SentinelOne Singularity Cloud — CWPP, CNAPP & Kubernetes Protection

① What Singularity Cloud Security actually is — one platform, two protection modes

The core idea: SentinelOne Singularity Cloud Security is one AI-powered platform that protects cloud workloads through two complementary modes. The CWPP layer puts a lightweight Singularity agent directly on each workload — VM, container or serverless — giving real-time, behavioural AI detection and autonomous response. The CNAPP/CSPM layer scans cloud accounts agentlessly, auditing misconfigurations, over-privileged IAM roles, exposed storage and compliance drift continuously.

Both modes share a single Singularity console. Alerts, incidents and posture findings all land in one place, correlated with the broader XDR story across endpoint, identity and network. The platform covers AWS, Azure, Google Cloud, private clouds and hybrid data-centre workloads from the same policy and incident pane.

② CWPP at runtime — the agent, behavioural AI and autonomous response

The Singularity CWPP agent runs as a lightweight process on each protected workload: a Linux or Windows VM, a container sidecar, or an AWS Lambda-compatible instrumented layer. It does not rely on signature updates. Instead, it uses behavioural AI — modelling every process, file, network and memory event — to identify malicious patterns like ransomware encryption loops, privilege-escalation chains, cryptomining side-channels and fileless lateral movement in real time.

Autonomous response options

When a threat is confirmed, the agent can kill the process, quarantine the file, isolate the workload from the network or roll back malicious changes — all without waiting for a human analyst. Every action is logged to the Singularity console with a full attack storyline, so the SOC understands exactly what happened rather than receiving a raw alert. This is the key differentiator versus a traditional AV or log-only CSPM tool.

③ Container and Kubernetes protection — nodes, admission and runtime policy

Container and Kubernetes environments need protection at three levels. Node-level: the Singularity agent deploys as a DaemonSet on each Kubernetes node, giving the same behavioural-AI runtime coverage to every pod running on that node. Admission control: the platform integrates with Kubernetes admission controllers to block deployment of images with known critical vulnerabilities or forbidden configurations before they run — the shift-left gate. Runtime policy: once running, process allow-lists and network micro-segmentation rules enforce the expected behaviour of each container, flagging any drift.

Agentless image scanning complements the runtime layer — scanning container-image registries (ECR, ACR, GCR, Docker Hub) for CVEs and secrets before images are ever deployed. The combination of pre-deploy scan, admission gate and runtime agent means a malicious or misconfigured container is caught at whichever layer it first appears — not just one of them.

④ Cloud Funnel, CSPM and closing the full coverage loop

Cloud Funnel is the data-streaming pipeline that replicates all EDR and XDR telemetry — every process, file, network and threat event from every protected workload — to a customer-owned destination: Amazon S3, Google Cloud Storage, or a SIEM such as Splunk or Microsoft Sentinel. This means you own your data, can build custom detection rules in your own SIEM, and are never locked to SentinelOne's storage alone. Cloud Funnel exports continuously and automatically with no per-event throttle.

CSPM closes the agentless gap

The CSPM layer connects to cloud provider APIs — no agent needed — and audits every resource for misconfigurations (open S3 buckets, unencrypted RDS, over-privileged roles), compliance drift (CIS Benchmarks, PCI-DSS, NIST), and CIEM excessive entitlements. Findings are risk-scored and surfaced alongside runtime alerts in the same console, so a single analyst can pivot from 'exposed bucket' to 'active threat on that VM' without switching tools.