Endpoint and Cloud Workload Protection Platform (CWPP): Runtime Threat Detection

IntermediateFree5 modules · 15 lessons · ~2 min

About this course

Learn how Safeguard's Runtime Protection engine (Cloud Workload Protection Platform and Cloud Native Application Protection Platform, CWPP and CNAPP), Endpoint Security (EDR and EPP), and Package Firewall work together to catch active exploitation, Software Bill of Materials (SBOM) drift, and malicious dependencies before and after deployment. You will deploy the runtime agent, read process, file and network telemetry, investigate a real endpoint incident end to end, and close the loop from runtime evidence back into vulnerability prioritization and incident response.

What you'll learn

Runtime Protection Foundations

From Static Scanning to Runtime: Why CWPP Matters
Deploying the Runtime Agent Across Workloads
Process, File and Network Telemetry Explained

Detecting Exploitation at Runtime

Catching Exploitation of a Known CVE in Production
Detecting Drift from the SBOM at Runtime
Container and Workload Anomaly Detection (CNAPP)

Endpoint Security (EDR/EPP)

Endpoint Detection and Response Fundamentals
Endpoint Prevention: Blocking Known-Bad Before Execution
Investigating an Endpoint Alert End to End

Closing the Loop

01Runtime Protection Foundations3 lessons

From Static Scanning to Runtime: Why CWPP Matters
Deploying the Runtime Agent Across Workloads
Process, File and Network Telemetry Explained

02Detecting Exploitation at Runtime3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

The Feedback Loop: Runtime Evidence Sharpens Reachability

Prioritization: Runtime-Confirmed Risk versus Theoretical Risk

Package Firewall: Blocking Malicious Dependencies Before Runtime

Operating Runtime Protection

Tuning Detections and Reducing Alert Fatigue
Incident Response Workflow for Runtime Findings
Building a Runtime Protection Program

Catching Exploitation of a Known CVE in Production

Detecting Drift from the SBOM at Runtime

Container and Workload Anomaly Detection (CNAPP)

03Endpoint Security (EDR/EPP)3 lessons

Endpoint Detection and Response Fundamentals
Endpoint Prevention: Blocking Known-Bad Before Execution
Investigating an Endpoint Alert End to End

04Closing the Loop3 lessons

The Feedback Loop: Runtime Evidence Sharpens Reachability
Prioritization: Runtime-Confirmed Risk versus Theoretical Risk
Package Firewall: Blocking Malicious Dependencies Before Runtime

05Operating Runtime Protection3 lessons

Tuning Detections and Reducing Alert Fatigue
Incident Response Workflow for Runtime Findings
Building a Runtime Protection Program2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.