* [Blog](https://www2.paloaltonetworks.com/blog)
* [Cloud Security](https://www2.paloaltonetworks.com/blog/cloud-security/)
* [API Security](https://www2.paloaltonetworks.com/blog/cloud-security/category/api-security/)
* API Security and Threat I...

# API Security and Threat Intelligence Reduce Attack Surface in Prisma Cloud Workload Protection Release

[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fapi-security-threat-intel-reduce-attack-surface%2F)  
[](https://twitter.com/share?text=API+Security+and+Threat+Intelligence+Reduce+Attack+Surface+in+Prisma+Cloud+Workload+Protection+Release&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fapi-security-threat-intel-reduce-attack-surface%2F)  
[](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fapi-security-threat-intel-reduce-attack-surface%2F&title=API+Security+and+Threat+Intelligence+Reduce+Attack+Surface+in+Prisma+Cloud+Workload+Protection+Release&summary=&source=)  
[](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/cloud-security/api-security-threat-intel-reduce-attack-surface/&ts=markdown)  
\[\](mailto:?subject=API Security and Threat Intelligence Reduce Attack Surface in Prisma Cloud Workload Protection Release)  
Link copied  
By [Ivan Melia](https://www.paloaltonetworks.com/blog/author/ivan-melia/?ts=markdown "Posts by Ivan Melia")  
Dec 19, 2022  
7 minutes  
[API Security](https://www.paloaltonetworks.com/blog/cloud-security/category/api-security/?ts=markdown)  
[Application Security](https://www.paloaltonetworks.com/blog/cloud-security/category/application-security/?ts=markdown)  
[Cloud Workload Protection](https://www.paloaltonetworks.com/blog/category/cloud-workload-protection/?ts=markdown)  
[Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown)  
[Code Security](https://www.paloaltonetworks.com/blog/cloud-security/category/code-security/?ts=markdown)  
[Code to Cloud](https://www.paloaltonetworks.com/blog/cloud-security/category/code-to-cloud/?ts=markdown)  
[Agentless Scanning](https://www.paloaltonetworks.com/blog/tag/agentless-scanning/?ts=markdown)  
[API Security](https://www.paloaltonetworks.com/blog/tag/api-security/?ts=markdown)  
[Vulnerability Management](https://www.paloaltonetworks.com/blog/tag/vulnerability-management/?ts=markdown)

Three trends with cloud-native applications present significant security concerns that can cost your organization through breach or valuable time lost in remediation.

The first area of risk enters with development. Modern cloud-native apps are constructed in CI/CD pipelines consisting of many components and dependencies, any number of which can unknowingly introduce vulnerabilities. The holy grail of vulnerability management is prioritizing vulnerabilities that matter while balancing risk and vulnerability impact on production environments.

Second, most of today's traffic is web, and most web traffic is via API calls. API is a software intermediary that allows two applications to extract and share data. Cloud-native applications rely on APIs for communication, as APIs are the entry point to our apps and data. The explosive growth of insecure cloud-native deployments has made APIs a primary attack vector.

Third, all systems are vulnerable. It's only a matter of time before a vulnerability is exploited. Unaddressed vulnerabilities amplify security alerts at runtime, and attackers have bountiful targets when vulnerabilities are discovered because 100% patch rates are rare.

## Risk Prioritization Through Prisma Cloud Workload Protection

For DevOps and security teams that focus on runtime application security, Prisma Cloud is making it easier to adopt agentless and agent-based architectures that help with prioritizing threats and defending your workloads.

We're pleased to announce the following key capabilities that reinforce security in your code to cloud journey:

* **API Risk Profiling:** We've added API risks profiling to our API discovery capability. You can now better understand and prioritize risk based on 200+ risk factors for all APIs in your environment.
* **Vulnerability Explorer Enhancements:** A primary approach to application security involves accurate risk prioritization to enable your team to focus on what's most concerning. The first step in this process is to have a complete view of your vulnerabilities from filtering threats by risk factors. This is where Vulnerability Explorer comes in.

In our commitment to ongoing development, we've added new features that will make it easier for you to identify and prioritize security issues with our Vulnerability Explorer. You'll find new ways to better track, analyze, and prioritize vulnerabilities across all your workloads.

* **Application Control for Hosts:** With applications and versions evolving, it's becoming difficult to track what runs on your hosts. We've added new capabilities to control applications and their versions that can run on your host machines.

With this protection policy, we provide compliance controls that give users the ability to select which applications can run on their host machines and specify the allowed versions. Now you can reduce the attack surface and ensure continuous compliance controls on all your hosts.

* \*\*Agentless Workload Scanning for Containers:\*\*Now Prisma Cloud can scan container workloads for software vulnerabilities without the need of an agent. Identified vulnerabilities are prioritized with a risk score and a description of risk factors. The risk factor description guides the security team to the best course of action by reporting details --- vulnerable packages, attack complexity and attack vector.

With the addition of container agentless scanning, customers can centralize visibility across hosts, VMs, serverless, and containers.

## API Risk Profiling

Due to the massive growth in APIs, [less than 50% of enterprise APIs will be managed by 2025](https://www.gartner.com/en/documents/4009103), according to a recent study by Gartner. The speed of application development makes it incredibly challenging without automation to keep track of all API-associated risks. [API security](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security) needs to start with full insight into the risk APIs pose across your cloud environments.

Prisma Cloud has enhanced its API security capabilities with API risk profiling to help teams understand and prioritize risk based on 200+ factors for all APIs in your environment. Understanding the risk factors associated with APIs based on misconfigurations, best practices, exposure to sensitive data and access control is a key step before application security teams can take preventative measures to reduce the API attack surface.

In a single view, Prisma Cloud provides the API endpoint's path, the method used to call, the number of times it's been called, what protections are enabled, its risk factors and the vulnerabilities in the underlying workload. Prisma Cloud makes it easy to prioritize risk based on these filters and then users can enable runtime protection to enforce security across the [OWASP API Top 10](https://owasp.org/www-project-api-security/) security risks.
![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2022/12/1.png)
Figure 1: API Risk Profiling and Observations

## Vulnerability Explorer Enhancements

We improved our risk mechanism for CVEs across a number of areas. First, you can now filter the CVE viewer in the Vulnerability Explorer by risk factors of your choice (see Figure 2). You can include factors, such as whether the container is privileged or if the container is exposed to the Internet. This will help you find affected assets fast.

Second, we added a new risk factor category --- 'Exploit in the wild' (see figure 3) --- with CISA Known Exploited Vulnerabilities Catalog as the main data source. Now you can know which CVEs have a proven risk of exploitation. Based on this, you can create alerts and block policies for 'exploits in the wild' vulnerabilities.
![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2022/12/2.png)
Figure 2: Additional search parameters in Prisma Cloud Vulnerability Explorer to help security teams focus on things that matter ![Vulnerability Explorer Enhancements](https://www.paloaltonetworks.com/blog/wp-content/uploads/2022/12/3.png)
Figure 3: Expanded Risk and Environmental factors overview for a more granularity and insights

## Application Control for Hosts

To minimize the attack surface and prevent vulnerable applications from running on host machines, we've added a new capability to detect legacy applications and control the application inventory on your host machines with compliance checks.

Now you can identify legacy applications or the versions of the applications that can run on hosts (see Figure 4). Without this control, vulnerable applications and versions with vulnerabilities can run freely on host machines. But with compliance controls, you have the ability to select which applications can run on host machines and specify the allowed versions. Our compliance controls can alert on a range of versions or raise an alert on specific applications detected on host machines.
![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2022/12/4.png)
Figure 4: Added process for new application control rule in Prisma Cloud

## Agentless Workload Scanning

Securing cloud environments in an agentless deployment model begins with quick visibility to inventory and threat prioritization but with little to no overhead processes. We are continuing the investment in agentless capabilities to help you map the environment and calculate and prioritize risk as a first step in implementing application security at runtime.

We know that distributed environments, mixed workload types and app stacks require frictionless security. Our latest release of agentless security brings support for containers across the major cloud providers. In addition to container scanning, we've introduced host scanning for Oracle Cloud and compliance assessment for Kubernetes clusters across the public cloud, including support for OpenShift clusters.

## Learn More

To learn more about [the latest product updates](https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-12/prisma-cloud-compute-edition-release-notes/release-information/release-notes-22-12) and discover how Prisma Cloud provides everything you need for cloud-native security, we invite you to take a test drive with [a hands-on demo](https://www.paloaltonetworks.com/prisma/request-a-prisma-cloud-trial).

[Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) protects application lifecycles from code to cloud for 2000+ customers, securing more than 1.5 billion assets and protecting over 2.5 million workloads by processing roughly 2 billion events each day. Continually recognized by the industry --- most recently by Frost and Sullivan --- Prisma Cloud was named the [Global Cloud Workload Protection Company of the Year](https://www.prnewswire.co.uk/news-releases/palo-alto-networks-prisma-cloud-recognized-by-frost--sullivan-for-outstanding-business-performance-visibility-vulnerability-management-and-cloud-protection-301664999.html?tc=eml_cleartime) and earned [Frost \& Sullivan's 2022 award across 10 categories](https://www.frost.com/wp-content/uploads/2022/10/2022-Award-Write-Up-Palo-Alto-Networks-CWP-Award.pdf). For its outstanding growth and innovation, Prisma Cloud was also named a Leader in the inaugural [Frost Radar: Cloud-Native Application Protection Platforms](https://start.paloaltonetworks.com/frost-and-sullivan-radar-cnapp-leader) (CNAPP) study.

*** ** * ** ***

## Related Blogs

### [Cloud Workload Protection](https://www.paloaltonetworks.com/blog/category/cloud-workload-protection/?ts=markdown), [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown)

[#### Agentless vs. Agent-Based Security: How to Use Them to Stay Secure](https://www2.paloaltonetworks.com/blog/cloud-security/agentless-vs-agent-based-security-how-to-use-them-both-to-stay-secure/)

### [API Security](https://www.paloaltonetworks.com/blog/cloud-security/category/api-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security/?ts=markdown), [Code to Cloud](https://www.paloaltonetworks.com/blog/cloud-security/category/code-to-cloud/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown)

[#### API Security in a Cloud-Native World](https://www2.paloaltonetworks.com/blog/2023/01/api-security-in-a-cloud-native-world/)

### [API Security](https://www.paloaltonetworks.com/blog/cloud-security/category/api-security/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Workload Protection](https://www.paloaltonetworks.com/blog/category/cloud-workload-protection/?ts=markdown), [CWPP](https://www.paloaltonetworks.com/blog/cloud-security/category/cwpp/?ts=markdown), [Web Application \& API Security](https://www.paloaltonetworks.com/blog/cloud-security/category/web-application-api-security/?ts=markdown)

[#### The Expanding API Attack Surface](https://www2.paloaltonetworks.com/blog/cloud-security/api-security-visibility-prioritization-protection/)

### [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Code to Cloud](https://www.paloaltonetworks.com/blog/cloud-security/category/code-to-cloud/?ts=markdown)

[#### Best Practices for Managing Vulnerabilities in the Cloud--Part 2](https://www2.paloaltonetworks.com/blog/cloud-security/managing-vulnerabilities-part-two/)

### [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Code to Cloud](https://www.paloaltonetworks.com/blog/cloud-security/category/code-to-cloud/?ts=markdown)

[#### Best Practices for Managing Vulnerabilities in the Cloud](https://www2.paloaltonetworks.com/blog/cloud-security/managing-vulnerabilities-part-one/)

### [Application Security](https://www.paloaltonetworks.com/blog/cloud-security/category/application-security/?ts=markdown), [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Workload Protection](https://www.paloaltonetworks.com/blog/category/cloud-workload-protection/?ts=markdown)

[#### Agentless Secrets Scanning with Prisma Cloud](https://www2.paloaltonetworks.com/blog/cloud-security/agentless-secrets-scanning/)

### Subscribe to Cloud Security Blogs!

Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up  
Please enter a valid email.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.  
This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.  
{#footer} {#footer}

## Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)

* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)

* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)

## Company

* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)

## Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language