Should you build or buy Cloud-Native Application Protection Platform (CNAPP)?
Cloud-Native Application Protection Platform (CNAPP) software unifies cloud security posture management, workload scanning, identity risk, and runtime threat detection into one platform with a correlated view of attack paths across multi-cloud environments. Buyers are security and platform teams who need prioritized findings, not another disconnected dashboard.
Buy a CNAPP for unified visibility and prioritization across clouds, tested in a proof of concept on coverage, data freshness and remediation workflow rather than on which vendor has a graph. Keep Checkov, Trivy and policy-as-code in CI where they already live, and contract Wiz post-acquisition with renewal protections and explicit multicloud terms.
Build it, buy it, or bridge?
When building makes sense
Building cloud security posture management piece by piece is a real, documented pattern for narrow slices. HBO Max and Capital One both run Cloud Custodian in production for policy-as-code and automated remediation. Prowler, Steampipe, Trivy, Falco, Checkov, and Cartography each cover one function: posture checks, image scanning, runtime detection, or asset graphing. Teams with strong platform engineering can assemble them into a working pipeline, but no independent team has documented joining those tools into a correlated attack-path graph, cloud infrastructure entitlement management, and runtime coverage that behaves like a single product across multiple clouds. That correlation and prioritization work is where the real engineering cost sits, and a modeled three-year build runs $514k-$1.06m against a licensed CNAPP with operation included, no cost advantage to offset the integration risk.
When buying makes sense
Buying a CNAPP is the stronger case here because cloud security posture is an obligation you carry everywhere, not a place to compete. Wiz, Orca, Prisma Cloud, CrowdStrike Falcon Cloud Security, and Microsoft Defender for Cloud all ship agentless scanning, attack-path graphs, cloud infrastructure entitlement management, and runtime detection as one correlated product, so the vendor choice comes down to fit and terms rather than a unique capability. Vendr's procurement data puts Wiz's median annual spend well into six figures, in the same range as the modeled cost of assembling and maintaining the open-source equivalent yourself. Run a proof of concept scored on coverage, data freshness, and remediation workflow rather than whichever vendor has the flashiest graph, keep Checkov and Trivy in your CI pipeline where they already do useful work, and negotiate Wiz's post-Google-acquisition contract with explicit multicloud commitments, since Google's pledge to keep Wiz working across AWS, Azure and Oracle Cloud is a voluntary commitment, not a term regulators imposed.
The desk read
Build-versus-buy analysis for Cloud-Native Application Protection Platform (CNAPP) is being written. In the meantime, the framework that drives every B4 call is on the B4 Index page.
Frequently asked
Can you build a CNAPP with open-source tools?
You can cover individual functions. Cloud Custodian handles policy-as-code, Falco handles runtime detection, and Trivy handles image scanning, and HBO Max and Capital One run pieces of this in production. No team has documented joining them into one correlated attack-path graph, which is where the real engineering cost sits.
How much does a CNAPP cost?
Vendr's procurement data puts Wiz's median annual spend at $154,381; other platforms price lower or higher depending on scope and workload count. A modeled three-year build of the open-source equivalent runs $514k to $1.06 million once integration and maintenance are counted, in the same range as licensing a platform.
What are the main CNAPP vendors?
Representative vendors include Orca Cloud Security Platform, Wiz. B4 Pro includes the category score and the full vendor list.
Does Google's acquisition of Wiz change the buy case?
The acquisition closed March 11, 2026. Google says Wiz will keep working across AWS, Azure, and Oracle Cloud, not just Google Cloud, so multicloud availability is a vendor commitment rather than a change forced by the deal's terms. Negotiate multicloud commitments explicitly in the contract regardless.