What it means
Capabilities may include image assessment, runtime behavior analysis, vulnerability detection, host controls, container policy, and workload identity monitoring.
Why it matters
Cloud posture and workload runtime are different views: a correctly configured resource can still execute malicious code or be abused through valid credentials.
Practical focus
- Match controls to the workload type and responsibility model
- Protect images before deployment and behavior during runtime
- Correlate workload findings with identity and network evidence
Common mistakes
- Installing host agents where the provider controls the runtime
- Assuming vulnerability scanning detects active compromise
- Using one policy for every workload risk level
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: