CWPP

A CWPP protects the workloads themselves, meaning the virtual machines, containers, and serverless functions running in the cloud. It handles things like vulnerability scanning, runtime threat detection, and system integrity monitoring. While CSPM watches the cloud configuration, CWPP watches what is actually executing inside it.