Home Cloud SecurityNova Cloud-Native Application Protection Platform (CNAPP)

Cloud security

CNAPP capabilities in Nova

Understand cloud risk. Carry it into detection and response.

A Cloud-Native Application Protection Platform, or CNAPP, brings cloud security capabilities together across applications, infrastructure, identities, data, and workloads. Nova addresses these needs through cloud asset inventory, Cloud Security Posture Management, external exposure, attack-path analysis, cloud data context, code and workload security checks, compliance evidence, and cloud threat detection. Nova then connects that cloud context to SecOps investigation and governed response through its broader ACDP.

Request a private demo Review the CNAPP workflow

Nova Cloud-Native Application Protection Platform (CNAPP) A Cloud-Native Application Protection Platform, or CNAPP, brings cloud security capabilities together across applications, infrastructure, identities, data, and workloads. Nova addresses these needs through cloud asset inventory, Cloud Security Posture Management, external exposure, attack-path analysis, cloud data context, code and workload security checks, compliance evidence, and cloud threat detection. Nova then connects that cloud context to SecOps investigation and governed response through its broader ACDP.

External exposureReachable serviceObserved

Identity reachAccess relationshipEvidence checked

Protected resourcePotential impactPrioritize review

Evidence available Coverage partial Owner required

A list of cloud findings is not enough to explain business risk

Cloud teams need to know which resource is affected, how it is exposed, which identities can reach it, what data or workload may be involved, and whether active security signals increase the urgency. Nova keeps those relationships and the available evidence together, while showing where collection or assessment coverage is incomplete.

Cloud risk path

Inventory
Exposure
Priority

Asset inventory and security posture

Establish the cloud scope before interpreting the findings.

Review supported accounts, subscriptions, projects, regions, services, and resources alongside collection status and evidence freshness. CSPM checks show configuration and control findings while incomplete or unavailable assessments remain visibly different from a passing result.

Explore Cloud Security Posture Management

Establish the cloud scope before interpreting the findings. Review supported accounts, subscriptions, projects, regions, services, and resources alongside collection status and evidence freshness. CSPM checks show configuration and control findings while incomplete or unavailable assessments remain visibly different from a passing result.

Expected sources

Cloud activityConnected

Identity activityConnected

Endpoint signalsEvidence delayed

Evidence scopeFreshness + scopeSource-aware

Coverage posture

ObservedEvidence current

GapDecision limited

Exposure and attack paths

Find the combinations that create a reachable path to important resources.

Connect external exposure, configuration findings, access relationships, identities, and affected resources. The resulting path helps teams decide which weakness deserves attention first without presenting a possible route as proof of compromise.

Explore attack surface management

Find the combinations that create a reachable path to important resources. Connect external exposure, configuration findings, access relationships, identities, and affected resources. The resulting path helps teams decide which weakness deserves attention first without presenting a possible route as proof of compromise.

External exposureReachable serviceObserved

Identity reachAccess relationshipEvidence checked

Protected resourcePotential impactPrioritize review

Evidence available Coverage partial Owner required

Code, workload and data context

Review supported security evidence before and after a cloud change.

Nova can evaluate supported infrastructure definitions and Kubernetes admission requests against available controls, then connect running cloud resources with data exposure, ownership, policy, and related findings. Exact coverage depends on the connected source and supported asset type.

Explore cloud data security

Review supported security evidence before and after a cloud change. Nova can evaluate supported infrastructure definitions and Kubernetes admission requests against available controls, then connect running cloud resources with data exposure, ownership, policy, and related findings. Exact coverage depends on the connected source and supported asset type.

01Change inputInspect the proposed configuration

Check infrastructure definitions and Kubernetes admission requests before the proposed change is applied.

Customer scope kept separate

02Policy evidenceEvaluate against supported controls

Review the affected resource, the failed security check, the evaluation mode and the available evidence.

Result explained

03Controlled decisionReview what should proceed

Distinguish allowed changes, blocked changes, evaluation failures and audit-only results.

Your team decides

Security outcomeCloud changes reach review with policy evidence already attached.

Cloud detection and response

Carry cloud context into the SOC case instead of stopping at posture.

