p><p>21:07 CSPM, CWPP, CIEM, KSPM and CNAPP capabilities</p><p>23:12 The shared responsibility model</p><p>27:46 Who defines secure? SOC 2 and complementary user entity controls</p><p>31:40 Multi-cloud and the case for standards</p><p>35:18 CNAPP as the security plane for AI</p><p>40:48 Where the CNAPP market heads next</p><p>44:34 Acquisitions and consolidation in cloud security</p><p>46:50 The cloud as national critical infrastructure</p><p>50:08 How sovereign is