Within this evolving market, KuppingerCole names Microsoft a Leader across all four of its Leadership categories: Overall, Product, Innovation, and Market. In the report\u2019s words: <\/p>\n
\u201cMicrosoft earns its Overall Leadership with its Defender for Cloud that is redefining the CNAPP market by extending cloud security beyond infrastructure protection and into a unified security platform for cloud, data, identity, AI, and security operations, supported by one of the industry\u2019s most advanced agentic AI ecosystems.\u201d <\/p>\n That recognition reflects where the category is heading: toward platforms that unify cloud and AI security into one operational view of risk. <\/p>\n KuppingerCole makes a clear point: CNAPP <\/a>is no longer about posture or visibility alone. It is becoming the operational foundation for securing AI-powered applications, services, and business processes, across the full software lifecycle from cloud infrastructure to the AI systems running on top of it. <\/p>\n Modern environments introduce complexity across: <\/p>\n This complexity exposes the limits of traditional, siloed tools, where cloud posture, workload protection, AI security, and the security operations center (SOC) each live in their own console. Organizations now need platforms that can: <\/p>\n Runtime intelligence is now central to this shift. Across the platforms KuppingerCole evaluated, 94% detect active exploitation of the complex attack paths they surface, moving teams from long lists of findings to the exposures threat actors can actually use. <\/p>\n KuppingerCole evaluates providers on product strength, innovation, and market presence, and, more importantly, on how effectively they help organizations manage real risk across cloud and AI. Several themes define the next generation of platforms: <\/p>\n Taken together, these capabilities represent a move from fragmented visibility to connected, contextual risk management that spans cloud and AI in a single fabric. <\/p>\n Most security tools surface large volumes of findings, but isolated findings do not reflect how cyberattacks actually happen. Microsoft Defender for Cloud<\/a> uses the Cloud Security Graph and risk-based, multicloud attack path analysis to correlate posture, identity (human and non-human), data, network, and workload signals and identify which risks are truly exploitable. A misconfigured storage resource may look low priority on its own. Exposed to the internet, combined with excessive permissions, and connected to sensitive data, it becomes part of a clear attack path.\u202f <\/p>\n What this means:<\/strong>\u202fSecurity teams can prioritize real attack paths instead of individual findings, helping reduce alert fatigue and improve remediation speed and precision.\u202f <\/p>\n Defender for Cloud brings AI security posture management into the same model as the rest of the cloud, helping organizations validate AI deployment configurations, access controls, model provenance, approved model usage, and identify potential shadow AI risks within supported environments. Through Microsoft Security Copilot<\/a> and a growing set of specialized security agents, the platform also helps teams investigate, prioritize, guide remediation, and automate workflows.\u202f <\/p>\n What this means:<\/strong>\u202fOrganizations can govern AI as part of cloud risk rather than in a separate silo, and shift AI from flagging risk to actively helping resolve it. <\/p>\n As environments scale, fragmented tools make it difficult to understand how risks connect and where to focus first. Defender for Cloud connects code and infrastructure definitions, assesses cloud configurations, protect workloads at runtime, monitor applications and APIs, govern identities, correlate threats across the broader digital estate, and use AI to accelerate investigation and remediation across multicloud and hybrid environments. <\/p>\n What this means:<\/strong>\u202fSecurity teams can investigate faster, prioritize more consistently, and respond more quickly across fragmented cloud and application environments. <\/p>\n The Leadership Compass offers a signal for where cloud security is headed: toward platforms that connect context across cloud, application, and AI environments so teams can prioritize the risks most likely to be exploited and reduce exposure faster. Security leaders should now ask: <\/p>\n These are the capabilities that define the next generation of cloud-native application protection. <\/p>\n KuppingerCole\u2019s 2026 CNAPP Leadership Compass reinforces a clear shift: CNAPP is becoming the control plane for managing risk across cloud, identity, data, applications, and AI. Microsoft\u2019s recognition as a Leader across all four Leadership categories reflects this shift, bringing posture, runtime, identity, data, application, and AI signals into a connected platform that helps organizations prioritize and reduce risk continuously.\u202f <\/p>\n To learn more about Microsoft Security solutions, visit our\u202fwebsite.<\/a>\u202fBookmark the\u202fSecurity blog<\/a>\u202fto keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security<\/a>) and X (@MSFTSecurity<\/a>)\u202ffor the latest news and updates on cybersecurity.<\/p>\n![\"Graphic](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/08\/CombinedLeadershipFull-712x1024.webp\")
<\/figure>\nWhy CNAPP is being redefined<\/strong> <\/h2>\n
\n
\n
What distinguishes leading platforms<\/strong> <\/h2>\n
\n
How Microsoft helps organizations manage real risk<\/strong> <\/h2>\n
1. Connect cross-domain signals to prioritize real attack paths<\/strong> <\/h3>\n
2. Secure AI as part of cloud risk, and use AI to run security<\/strong> <\/h3>\n
3. Reduce complexity from code to cloud to SOC<\/strong> <\/h3>\n
What this signals for security leaders<\/strong> <\/h2>\n
\n
Bottom line<\/strong> <\/h2>\n
Learn more<\/strong> <\/h2>\n