Cloud Detection and Response. Catch what a scan cannot.

CSPM and CNAPP assess how your cloud is built and find misconfigurations, largely on a scan cadence. CDR adds the runtime layer: it keeps a live model of the cloud and detects threats as they happen, then drives response. We run CDR on top of the posture tooling you already have, so the two work together, with posture finding the gaps and CDR catching the attacker who uses one.

It is a continuously updated model of your cloud: the identities, configurations, network reachability, and workloads, and how they relate. Because the model is stateful, a single event can be judged in context. A new role on its own may be routine, but a new role with a reachable path to sensitive data is a finding. The twin is what lets CDR tell the difference.

No. CDR detects and prepares the response, but any consequential action, such as revoking a session or isolating a resource, runs through a Human-In-Loop gate where a named Security Analyst approves it. This follows the same operating rule as our Autonomous SOC: AI investigates, Analysts decide.

AWS, Azure, and Google Cloud, in a single model. Detection and correlation work across accounts and across providers, so an attack path that crosses a boundary is still seen as one path rather than disconnected events in separate consoles.

CDR feeds the iTDC, the operating core behind our Autonomous SOC, so cloud detections sit alongside endpoint, identity, and network signals. It also pairs with Continuous Threat Exposure Management, which prioritizes the exposures the cloud twin surfaces, and with Cloud Security for the hardening underneath.

Cloud control-plane events stream into the iTDC as they happen, so detection is near real time. Response speed depends on the autonomy level you set and the Human-In-Loop gate for consequential actions.

Mostly no. CDR reads the logs and APIs your cloud already produces: control plane events, identity activity, and workload signals. Agent-based depth is added only where runtime visibility needs it.

AI does the correlation and enrichment, then a Security Analyst owns the decision. Cloud alerts run through the same iTDC pipeline as everything else, so cross-domain attacks stay one story.

By cloud footprint and telemetry volume, usually as part of a managed detection retainer. A scoped assessment of your cloud signal coverage is the typical starting point.

It is the Implement motion for your cloud estate, with Learn tuning cloud detections weekly and findings feeding posture work in Guard.