Changing your CNAPP without starting again.
The contract is up, or the product you bought has been renamed and rebuilt under you. The new CNAPP arrives with an empty history, and none of the decisions your team spent two years making come across with it.
You will recognise this if
- Your CNAPP has been renamed, merged or rebuilt, and its policies changed with it.
- Two years of exceptions live in the old tool, and nobody is sure which still apply.
- The new CNAPP’s first scan opened thousands of findings your team had already dealt with.
- Halfway through the switch, nobody can say which accounts anything is checking.
What a CNAPP change usually leaves behind.
A CNAPP is where findings are raised. Over time it also becomes where the decisions about them are kept. When the tool goes, the decisions go with it, unless they were kept somewhere else.
| What | Where it usually lives | Where NxSCORE keeps it |
|---|---|---|
| Exceptions and their expiry dates | Inside the old CNAPP, or in a spreadsheet beside it | On the finding in NxSCORE, with the reason, who decided and when it expires |
| Owners and fix-by dates | In alert assignments that the new tool cannot read | On the account and the control, whichever tool raised the finding |
| Findings that came back after a fix | In the old tool’s alert history, which stays behind | Counted by issue, so a repeat is still a repeat after the switch |
| Prevention plans | In tickets and wiki pages, if anywhere | By issue, with their state: agreed, applied or verified |
| Evidence for your auditors | In shared folders, matched to the old tool’s compliance report | Against each requirement, with who uploaded it and who accepted it |
None of it depends on which CNAPP raised the finding. That is what lets it outlast the tool.
Before the switch, keep the decisions somewhere that stays.
The best time to connect NxSCORE is a few months before the old contract ends. The work below needs only read-only access to the CNAPP you already have.
- 01
Connect the CNAPP you have today.
Your team creates a read-only key in the CNAPP and enters it once. It is encrypted as soon as it arrives and never shown again.
NxSCORE reads the CNAPP’s policies, alert rules, compliance standards, cloud accounts and open alerts, once a day. The first sync also reads the last 90 days of resolved alerts, so findings that came back after a fix are visible from the start.
Nothing is written back to the CNAPP, then or later.
Your CNAPP, first syncConnectedCloud accounts 48 Policies enabled 612 Alert rules 9 Open alerts 842 Resolved alerts read, last 90 days 2,310 - 02
Keep every decision on the account and the control.
A CNAPP keeps decisions on its own alerts. NxSCORE keeps them on the finding: one control, failing on one account. The owner, the fix-by date, the first time it was seen and any exception all sit there.
The finding does not belong to the tool that raised it, so it does not leave when the tool does.
S3 buckets that allow public access, prod-paymentsFound by Your CNAPP and NxSCORE First seen 14 February 2025 Owner team: payments-platform Came back after a fix 3 times Prevention plan Verified - 03
Know which accounts each tool can see.
NxSCORE matches every account in your cloud organisation with the accounts your CNAPP monitors. Accounts the CNAPP has switched off, or never had, are listed by name.
Where NxSCORE has its own read-only role, it scans those accounts itself. Where it has no access, the account says so. It is never reported as clean.
AccountsExample- prod-paymentsCovered by your CNAPP
- core-bankingCovered by your CNAPP
- data-lakeScanned
- shared-servicesCNAPP only, not scanned
- dr-siteAccess denied
During the switch, no gap in coverage.
Most migrations run for months, with two tools half deployed. This is when controls quietly stop being checked.
- 04
Coverage worked out control by control.
For each control, NxSCORE looks at whether your CNAPP has a policy for it, whether the policy is switched on, and whether an alert rule sends it for every account.
If any of those is missing, the control is not covered, and the NxSCORE scan checks it. If an alert rule only covers some regions or tags, NxSCORE checks the rest. Nothing is left to chance because a policy was renamed in the new tool.
Who checks whatExample- S3 buckets block public accessYour CNAPP
Policy on, and an alert rule sends it for every account.
- EC2 instances require IMDSv2NxSCORE
The policy is off in your CNAPP, so NxSCORE checks it.
- CloudTrail is on in every regionYour CNAPP and NxSCORE
The alert rule covers two regions only, so NxSCORE checks the rest.
- Access reviews done each quarterEvidence
No tool can check it. Your team uploads the review and an analyst accepts it.
- 05
The new CNAPP’s findings land on the same records.
When the new CNAPP is connected, each finding it raises is matched to the account and the control. If NxSCORE already has that finding, it keeps its owner, its fix-by date and any exception, and is marked as found by the new tool as well.
Your team sees the findings that are actually new, instead of the whole estate again.
