CNAPP Selling to the Cloud Security Architect — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **CNAPP (Cloud-Native Application Protection Platform) Selling to the Cloud Security Architect** is a 60-minute training for AEs, SEs, and channel managers running $200K–$2.5M ACV cycles against incumbents like **Wiz**, **Palo Alto Prisma Cloud**, **CrowdStrike Falcon Cloud Security**, **Orca Security**, **Lacework**, **Sysdig Secure**, **Microsoft Defender for Cloud**, **Check Point CloudGuard CNAPP**, **Aqua Security**, **Tenable Cloud Security**, and **Snyk Cloud**. The session teaches sellers to qualify against the **three-buyer reality (Cloud Security Architect, CISO, DevSecOps Lead)**, run a structured discovery on **toxic-combination economics**, demo against the customer's actual cloud accounts, and trap-set the multi-year renewal at month 12. Built on **MEDDPICC**, **Force Management's Command of the Message**, and **Andy Paul's "Sell Without Selling Out"** discovery cadence.

---

## Section 1 — Why CNAPP Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. CNAPP is the **consolidation play** — combining CSPM, CWPP, CIEM, container scanning, IaC scanning, and API security into one platform. The Cloud Security Architect runs the technical evaluation; the CISO funds the consolidation; the DevSecOps Lead validates CI/CD integration.

Set the frame on the whiteboard.

- **Three buyers, one consolidation thesis.** Cloud Security Architect picks; CISO funds the consolidation; DevSecOps Lead integrates with CI/CD. **Wiz's 2026 customer survey** shows 78% of CNAPP buyers consolidating 3+ point tools.
- **Attack-path analysis is the value-add.** CNAPP differentiates by mapping **toxic combinations** — vulnerable workload + public-facing exposure + sensitive data access + over-privileged identity = critical attack path.
- **Agentless plus runtime is the modern stack.** **Wiz and Orca** lead on agentless onboarding; **Sysdig and CrowdStrike** lead on runtime container protection. CNAPPs need both.

End the segment with **Mark Roberge's** rule: *"Sell the consolidation savings, not the feature count."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

> 1. **Opening (3 min):** "Walk me through your cloud security stack today — CSPM, CWPP, CIEM, container, IaC. What's consolidated and what's still point-tool?"
> 2. **Consolidation baseline (10 min):** "How many cloud security point tools do you run today? **3+ consolidation candidates** is the typical CNAPP buyer."
> 3. **Attack-path baseline (10 min):** "What percentage of your team's effort goes against attack-path-level risks vs. Individual findings? Top quartile runs **70%+ on attack paths**."
> 4. **Container and Kubernetes coverage (10 min):** "Are you running Kubernetes? **EKS, AKS, GKE, OpenShift, Rancher?** How are you securing pod admission and runtime?"
> 5. **CI/CD integration (8 min):** "Does your CNAPP block bad-config commits at PR time? **Pre-merge enforcement** is the modern bar."
> 6. **Identity-and-permissions coverage (7 min):** "Are you managing cloud entitlements with CIEM? **CrowdStrike Falcon Cloud Security** and **Sonrai Security** lead here."
> 7. **Renewal posture (5 min):** "When are your various cloud-security contracts up? CNAPP rebundles often."

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{Cloud Arch + CISO + DevSecOps?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[Consolidation + Attack Path 20 min]
    E --> F[Container + CI/CD 18 min]
    F --> G[Identity + Renewal 12 min]
    G --> H[Confirm POC Scope Workshop]
    H --> I[Agentless Connection in 30 min]
    I --> J[Joint Cloud Architect Review at Day 30]
    J --> K[Bind Decision at Day 60]
```

---

## Section 3 — The POC That Wins (15 min)

**Failure modes to ban.** **Single-domain POCs.** **No-attack-path output.** **Agent-only POCs** that require platform-team engineering time.

**Wins to coach.** **Agentless multi-cloud connection.** Walk through **Wiz's and Orca's published POC agendas** — both connect to multi-cloud in under 30 minutes. **Attack-path map delivered within 7 days.** Show a **named attack-path map** for the customer's environment. **Pre-merge enforcement live in CI.** Demo blocking bad-config commits live.

End with **Andy Paul's** rule: *"Show the customer their attack paths closed, not your tool stack expanded."*

---

## Section 4 — Handling the Incumbent Trap (10 min)

The room will face **Wiz**, **Palo Alto Prisma Cloud**, and **CrowdStrike Falcon Cloud Security** in eight of ten enterprise deals. Coach the room on three counter-moves.

**Counter-move 1 — The attack-path wedge.** Ask the Cloud Security Architect: *"What percentage of your incumbent's findings are attack-path-level? **Top quartile is 70%+**."*

**Counter-move 2 — The consolidation-savings wedge.** Ask the CISO: *"What's your total spend across CSPM, CWPP, CIEM, container, and IaC today? CNAPP consolidates these into 1–2 SKUs and saves **20–35%** on

CNAPP Selling to the Cloud Security Architect — 60-Min Training

Direct Answer

Section 1 — Why CNAPP Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 12 (5 min)

FAQ

Sources

CNAPP Selling to the Cloud Security Architect — 60-Min Training

Direct Answer

Section 1 — Why CNAPP Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 12 (5 min)

FAQ

Sources

What does the score mean?