The backlog is the symptom, not the problem
A mid-size multicloud estate produces tens of thousands of posture findings within the first week of onboarding. The instinctive response is to filter by severity, which replaces one arbitrary queue with a smaller arbitrary queue: severity is assigned by the check author, without knowledge of network reachability, identity entitlements or data sensitivity in the specific environment.
The result is an operation that closes findings without reducing exposure. Teams remediate public storage misconfigurations on empty development buckets while a privileged role attached to an internet-facing compute instance remains untouched, because no single check describes that combination.
An entity graph is the minimum viable architecture
Attack path analysis requires four entity classes resolved to authoritative keys: identities and their effective entitlements, workloads and their software inventory, network reachability including load balancers and peering, and data stores with classification. Any of these missing turns the graph into a guess.
Effective entitlement is the hardest input and the most valuable. Policy documents describe intent; effective permission is the result of policy evaluation across inheritance, boundaries, conditions and trust relationships. A CNAPP that reads policies without evaluating them will systematically underestimate privilege escalation paths.
- Asset keys derived from the provider inventory, never from hostname or IP
- Effective permissions computed, not inferred from attached policy names
- Reachability qualified through actual routing, security groups and edge configuration
- Data classification joined to the storage object, not to the account
Reachability is what converts a finding into an exposure
A vulnerable package in a container image is a defect. The same package in a running workload, exposed through an ingress with no authentication, holding a role that can read a production database, is an exposure with a defined blast radius. The distinction is not semantic: it changes the owner, the deadline and the compensating control.
Reachability qualification is also the only defensible way to suppress noise. Downgrading a finding because a bucket has no network path and no external principal is a structural justification with evidence attached, which survives audit review. Silencing rules do not.
Scoring that a business owner can defend
Prioritization must produce a ranking that a service owner can accept without a security translator in the room. In practice this means the score is a product of exploitability, reach and asset value, where every factor is traceable to a source the owner already trusts: the CMDB tier, the data classification, the exposure state of the ingress.
Scores that cannot be decomposed are rejected in the second meeting. Publish the factors alongside the number, and allow the owner to challenge the input rather than the verdict.
- Exploitability from exploit intelligence and validated path evidence
- Reach from graph traversal, capped at documented trust boundaries
- Asset value from business service criticality, not from tags applied ad hoc
- Compensating controls applied as explicit reductions with expiry dates
Acceptance criteria for a CNAPP deployment
A CNAPP program should be accepted against outcomes measured in the customer's own environment, over a defined window, with the baseline captured before onboarding. Vendor benchmarks are not evidence.
- Inventory completeness: at least 98% of provider resources matched to an owner
- Path fidelity: 100% of top-ranked paths reproducible on demand with evidence
- Queue convergence: top-priority queue closes faster than it refills for six consecutive weeks
- Noise justification: every suppressed finding carries a structural reason and a review date
- Time to owner: median under 15 minutes from detection to notified accountable team