Cybersecurity 101 | What is Cloud Detection and Response (CDR)?| Cloudskope

Cloud Detection and Response monitors cloud workloads, control planes, and data layers. The detection category for modern cloud compromise patterns.

What CDR Actually Monitors

Cloud Detection and Response (CDR) is the category of security tooling and managed services that monitor cloud workloads, cloud control planes, and cloud-native data for security threats. CDR emerged as a distinct category because the traditional endpoint and network monitoring approaches — designed for on-premises environments where security teams controlled the infrastructure — do not produce adequate visibility into AWS, Azure, and Google Cloud environments where the infrastructure abstractions, ephemeral resources, and API-driven control planes operate fundamentally differently.

The Cloud Threat Surface

Cloud environments expose three distinct threat surfaces that CDR is designed to monitor. The compute layer — virtual machines, containers, serverless functions — looks superficially similar to on-premises servers but operates with substantially different attack patterns. Containers are ephemeral and orchestrated by Kubernetes; serverless functions execute and terminate in milliseconds; both produce telemetry that traditional EDR does not capture.

The control plane layer is the larger gap. AWS, Azure, and Google Cloud expose API surfaces that authenticated entities use to provision resources, modify configurations, and access data. An attacker with cloud credentials does not need to run malware on any workload — they can call AWS APIs directly to exfiltrate S3 bucket contents, escalate IAM permissions, or modify infrastructure configuration. The control plane is the actual attack surface for most modern cloud compromises, and traditional security monitoring is structurally blind to it.

The data layer is the third surface. Cloud storage services (S3, Azure Blob, Cloud Storage), managed databases (RDS, Cosmos DB, Cloud SQL), and data warehouses (Snowflake, BigQuery, Redshift) hold the high-value targets of most cloud-targeted attacks. The 2024-2026 Snowflake customer breach campaign demonstrated how data-layer access produces material compromise without requiring any workload compromise at all.

The CDR Detection Layers

Effective CDR combines four detection layers. Cloud workload protection (CWP) monitors compute workloads for malware, suspicious processes, and policy violations. Cloud control plane monitoring analyzes CloudTrail, Azure Activity Log, and Google Cloud Audit Logs for unusual API patterns, suspicious authentication, and IAM changes. Cloud Security Posture Management (CSPM) continuously evaluates the configuration of cloud resources against security baselines, surfacing misconfigurations before they are exploited. Data security posture management (DSPM) tracks sensitive data location and access patterns across the cloud environment.

Why CDR Matters Now

The Cloud Compromise Pattern

Modern cloud compromise follows a different attack chain than on-premises compromise. Initial access typically does not target cloud workloads directly. It targets the human or machine identities that have access to the cloud control plane: developer laptops with cached cloud credentials, CI/CD pipelines with deployment credentials, OAuth grants between SaaS applications, federated identity infrastructure that connects on-premises Active Directory to cloud IAM. Once identity access is obtained, the attacker calls cloud APIs directly — no malware is required on any workload.

The 2024 Storm-0558 incident, the 2025 Snowflake customer breaches, the ADT breach involving Okta and Salesforce, the multi-tenant compromises through OAuth applications: these are control-plane and identity-layer attacks that traditional EDR does not see. CDR is the category that exists to provide visibility into this attack pattern.

The Vendor Landscape

Leading CDR platforms include Microsoft Defender for Cloud (the consolidated Microsoft cloud security offering), CrowdStrike Falcon Cloud Security, Wiz (the cloud-native CSPM leader, now expanding into runtime detection), Lacework, Sysdig, Palo Alto Prisma Cloud, and Aqua Security. The vendor selection question depends heavily on which cloud providers are in scope (Microsoft-heavy environments default to Defender for Cloud), the existing endpoint security relationship (CrowdStrike customers often extend the Falcon platform into cloud), and the depth required across CSPM, CWP, and identity-layer monitoring.

The Managed CDR Variant

For mid-market organizations, CDR is typically procured as a component of broader MDR service rather than as standalone tooling. The MDR provider operates the CDR platform alongside endpoint and network monitoring, integrating cloud telemetry into the unified detection and response workflow. The procurement question becomes which MDR provider has actual cloud capability versus which is reselling underlying CDR tools without specialized cloud expertise.

How to Evaluate CDR Capability

Cloud Coverage Across Three Major Providers

Most mid-market environments have material presence in at least two of AWS, Azure, and Google Cloud. CDR tooling that covers only one cloud provider produces material visibility gaps. The evaluation question is: does the tooling provide depth across the cloud providers actually in use, or does it claim multi-cloud while delivering depth in only one?

Identity-Layer Integration

Modern cloud compromise typically begins with identity-layer attack. CDR capability that does not include integration with the identity provider — Microsoft Entra, Okta, Google Workspace identity — misses the front of the attack chain. Effective CDR correlates identity events with cloud control plane activity and cloud workload behavior to surface the full attack timeline.

Response Capability

Detection without response leaves the organization in alert-only mode. CDR tooling should support automated response actions: isolating compromised cloud workloads, revoking cloud session tokens, disabling compromised IAM roles, blocking suspicious API patterns. The response automation footprint distinguishes operationally mature CDR from monitoring-only positioning.

What is Cloud Detection and Response (CDR)?