Cloud platform terms, explained.
Asset inventory, security posture, FinOps, disaster recovery and AI agents in operations each have their own vocabulary and plenty of overlapping marketing. These are vendor-neutral explanations of what each term covers, and what it does not.
Security: CSPM vs CNAPP vs CWPP vs CIEM vs DSPM vs SSPM
The short version: five of these are components, and one is the umbrella.
| Acronym | Stands for | Question it answers |
|---|---|---|
| CSPM | Cloud Security Posture Management | Is the cloud infrastructure configured correctly? |
| CWPP | Cloud Workload Protection Platform | Are the running workloads patched and hardened? |
| CIEM | Cloud Infrastructure Entitlement Management | Who can do what, and do they still need it? |
| DSPM | Data Security Posture Management | Where is the sensitive data and who can reach it? |
| SSPM | SaaS Security Posture Management | Are M365, Workspace, GitHub and Snowflake locked down? |
| CNAPP | Cloud-Native Application Protection Platform | All of the above, correlated on one data model. |
All explainers, by topic
Platform & Estate
Knowing what you run: the inventory every other discipline starts from.
Security
Posture, identity, data, workloads and code, and how the categories overlap.
What is CSPM (Cloud Security Posture Management)?
CSPM (cloud security posture management) checks cloud infrastructure for misconfigurations and compliance drift: how it works, what it misses, vs CNAPP.
What is CNAPP (Cloud-Native Application Protection Platform)?
CNAPP unifies CSPM, CWPP, CIEM and DSPM on one data model instead of four consoles. What the category means and how to spot a bundle of acquisitions.
What is CWPP (Cloud Workload Protection Platform)?
What is CWPP? A cloud workload protection platform secures VMs, containers and serverless from the inside. CSPM vs CWPP compared in one table, plus CNAPP.
What is CIEM (Cloud Infrastructure Entitlement Management)?
What is CIEM? It finds what cloud identities can really do after role chains and SCPs, versus what they use. CSPM vs CIEM compared, and why you need both.
What is DSPM (Data Security Posture Management)?
What is DSPM? Data security posture management finds sensitive cloud data, classifies it and maps who can reach it. DSPM vs CSPM vs DLP, examples, FAQs.
What is SSPM (SaaS Security Posture Management)?
SSPM secures the SaaS platforms you run on (Microsoft 365, Google Workspace, GitHub, Snowflake) that cloud CSPM never scans. What it covers and why.
What is attack path analysis?
What is attack path analysis? How attack path mapping and attack path management find chained cloud risks and choke points. Examples, on-path attack, FAQs.
What is agentless cloud security?
Agentless cloud security assesses infrastructure and workloads without installing software on them. How snapshot scanning works and what it cannot see.
What is cloud risk quantification?
Cloud risk quantification expresses security exposure as a probable dollar loss, not a severity score. How the FAIR model works and what inputs it needs.
What is a choke point in cloud security?
A choke point is one resource on many attack paths, so fixing it severs the most routes at once. How choke points are found and how they shrink a backlog.
What is KSPM (Kubernetes Security Posture Management)?
What is KSPM? Kubernetes security posture management checks clusters for risky RBAC, pod settings and missing network policy. KSPM vs CSPM, CIS, checklist.
What is code security?
What is code security? How SAST, SCA, DAST, IaC scanning and secret detection fit together, what security as code means, and how to gate a pipeline.
What is cloud secrets management?
Cloud secrets management: how credentials, keys and tokens are stored, accessed, rotated and audited, why hardcoded secrets persist, and where KMS fits.
FinOps
Who spends what, who owns it, and how cloud cost is managed as a practice.
What is FinOps?
FinOps manages cloud spend through shared accountability between engineering, finance and business teams: its phases, activities and common mistakes.
What is cloud cost allocation?
Cloud cost allocation assigns every cloud cost to the team or product responsible: tagging, account structure, shared costs, showback vs chargeback.
Disaster recovery
Recovery objectives, recovery strategies, and what makes a plan hold up.
What is the difference between RTO and RPO?
RTO is how long a system can be down; RPO is how much data you can afford to lose. How each is set, measured, and what drives it in the cloud.
What is cloud disaster recovery?
Cloud disaster recovery restores applications and data after a major failure: backup and restore, pilot light, warm standby, multi-site, how to choose.
AIOps
AI agents in operations, and how people stay in control of them.
See it on your own cloud.
Estate, Security, FinOps and DRM run on one Onam platform, with AIOps agents across them. Connect a read-only role once to get started.