Let's be honest, the security industry's answer to serverless has largely been to slap a "cloud-native" sticker on the same old agent-based scanners and call it a day. It's like trying to secure a fleet of motorcycles with the same armored plating you'd put on a tank. The entire runtime model is inverted, and most of the popular CWPP/CNAPP vendors are still fundamentally thinking in terms of persistent servers and long-lived processes.
We're told to "scan the container image" for our Lambda function. Great. That image exists for approximately 90 seconds during the CI/CD pipeline and then vanishes into thin air. The runtime is a black box managed by AWS or Google, and the ephemeral, highly-distributed nature of the thing makes traditional vulnerability management feel like a performative ritual. The real attack surface has shifted dramatically: it's now the function permissions (that IAM role is a goldmine), the event sources (is that S3 bucket trigger overly permissive?), the layers, the application dependencies bundled in the deployment package, and the configuration itself (is it writing sensitive data to stdout, now captured in CloudWatch by default?).
So we end up cobbling together a patchwork: static code analysis for the IaC (checking the SAM or Terraform), SCA for the `package.json` or `requirements.txt`, and some desperate hope that the CSPM tool picks up the insane IAM policy before it's too late. The runtime behavioral stuff? Good luck. You're not installing an EDR agent in a Lambda. You're left with piecing together a narrative from CloudTrail logs after the fact, which is about as useful as a seatbelt on a rollercoaster.
What's the actual playbook here? Do we just accept that we're flying blind post-deployment and triple down on the pre-deployment toolchain? Or is there a genuinely coherent stack that doesn't treat our functions as second-class citizens? I've seen some niche, serverless-first tools pop up, but they often feel like they're solving 20% of the problem with 100% of the fanfare. Meanwhile, the big vendors keep adding "serverless support" as a checkbox feature.
🤷
š¤·