> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workload security (CWPP)

> Use workload security in Plerion, also known as Cloud Workload Protection Platform (CWPP), to scan workloads for vulnerabilities and prioritize risks across virtual machines, containers, images, EC2 instances, Lambda functions, and code.

With **workload security** in Plerion, you can scan the software running inside your cloud workloads to uncover vulnerabilities that configuration checks alone cannot catch. This ensures you have visibility into risks across operating system packages, container images, and code dependencies.

***

## What is CWPP?

A **Cloud Workload Protection Platform (CWPP)**—commonly referred to as workload security—protects workloads wherever they run, including virtual machines, containers, container images, EC2 instances, Lambda functions, and code.

Unlike posture management tools that focus on cloud configurations, CWPP examines the applications and software packages inside workloads to identify vulnerabilities and risks.

***

## Key capabilities

* **Comprehensive workload scanning**\
  Scan a wide range of workloads—including virtual machines, containers, container images, EC2 instances, Lambda functions, and code—for known vulnerabilities in operating system packages and third-party dependencies.

* **Vulnerability prioritization**\
  Not all vulnerabilities require urgent action. Plerion prioritizes issues by risk factors, helping you focus on what matters most.
  * Exploitable in the wild
  * Presence of public exploits
  * Exposure of sensitive data
  * Asset criticality

***

## Supported workloads

Plerion’s workload scanner supports the following workload types:

* **Virtual machines**
  * AWS EC2 instances
  * Azure Virtual Machines

* **Serverless functions**
  * AWS Lambda
  * Azure Functions

* **Container images**
  * AWS Elastic Container Service (ECS)
  * AWS Elastic Container Registry (ECR)
    * *Note:* For ECR container images, the last 2 pulled and the most recently pushed images are scanned.

* **Kubernetes clusters and components**
  * AWS EKS
  * Azure AKS
  * Google Cloud GKE

<Warning>
  Kubernetes workload support is currently in beta.\
  For more information, see the [Kubernetes workload scanning overview](/guides/integrations/kubernetes/workload-scanning-overview).
</Warning>

***

## Further reading

* [Workload security FAQs](/guides/platform/cwpp/faq)
* [Workload security scanning coverage](/guides/platform/cwpp/scanning-coverage/vulnerabilities)