Sweet Runtime CNAPP

Detects attacks at the application and API layer at runtime using behavioral signals such as unexpected process behavior, suspicious API calls, unusual service-to-service communication, and exploit activity across cloud apps, containers, and Kubernetes.

Correlates SaaS activity with identity events (MFA changes, session token replay, impossible travel) to detect account takeover within cloud application environments.

Instruments workload behavior at the kernel level via eBPF without a traditional user-space agent. Provides syscall-level visibility into process execution, network connections, and file access in running containers and VMs.

Monitors running pod and container behavior against policy, detecting unexpected process execution, network connections, and privilege escalation at runtime rather than at image scan time.

Continuously audits cloud and Kubernetes configuration across AWS, Azure, and GCP against security benchmarks, flagging misconfigurations and identity-permission gaps that create exploitable exposures.

Maps the effective access of human and machine identities to compute, storage and data resources across AWS, Azure and GCP as an access relationship graph, surfacing over-permissioned roles, unused permissions, cross-account trust and toxic combinations of administrator permissions, and remediating them toward least privilege, including automatic revocation of excessive roles.

Delivers scan results inside developer IDEs and pipeline stages so developers receive findings before code merges, reducing the cost and cycle time of remediation.

Discovers and classifies sensitive data in IaaS and PaaS stores such as object storage, databases, and data warehouses, surfacing data exposure risk alongside infrastructure findings.

Exports compliance evidence pre-mapped to framework control requirements (SOC 2, ISO 27001, PCI DSS), in formats auditors can consume directly: not raw CSV exports requiring manual assembly.

Correlates individual misconfigurations, CVEs and excessive entitlements into chained attack scenarios showing lateral movement paths from an exposed entry point to a target asset, visualized on the resource graph. Produces a prioritized list of attack paths rather than a flat CVE inventory. Products differ in whether they show only possible paths derived from posture data or also actual paths confirmed from runtime and log telemetry.

Assesses the configuration of Kubernetes clusters and managed orchestrators (EKS, AKS, GKE, ECS, Fargate, OpenShift) against best-practice templates, surfacing cluster misconfigurations, weak RBAC, exposed control planes and configuration drift, and driving their remediation. Distinct from runtime workload monitoring: this is the posture of the orchestrator itself.

Provides AI copilots or agents inside the platform that search product documentation, triage and investigate alerts with plain-language explanations, discover threats and indicators of attack from telemetry, and generate remediation steps, policies and playbooks. Products differ in which of these tasks the copilot performs and how much of the investigation it completes on its own.

Pushes findings into help-desk ticketing, SIEM and security analytics, SOAR, asset management and application security tools and pulls status back, so remediation ownership, closure and exceptions stay synchronized between the platform and the SOC or developer workflow instead of being re-keyed. Productized, bidirectional depth of these integrations varies across products.