This article is based on a Palo Alto Networks announcement originally published on Security Boulevard in March 2020, covering a Prisma Cloud platform release.
Overview
Palo Alto Networks announced a significant update to Prisma Cloud, its Cloud Native Security Platform (CNSP), in early 2020. The release targeted both DevOps and SecOps teams, adding shift-left security capabilities, centralized CI/CD policy management, Amazon Machine Image (AMI) scanning, and one-click serverless protection. The overarching goal was to unify previously siloed development and security teams under a DevSecOps model that spans the entire application lifecycle—from infrastructure code authoring through production workload monitoring.
The Security Challenge in Cloud Native Environments
Modern developer-led organizations move fast, relying on containers, serverless functions, and infrastructure as code (IaC) templates to build and scale applications. This velocity introduces compounding security risks:
- Sprawling cloud footprints: Multiple clouds and accounts increase the attack surface and the number of entities that must be monitored.
- Insecure IaC templates: According to the Palo Alto Networks Unit 42 Cloud Threat Report (Spring 2020), nearly 200,000 insecure IaC templates were found in active use across organizations globally. Misconfigurations baked into templates propagate at the speed of automation.
- Abstraction layers: Containers, orchestrators, and serverless runtimes each add layers of abstraction, making traditional perimeter-based security insufficient.
- Fragmented tooling: Disparate security controls across applications, data, and infrastructure create visibility gaps and inconsistent enforcement.
Addressing these challenges requires security to be embedded at every phase of the software delivery pipeline—not bolted on after deployment.
What Is a Cloud Native Security Platform (CNSP)?
A CNSP converges two previously distinct categories of cloud security tooling:
- Cloud Security Posture Management (CSPM): Continuously monitors cloud configurations, detects misconfigurations, and enforces compliance against standards such as CIS Benchmarks, PCI-DSS, and HIPAA.
- Cloud Workload Protection Platform (CWPP): Protects the runtime of VMs, containers, and serverless functions—covering vulnerability management, behavioral protection, and runtime defense.
By converging CSPM and CWPP in a single platform, security teams can manage risk from code commit through production workload, without switching between multiple consoles or reconciling inconsistent data.
Palo Alto Networks cited a Gartner analysis (as of early 2020) recognizing the company as one of three vendors actively converging CWPP and CSPM capabilities across development and production environments, including container and serverless protection.
Key Features in This Release
1. Shift-Left Security: IaC Scanning
Prisma Cloud introduced the ability to scan IaC templates before they are deployed, using both out-of-the-box and customizable policies. This catches insecure configurations at the point of authoring rather than at runtime.
Supported integration points at release included:
- IDE plugins: IntelliJ, VS Code
- Source Control Management (SCM): GitHub
- CI/CD pipelines: AWS CodePipeline, Azure DevOps, CircleCI, GitLab, Jenkins
Additional plugins (GitLab, Bitbucket) were announced as coming soon at the time of publication.
2. Central CI/CD Policy Management
Teams can now define vulnerability and compliance policies for CI and CD workflows directly from the Prisma Cloud dashboard. This centralization means:
- IaC policies can be authored and reviewed in a single location.
- Out-of-the-box policies cover CIS standards for AWS, Azure, and GCP.
- Policy enforcement is consistent across pipelines, reducing configuration drift between environments.
3. Amazon Machine Image (AMI) Scanning
Prisma Cloud extended its vulnerability management capabilities to cover Amazon Machine Images (AMIs), enabling teams to vet images for vulnerabilities and compliance violations before they are deployed as EC2 instances. This mirrors the scanning capability already available for container registries and serverless repositories, creating a consistent vulnerability management experience across workload types.
4. Automatic Serverless Protection for AWS Lambda
Building on Palo Alto Networks’ acquisition of PureSec (integrated in November 2019), this release added one-click automatic protection for AWS Lambda functions directly from the Prisma Cloud console. Previously, enabling serverless security required developers to manually instrument their function code with security wrappers—a friction point that slowed adoption.
With automatic protection enabled, all existing serverless security capabilities become available without code changes:
- Vulnerability management
- Behavioral protection
- Serverless Cloud Native Application Firewall (CNAF)
Customer Perspectives
Several enterprise teams shared their use cases at the time of the announcement:
“Being able to effectively identify and remediate vulnerabilities and misconfigurations before applications are released into production empowers our security and developer teams to innovate quickly—with the confidence that our business is compliant and our customers’ data is secure.”
Wiebe de Roos, CI/CD Consultant & Engineer, ABN AMRO
“Today, Prisma Cloud empowers our SOC to continuously monitor our cloud environments as well as provide forensic data for faster Incident Response. I am looking at Prisma Cloud’s Shift Left features to enable our security professionals to partner more closely with developers on security responsibilities, and ensure secure configurations in every phase of development.”
Xiaobo Long, SVP of Cloud Security, Citibank
“Prisma Cloud helps our company reach the concept of DevSecOps, where we assess security in every phase of development. If any vulnerability or flaw is discovered, we patch it before going into production. In a single pane of glass, we have everything under control.”
Nicola Mutti, Head of Security, Cuebiq
How These Features Support a DevSecOps Model
The features in this release map directly to the three core phases where security must be embedded in a DevSecOps pipeline:
| Phase | Prisma Cloud Capability | Outcome |
|---|---|---|
| Code & Build | IaC scanning (IDE, SCM, CI plugins) | Catch misconfigurations before commit or merge |
| Deploy | Central CI/CD policy management; AMI scanning | Gate deployments on vulnerability and compliance policy |
| Run | CSPM, CWPP, auto serverless protection | Continuous monitoring and runtime defense in production |
This lifecycle coverage means a single platform can enforce consistent security policy from the first line of infrastructure code through the running workload—closing the gap between what developers build and what security teams monitor.
Availability
At the time of the March 2020 announcement, general availability of the new features described above was expected by late April 2020. Readers should consult current Palo Alto Networks documentation for up-to-date feature availability and platform versions.
Getting Started with Cloud Native Security
For teams beginning their cloud native security journey, the core priorities are:
- Inventory your IaC templates and run an initial scan to identify existing misconfigurations before they reach production.
- Integrate IaC scanning into your CI pipeline so that policy violations block builds automatically rather than relying on manual review.
- Enable CSPM across all cloud accounts to establish a compliance baseline and detect configuration drift.
- Extend CWPP coverage to include not just containers but also VMs (via AMI scanning) and serverless functions.
- Centralize policy management so that development, operations, and security teams operate from the same set of rules.
This incremental approach aligns with the DevSecOps principle of embedding security at each stage rather than attempting to retrofit it after deployment.