Serverless functions are short-lived units of code that run only when triggered by an event, such as an HTTP request, file upload, or queue message. The cloud provider manages the servers and scaling, so defenders focus less on host administration and more on code, permissions, and event-driven behavior. Because these functions are ephemeral, they can start and stop quickly, leaving little time for manual inspection.
In security, serverless functions matter because attackers often target the surrounding control plane: overly broad IAM roles, exposed secrets, unsafe dependencies, or unvalidated event inputs. Abuse can lead to data theft, unauthorized API calls, or covert crypto-mining through repeated invocations. Defenses center on least privilege, secret management, code scanning, and runtime monitoring. In CWPP, serverless support helps teams detect suspicious execution patterns and enforce policy on workloads that never exist as traditional servers.