Cloud Workload Security
Runtime protection for servers, virtual machines, containers and Kubernetes. Detection and response within the workload.
Where the module helps during an attack
Its primary role is protecting running workloads; configuration assessment reduces the paths attackers can use to enter the cloud.
| Area | Level |
|---|---|
| Reconnaissance | context |
| Initial access | additional protection |
| Execution and persistence | primary role |
| Escalation and lateral movement | additional protection |
| Impact | additional protection |
| Investigation and recovery | additional protection |
Two layers of cloud protection in one platform
Singularity Cloud Security is a cloud-native application protection platform (CNAPP). It combines protection for running workloads with cloud configuration assessment. Both share a console and data with the wider Singularity platform, allowing cloud alerts to be investigated alongside endpoint and identity events.
Scope can be tailored. Some organisations start with server and Kubernetes protection, others with account configuration visibility. The vendor lists support for AWS, Azure, GCP, private and hybrid clouds.
Cloud Native Security
Agentless assessment of configuration (CSPM), permissions (CIEM), infrastructure as code, secrets and container images.
Data and AI
Depending on licensing, protection for sensitive data in cloud storage (DSPM) and visibility into AI services and models (AI-SPM).
Workload protection without kernel modules
According to the vendor, the Cloud Workload Security agent uses eBPF and does not rely on operating system kernel modules. This reduces the risk of kernel or agent updates disrupting server operation.
The agent detects ransomware, cryptomining, fileless attacks, unexpected changes in running containers and lateral movement between workloads. According to policy, it terminates processes or quarantines files. Events are linked into Storyline and available for investigation in Singularity Data Lake.
- Linux and Windows servers and virtual machines, and Kubernetes, subject to current vendor support.
- Persistent and short-lived workloads, including containers.
- Automatic policy-based response or manual action by an analyst.
Configuration assessment focused on exploitable risks
Cloud Native Security connects to cloud accounts without agents or infrastructure changes. It continuously checks for misconfigurations, excessive permissions, repository secrets and container image vulnerabilities.
The vendor emphasises validation of exploitability. Its Offensive Security Engine simulates an external attacker's perspective, distinguishing verified attack paths from theoretical findings so teams can prioritise reachable risks.
- Infrastructure-as-code template checks in CI/CD.
- Discovery of secrets and verification of whether they remain active.
- A Kubernetes admission controller that can prevent vulnerable images from being deployed.
Who benefits from the module
Organisations running production systems in cloud or hybrid environments that need to connect security, operations and development.
- You lack visibility into publicly accessible or misconfigured cloud resources.
- Accounts and services have more permissions than they need.
- Secrets appear in code, templates or container images.
- You want to detect and stop attacks on running servers or containers, rather than find them later in logs.
Deployment and operation with APPSEC
We first scope cloud accounts, subscriptions, projects, workload types and owners. We then recommend agentless assessment, workload protection or both, and prepare a pilot with measurable criteria.
- Which cloud accounts and workload types are in scope, and how licensing is calculated.
- Supported Linux distributions, Windows and Kubernetes versions in your environment.
- Whether to integrate CI/CD and code repositories or start with the running environment.
- Who will remediate findings and how they enter your change process.
APPSEC
Scoping, pilot, account integration, agent deployment, baseline policies and support as agreed.
Vendor
The product, supported platforms, detection updates and product escalation under the vendor's terms.
Customer
Cloud account access, approval of permissions and policies, configuration fixes and application changes.
