What is CSPM (Cloud Security Posture Management)?
Cloud Security Posture Management (CSPM) is the continuous, automated inspection of cloud infrastructure configuration for misconfigurations, policy violations and compliance drift. It reads cloud provider APIs to evaluate resources — storage buckets, databases, security groups, IAM roles — against a rule set, then reports what is misconfigured and how to fix it.
Why CSPM exists
Cloud breaches are rarely sophisticated. The overwhelming majority start with something mundane: a storage bucket left public, a database reachable from the internet, a security group opened to 0.0.0.0/0 during a debugging session, an IAM role that accumulated permissions nobody removed.
None of this is caused by careless engineers. It is caused by scale and speed. A single team can create hundreds of cloud resources in a week, each with dozens of configuration options and defaults that were never designed to be secure — they were designed to work. Manual review cannot keep pace, and annual audits find problems roughly 360 days too late.
CSPM automates that review and runs it continuously.
How CSPM works
Every CSPM tool follows the same four steps:
- Connect — a read-only credential is granted in the cloud account: an IAM role on AWS, a service principal on Azure, a service account on GCP. No agent is installed.
- Discover — the tool enumerates every resource across every region and account through the provider's APIs, building an inventory.
- Evaluate — each resource is checked against a rule catalog. Rules are deterministic and binary: a bucket either blocks public access or it does not.
- Report and remediate — failures become findings, ranked by severity, mapped to the compliance frameworks they violate, and paired with remediation steps.
The critical word is *continuous*. A scan that runs quarterly is an audit. CSPM re-evaluates as infrastructure changes, so a misconfiguration introduced on Tuesday surfaces on Tuesday.
What CSPM catches
| Category | Typical findings |
|---|---|
| Storage exposure | Public buckets, unencrypted volumes, snapshots shared outside the account |
| Network exposure | Security groups open to the internet, management ports reachable, missing WAF |
| Identity | Root account in use, MFA not enforced, over-permissive policies, stale access keys |
| Encryption | Provider-managed keys where customer-managed is required, no key rotation, expired certificates |
| Logging | Audit logging disabled, flow logs off, retention below policy |
| Resilience | No backups, deletion protection off, single-AZ production databases |
What CSPM does not catch
This is where most evaluations go wrong. CSPM reads *configuration*. It does not see:
- What is running inside a workload. An EC2 instance can be perfectly configured and still run an unpatched OpenSSL. That is CWPP.
- What the data actually is. CSPM sees an encrypted bucket, not that it holds 800,000 customer records. That is DSPM.
- Effective permissions. CSPM reads a policy document; it does not resolve what a principal can actually do after role chaining, SCPs and permission boundaries. That is CIEM.
- Behaviour. A valid credential used at 3am from a new country is not a misconfiguration. That is cloud detection and response.
- Chains. CSPM produces a list. It does not tell you that finding #47 plus finding #212 equals a path from the internet to your database. That is attack path analysis.
A CSPM tool that reports 4,000 findings with no chaining hands you a spreadsheet, not a priority.
CSPM vs CNAPP vs CWPP vs CIEM
CSPM was the first category to exist, which is why the terms are often used loosely. The relationship is nesting, not competition:
- CSPM — configuration posture.
- [CWPP](/learn/cwpp) — the workloads themselves.
- [CIEM](/learn/ciem) — identity and effective permissions.
- [DSPM](/learn/dspm) — the data and its exposure.
- [CNAPP](/learn/cnapp) — the umbrella that runs all of the above on one data model.
Buying these as four products from four vendors reproduces the problem they were meant to solve: four consoles, four severity scales, and no correlation between them.
What to look for in a CSPM tool
- Rule depth per cloud, not cloud count. "Supports 6 clouds" often means full depth on two and a token integration on the rest. Ask for the rule count per provider.
- Agentless. If it needs an agent for posture, coverage will stall at whatever percentage the platform team tolerates.
- Remediation, not just detection. A finding without a specific fix for that specific resource is a ticket nobody actions.
- Framework mapping. One finding should update every framework it affects at once.
- Correlation with identity and data context. Severity alone is a poor proxy for risk.
Next steps
- How Onam implements CSPM — 9,853 posture rules across seven clouds
- What is CNAPP? — the umbrella category
- What is a cloud attack path? — why finding lists are not priorities
Frequently asked questions
What does CSPM stand for?
CSPM stands for Cloud Security Posture Management. It is the continuous automated inspection of cloud infrastructure configuration for misconfigurations, policy violations and compliance drift.
What is the difference between CSPM and CNAPP?
CSPM covers configuration posture only. CNAPP is the umbrella category that combines CSPM with workload protection (CWPP), identity analysis (CIEM), data security (DSPM) and runtime detection on a single data model. CSPM is a component of CNAPP, not an alternative to it.
Does CSPM require agents?
No. CSPM reads configuration through cloud provider APIs using read-only credentials, so no software is installed on any workload. Some vendors add optional agents for runtime telemetry, but posture assessment itself is agentless.
Is CSPM the same as a compliance tool?
They overlap but are not the same. CSPM detects misconfigurations regardless of whether a framework mentions them; a compliance tool reports pass rates against specific control catalogs. Most CSPM tools map findings to frameworks like CIS, NIST and PCI-DSS, which is how one scan produces evidence for many frameworks at once.
How often should CSPM scans run?
Continuously. The value of CSPM over a periodic audit is that a misconfiguration introduced today is detected today. Most platforms run discovery continuously and re-evaluate rules on every change, rather than on a nightly or weekly batch.