First sync from the new CNAPPExampleFindings raised 3,874 Already known, decisions kept 3,102 Already accepted as a risk, still in date 87 New to NxSCORE, for your analyst to look at 685 - 06
Nothing closes because a tool went quiet.
Keys expire, licences end and a CNAPP is switched off a week early. When NxSCORE cannot read a CNAPP, it retries, and then works from what it can still see.
A finding is never closed because its source stopped reporting. It is closed when a later assessment shows the problem is gone.
If a CNAPP cannot be readWhat happens- A cloud account is connectedScanned by NxSCORE
The NxSCORE scan checks every control itself for that run.
- Only the CNAPP is connectedLast good sync
The last complete sync is kept, and marked as out of date.
- Open findingsStay open
Closed only when an assessment no longer sees the problem.
Then carry on where you left off.
After the switch, the same programme with a different scanner.
The people, the decisions and the evidence stay where they were. Only the tool raising the findings has changed.
- 07
Exceptions keep their reason and their expiry.
An exception approved last spring is still approved, with the same reason, the same person who decided it and the same expiry, no more than 12 months away.
Nobody has to approve it again because the tool changed. When it expires, the finding goes back on its fix-by date, as it would have anyway.
ExceptionApproved, in dateFinding Port 22 open on bastion-dr Decided by Security team, 2 April 2026 Found by Old CNAPP, then the new one Expires 31 March 2027 - 08
Repeats and prevention plans carry on.
Prevention plans are kept by issue, not by tool. A plan your team agreed before the switch is still agreed after it, and a plan that held is still checked against the new CNAPP’s findings.
If the new tool finds the issue again, the plan goes back to applied, and your analyst looks at why.
Recurring issuesExample- S3 buckets that allow public accessVerified
Organisation guardrail. No new findings from either CNAPP since.
- Security groups open on port 22Applied
Pipeline check. 9 of 14 quiet days.
- 09
Evidence and reports keep their history.
Evidence is kept against each requirement, with who uploaded it, who accepted it and until when it counts. Signed quarterly packs stay as they were signed.
Your auditors see one compliance record across the change, instead of two reports from two tools that do not agree.
Compliance, PCI DSS 4.0.1Example- 12.1.1 Information security policyMet
Evidence accepted 8 October 2026. Not affected by the CNAPP change.
- 2.2.1 Configuration standardsIn review
Now checked by the new CNAPP and NxSCORE together.
Who does what.
A CNAPP migration is a project with a deadline. NxSCORE is there so that the decisions made before it are still there after it.
Your NxSCORE analyst
- Connects both CNAPPs with read-only credentials
- Shows which controls and accounts each one covers, week by week
- Checks the new CNAPP’s first findings against the decisions already made
- Flags exceptions and prevention plans that need a fresh look
Your security team
- Decides when the old CNAPP can be switched off
- Re-approves any exception whose reason changed with the new tool
- Approves every change to a verdict, as the checker
Your engineers
- Deploy the new CNAPP’s agents and roles, as its vendor describes
- Keep running the same fix kits, which do not depend on either CNAPP
NxSCORE’s access to your cloud is read-only. Every change on this page is made by your people, through your own change process. Read every permission.
Questions teams ask about this.
Does NxSCORE replace our CNAPP?
No. NxSCORE works with your CNAPP, the old one and then the new one. It reads what the CNAPP finds, checks what it does not, and keeps the decisions your team makes about each finding. The CNAPP stays your scanner.
Will we lose the history from the old CNAPP?
What NxSCORE has read stays in NxSCORE: the findings, when each was first seen, which ones came back, and every decision made about them. The first sync reads 90 days of resolved alerts, so the earlier you connect before a switch, the more of that history comes with you.
Our two CNAPPs name the same problem differently. Does that create duplicates?
NxSCORE keeps findings by account and by control, not by the CNAPP’s alert. When two sources report the same failing setting on the same account, it is one finding, marked as found by both.
What happens to accounts the new CNAPP does not monitor yet?
They are listed by name. If NxSCORE has read-only access to the account, it scans it. If it has no access, the account is shown as not scanned, never as passing.
Do we need to change anything in the old CNAPP?
No. NxSCORE reads policies, alert rules, compliance standards, accounts and open alerts, and never writes anything back to the CNAPP.
We are moving from Prisma Cloud to Cortex Cloud. Is that the same thing?
For NxSCORE it is the same job: two products, one after the other, with your decisions kept in between. The Cortex Cloud page explains how NxSCORE works with it.
Connect before the contract ends.
Start with the CNAPP you have and one cloud account. Your analyst shows you what is kept, which controls each tool covers, and what the switch would leave unchecked.