CNAPP

The App-Centric CNAPP, From Code to Cloud

Cloud-native application protection was named for the application. Data Theorem works from the app layer in: the client, the APIs it calls, the cloud infrastructure behind them and the code that builds them all.

Get Started Explore API Secure
#1
Ranked by Gartner® Cloud-Native Apps Use Case 2025 Gartner® Critical Capabilities for Application Security Testing1
Read the Report
What Is CNAPP

The CNAPP Stack, Covered Layer by Layer

Gartner defines a CNAPP as one integrated set of security and compliance capabilities that protects cloud-native applications from development into production2. Cloud posture is the base. Entitlements, Kubernetes, APIs, apps and artifact scanning stack on top.

Layer CNAPP Capabilities Data Theorem
  1. Code Artifact Scanning
    • IaC Scanning
    • Container Image Scanning
    • SCA and SBOM
    Code SAST Secure
  2. Client Layer Apps
    • App Security Testing
    • In-App Runtime Protection
    Mobile Secure Mobile Protect
  3. Network Layer APIs
    • API Discovery and Posture
    • API Security Testing
    • API Runtime Protection
    API Secure
  4. Infrastructure Layer Cloud
    • KSPM
    • CIEM
    • Cloud Asset Inventory
    Cloud Secure
  5. Foundation Cloud Posture
    • CSPM: Cloud Security Posture Management
    Cloud Secure

Gartner Representative Vendor for CNAPP for Cloud Secure, Market Guide for Cloud-Native Application Protection Platforms2

"The attack surface of cloud-native applications is increasing. Attackers are targeting the misconfiguration of cloud infrastructure (network, compute, storage, identities and permissions), APIs and the software supply chain itself. CNAPP offerings bring together multiple disparate security and protection capabilities into a single platform focused on identifying and prioritizing excessive risk of the entire cloud-native application and its associated infrastructure."

Neil MacDonald Gartner Fellow, Gartner2
Data Theorem Puts the App in CNAPP

Most CNAPPs Start at the Cloud. We Start at the App.

The client is the layer 7 entry point, and the APIs it calls lead to your data. Data Theorem starts there and works down to the cloud.

Standard CNAPP Starts Here At the cloud account, working up
Client App Mobile and web, the layer 7 entry point
APIs The network layer between app and cloud
Workloads and Containers Kubernetes, serverless, images
Cloud Accounts Storage, databases, identities
Data Theorem Starts Here At the app, working down
CNAPP

It is a cloud-native app. Data Theorem starts with the app.

How Data Theorem Delivers CNAPP

CNAPP, Built From the App Layer In

Artifact scanning, API security, cloud posture and runtime protection, working across the same layers as the attack above: the app, the APIs it calls, the cloud behind them and the code underneath it all.

Artifact Scanning · Code

Catch It in the Code, Before It Ships

Code SAST Secure scans application code, open source, infrastructure as code and container images, and catches risky changes at the pre-commit hook and in your coding agent.

  • SAST, SCA, SBOM, IaC and container security in one scan
  • SAST+ ties issues verified by Mobile Secure or API Secure to the line that caused them
  • AI Auto-Remediation hands the fix to your coding agent
Explore Code SAST Secure AI Auto-Remediation
API Security · Network Layer

Every API Between the App and the Cloud

APIs are the road from the client to your data. API Secure finds them from the outside in, tests them the way an attacker would and protects them at runtime.

  • Discovery by black-box probing and by reverse engineering your mobile and web apps
  • Fully authenticated testing for BOLA, privilege escalation and custom attacks
  • An alert when a protected API changes and loses its protection
Explore API Secure Ready for AI Exploits
Cloud Posture · Infrastructure Layer

Cloud Posture, From the App Down

Cloud Secure inventories the cloud behind your apps: APIs, containers, databases, storage, serverless and secrets. New assets are picked up as they appear, checked for posture and mapped to the app and API that reach them.

  • CSPM, KSPM and CIEM issues with dashboards and alerts
  • Attack path visualization from client to API to cloud
  • Cloud services nobody connected, surfaced through the APIs that reach them
Explore Cloud Secure
Runtime Protection · Apps and APIs

Stop the Attack Where It Enters

Mobile Protect blocks tampering, reverse engineering and compromised devices inside your iOS and Android apps. API Secure tells your WAF what to block. Blocking one step breaks the exploit chain while the fix ships.

  • In-app protection for iOS and Android, built into your app
  • Block rules for your WAF, driven by what API Secure sees
  • Fraud signals scored and flagged for every signed-in session
Explore Mobile Protect Active Protection
One Platform

Every Layer of the App, in One CNAPP

Five products on one Analyzer Engine, so a finding in the code, the app, the API or the cloud is never seen alone.

Code Apps APIs Cloud Built with code, secured at every layer

Get Started

See Your Apps, APIs and Cloud as One Attack Surface

Start with one app and see what an attacker would see: every path from the client to your data, traced back to the line of code behind it.

Get Started
  1. Start from an app. Submit a mobile app or point API Secure at your domain.
  2. Connect your clouds. Cloud Secure maps the services behind your APIs.
  3. Connect your repos. Code SAST Secure scans code, IaC and containers.

1 Gartner, Critical Capabilities for Application Security Testing, Mark Horvath, Jason Gross, Aaron Lord, Shailendra Upadhyay, 13 October 2025.

2 Gartner, Market Guide for Cloud-Native Application Protection Platforms, Neil MacDonald, Charlie Winckless, Dale Koeppen, 14 March 2023.

Gartner is a registered trademark and service mark, and Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.