Cybersecurity glossary
What is Cloud Security Posture Management (CSPM)?
Learn what Cloud Security Posture Management (CSPM) is, how it finds risky cloud settings across accounts, and how to turn findings into durable IaC and IAM fixes.
Definition
Cloud Security Posture Management (CSPM) is the continuous discovery, assessment, and prioritization of cloud configuration risk—identities, networks, storage, encryption, and logging—against policy baselines so teams can close misconfigurations before they are exploited.
Why CSPM exists
Cloud accounts accumulate settings faster than humans can click through consoles. A new region, a forgotten test bucket, a security group opened “just for today,” and an IAM wildcard can all sit unnoticed until a scanner or an attacker finds them.
Cloud Security Posture Management (CSPM) treats configuration as a living attack surface. It inventories what the provider APIs say is true, compares that state to a baseline, and ranks gaps by exposure—not by how many CIS rules fired.
How CSPM evaluates an environment
Connect and inventory
Read-only roles enumerate accounts, subscriptions, projects, regions, and resource types.
Collect control-plane state
IAM policies, network rules, storage ACLs, encryption flags, logging sinks, and Kubernetes API settings are pulled.
Evaluate against policy
CIS, vendor, and custom rules mark deviations such as public access, missing MFA, or disabled CloudTrail-style logs.
Score by blast radius
Internet reachability, data classification, and privilege of the affected identity change severity.
Route a durable fix
Tickets, pull requests, or org-policy changes close the gap in code—not only in the live console.
What CSPM is good at (and what it is not)
Multi-account coverage
The same rule pack runs across every org unit so forgotten sandbox accounts cannot stay wide open.
Drift detection
Console hotfixes that never made it into Terraform or Bicep show up as posture regressions.
Not exploit proof
A clean posture score does not mean applications are free of injection, IDOR, or leaked secrets.
Not a substitute for identity design
CSPM can flag AdminAccess; humans still have to split roles, federate users, and remove standing privilege.
CSPM compared with nearby controls
| Control | Inspects | Typical gap |
|---|---|---|
| CSPM | Live cloud configuration and identity posture | Cannot see application logic or most runtime exploits |
| IaC security scanning | Declared infrastructure before apply | Misses unmanaged resources and console drift |
| CWPP / runtime sensors | Workload behavior, packages, and process anomalies | Weak on account-level IAM and storage ACLs |
| Vulnerability scanning | CVEs in images, VMs, and libraries | A patched host can still have a public database |
CSPM operating checklist
- Cover every account, subscription, and region—including frozen and sandbox environments.
- Grant the scanner least-privilege read APIs; never give CSPM standing write or org-admin.
- Map rules to owners and to the IaC repo that should absorb the fix.
- Prioritize internet-exposed data and identity findings over cosmetic benchmark noise.
- Encode exceptions with expiry and justification; do not silence rules globally.
- Block known-dangerous settings at the organization policy layer so they cannot recur.
- Measure mean time to remediate and recurrence of the same control failure.
- Pair CSPM with IaC scanning so live findings and planned changes tell one story.
The practical takeaway
CSPM is continuous cloud configuration assessment. It answers “what is actually deployed, and is it safe?” at account scale.
Use it to find public data, open networks, and overprivileged identities, then fix those gaps in IaC and org guardrails. A dashboard full of unowned findings is not posture management—it is an unread inventory.
Related security terms
Cloud Misconfiguration
The class of defects CSPM is built to find and rank.
IaC Security Scanning
Shift-left checks on infrastructure code that complement live-account CSPM.
Public Storage Bucket
A high-severity posture finding that CSPM should detect across every account.
Cloud IAM
Overprivileged roles and public resource policies are core CSPM signals.
Security Misconfiguration
The broader OWASP category; CSPM focuses on cloud control-plane settings.
Frequently asked questions
What is CSPM in simple terms?
CSPM continuously inspects cloud accounts for unsafe settings—public buckets, open security groups, missing encryption, unused admin roles—and tells you what to fix first.
How is CSPM different from IaC scanning?
IaC scanning reviews planned infrastructure before deploy. CSPM inspects the live control plane, including console drift, unmanaged resources, and settings that never existed in code.
How is CSPM different from CWPP or CNAPP?
CWPP focuses on workload runtime (agents, workload vulnerabilities). CNAPP products often combine CSPM, CWPP, identity, and pipeline checks. CSPM itself is the configuration-posture slice.
Does CSPM replace penetration testing?
No. CSPM finds known-bad settings at cloud scale. It does not prove that an application can be exploited, and it will miss logic bugs that are not encoded as cloud config rules.
What should a good CSPM program measure?
Coverage of accounts and regions, time to remediate high findings, recurrence of the same rule, and whether fixes land in IaC rather than one-off console edits.
Why do CSPM tools produce so much noise?
Vendor rule packs are generic. Without account context, exceptions, and severity based on exposure and data sensitivity, every benchmark deviation looks equally urgent.
Where should CSPM findings be fixed?
Prefer changing the source IaC, org policy, or IAM guardrail. Console-only fixes drift back. Use break-glass only for actively exposed production resources.
References
Explore authoritative guidance and frameworks related to cloud security posture management (cspm).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.