Related alerts, unusual behavior, threat intelligence, and event activity can change the priority of a cloud finding. Nova carries the affected assets and evidence into investigation, then coordinates supported response actions through the policies and approvals configured for the organization.

Explore cloud threat detection and response

Carry cloud context into the SOC case instead of stopping at posture. Related alerts, unusual behavior, threat intelligence, and event activity can change the priority of a cloud finding. Nova carries the affected assets and evidence into investigation, then coordinates supported response actions through the policies and approvals configured for the organization.

Observed sequence

Observed activityControl-plane change

Behavior changeOutside recent baseline

Related evidenceSource events

Assessment

KnownActor and action observed

UnknownBusiness intent

ConflictCoverage is incomplete

Analyst next stepCheck who acted, which systems were affected and whether the change was expected.Evidence ready for review

CNAPP workflow in Nova

Turn cloud security evidence into prioritized, accountable work.

Inventory

Identify the supported cloud resources and the source, account, region, service, and ownership context available for each one.

Assess

Review configuration, control, data, code, workload, and compliance evidence within the supported scope.

Connect

Relate findings to exposure, identities, attack paths, affected assets, and active security signals.

Prioritize

Focus remediation and investigation on the combinations with the clearest reachable impact and strongest evidence.

Act

Assign remediation or prepare a supported response action under the organization's access and approval rules.

Nova CNAPP capabilities

Evaluate the cloud security coverage your environment requires.

CSPM

Cloud Security Posture Management

Assess supported configurations and controls while keeping assessment coverage visible.

ASM

Attack surface and attack paths

Connect external exposure and access relationships to the resources they may place at risk.

DATA

Cloud data security context

Review available data exposure, access, ownership, policy, and resource evidence together.

CDR

Cloud detection and response

Connect cloud risk to active signals, investigation, and supported response workflows.

FAQ

Questions about Nova Cloud-Native Application Protection Platform (CNAPP).

What is a Cloud-Native Application Protection Platform?

A Cloud-Native Application Protection Platform, or CNAPP, brings cloud security capabilities together across applications, infrastructure, identities, data, and workloads. A CNAPP evaluation should confirm the exact asset, posture, exposure, code, workload, data, compliance, and threat coverage needed for the customer environment.

Is Nova a CNAPP?

Nova includes CNAPP capabilities for cloud asset inventory, Cloud Security Posture Management, external exposure, attack paths, cloud data context, supported code and workload checks, compliance evidence, and cloud threat detection. Nova is positioned as an ACDP because it carries that cloud context into SecOps prioritization, investigation, autonomous analysis, detection improvement, and governed response.

What is cloud security posture management?

Cloud security posture management evaluates configuration and control evidence across supported environments. Nova shows what was assessed, what failed and where evidence is missing, so an incomplete assessment does not appear as a pass.

How does Nova prioritize cloud risk?

Nova can relate findings to affected assets, exposure, identities, attack paths, active security signals and evidence quality. The available factors depend on the connected sources and are kept visible for review.

What does Nova include in cloud asset inventory?

For supported sources, Nova presents the available resource identity, provider, account, region and service context. It can also connect exposure, posture findings, ownership and related evidence when those records are available.

What cloud data security context does Nova provide?

For supported data assets, Nova connects resource identity with the available exposure, access review, policy, ownership and related cloud risk evidence.

Does Nova certify that an organization is compliant?

No. Nova can organize supported control mappings and evidence, including missing and not assessed states. It does not replace an independent auditor, legal advice or a formal certification decision.

Which cloud environments and security systems can Nova connect?

Nova has evaluated connections across AWS, Microsoft Azure, Google Cloud, Kubernetes and supported identity, endpoint, software service, intelligence, ticketing and response systems. The available evidence and action set varies by connection and is confirmed for each customer environment.

Is every Nova capability available in every deployment?

No. Available features depend on your subscription, enabled modules, connected systems, and user permissions. Hansec confirms what is included and any relevant regional limits before onboarding.

Evaluate Nova

See how Nova fits your cloud security workflow.

In a private briefing, we will map Nova to your stack, confirm what connects and focus the evaluation on the outcome your team cares about.

Request a private demo