https://www.onamsecurity.com Cloud security posture, attack paths, identity risk and compliance — from the Onam Security team. en https://www.onamsecurity.com/resources/blog/dspm-implementation-checklist https://www.onamsecurity.com/resources/blog/dspm-implementation-checklist A step-by-step DSPM implementation checklist: inventory every data store, classify it, map who can reach it, and fix exposure in a sensible order. Data Security Sun, 04 Oct 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/data-lineage-security-unencrypted-hops https://www.onamsecurity.com/resources/blog/data-lineage-security-unencrypted-hops Every bucket passes its encryption check, yet the data still lands somewhere unprotected. How data lineage security finds the weak hop in a pipeline. Data Security Sun, 04 Oct 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/iac-security-scanning-fix-at-source https://www.onamsecurity.com/resources/blog/iac-security-scanning-fix-at-source Console fixes are undone by the next terraform apply. A practical guide to IaC security scanning that traces cloud findings back to the template line. Code Security Sun, 04 Oct 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/ci-cd-security-gates-delta-gating https://www.onamsecurity.com/resources/blog/ci-cd-security-gates-delta-gating Security gates that fail every build get switched off. How to design CI/CD security gates around new findings, clear output and an exception path. Code Security Sun, 04 Oct 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/ai-sast-remediation-fix-branch https://www.onamsecurity.com/resources/blog/ai-sast-remediation-fix-branch AI can draft fixes for SAST findings, but it should never merge its own code. A practical look at safe AI SAST remediation, with a review checklist. Code Security Sun, 04 Oct 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/cloud-access-review-checklist https://www.onamsecurity.com/resources/blog/cloud-access-review-checklist Most cloud access reviews are a spreadsheet nobody answers. A practical checklist for reviewing cloud entitlements, including machine identities. Identity Sun, 04 Oct 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/wiz-alternatives https://www.onamsecurity.com/resources/blog/wiz-alternatives Wiz alternatives in 2026: six cloud security platforms in their vendors' own published words, with links and dates, plus Onam. No scores. Buyer's Guide Mon, 14 Sep 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/best-cspm-tools https://www.onamsecurity.com/resources/blog/best-cspm-tools Best CSPM tools in 2026: seven worth shortlisting, each in its vendor's own words with a link and date, plus the five things that now separate them. Buyer's Guide Mon, 14 Sep 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/onam-vs-wiz-orca-prisma-cloud https://www.onamsecurity.com/resources/blog/onam-vs-wiz-orca-prisma-cloud Running a cloud security POC against Wiz, Orca or Prisma Cloud? Seven questions that separate the platforms, Onam's answers, and a scoring checklist. Buyer's Guide Sun, 19 Jul 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/cdr-behavioral-threat-detection https://www.onamsecurity.com/resources/blog/cdr-behavioral-threat-detection Cloud threat detection needs three levels: rules for single suspicious events, correlation across several events, and statistical behaviour baselines. CDR Tue, 14 Jul 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/aws-misconfigurations-first-scan https://www.onamsecurity.com/resources/blog/aws-misconfigurations-first-scan Five AWS misconfigurations that commonly show up on a first scan: what they are, why they persist, and how to fix them fast. CSPM Thu, 09 Jul 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/ciem-vs-iam-security https://www.onamsecurity.com/resources/blog/ciem-vs-iam-security They sound identical. They aren't. Here's the practical split between IAM Security and Cloud Infrastructure Entitlement Management — and why you need both. Identity Thu, 02 Jul 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/ai-powered-cloud-remediation https://www.onamsecurity.com/resources/blog/ai-powered-cloud-remediation AI-powered cloud remediation: fix prompts that name the resource, AI code fixes on a review branch, and attack-path stories that explain why a fix matters. Engineering Mon, 29 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/attack-path-4000-to-3 https://www.onamsecurity.com/resources/blog/attack-path-4000-to-3 CSPM tools surface hundreds of misconfigurations. The ones behind breaches chain together; attack path analysis shows which chains are dangerous. Attack Path Tue, 23 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/fair-model-cloud-risk https://www.onamsecurity.com/resources/blog/fair-model-cloud-risk FAIR model for cloud risk: CVSS ranks severity, FAIR asks what a breach of this attack surface would cost. How Onam applies a FAIR-style estimate. Risk Tue, 16 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/kubernetes-rbac-pitfalls https://www.onamsecurity.com/resources/blog/kubernetes-rbac-pitfalls Kubernetes RBAC pitfalls: a ClusterRoleBinding here, an aggregated role there, and a role that can only create pods can mount the host filesystem. Six patterns to audit. Containers Tue, 09 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/epss-over-cvss https://www.onamsecurity.com/resources/blog/epss-over-cvss CVSS tells you how bad a vulnerability could be. EPSS tells you how likely it is to be exploited in the next 30 days. Guess which one predicts breaches. Vulnerability Tue, 02 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/why-cloud-iam-permissions-are-never-used https://www.onamsecurity.com/resources/blog/why-cloud-iam-permissions-are-never-used Your IAM policies are accumulating unused permissions faster than your team can audit them. Here's what the data shows and how to close the gap. Identity Wed, 27 May 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/mitre-attack-cloud-mapping https://www.onamsecurity.com/resources/blog/mitre-attack-cloud-mapping How MITRE ATT&CK for Cloud translates abstract threat techniques into concrete cloud misconfigurations — and how your posture score tracks each one. Threat Detection Tue, 19 May 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/agentless-cloud-security-architecture https://www.onamsecurity.com/resources/blog/agentless-cloud-security-architecture Agentless cloud security architecture: how Onam scans 7 clouds with read-only posture roles and agentless workload scanning that runs in your account. Engineering Tue, 05 May 2026 18:30:00 GMT https://www.onamsecurity.com/learn/cspm https://www.onamsecurity.com/learn/cspm Cloud Security Posture Management (CSPM) is the continuous, automated inspection of cloud infrastructure configuration for misconfigurations, policy violations and compliance drift. It reads cloud provider APIs to evaluate resources — storage buckets, databases, security groups, IAM roles — against a rule set, then reports what is misconfigured and how to fix it. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/cnapp https://www.onamsecurity.com/learn/cnapp A Cloud-Native Application Protection Platform (CNAPP) is a single platform that combines cloud posture management, workload protection, identity entitlement analysis, data security and runtime threat detection on one shared data model — so risks that span those domains are correlated rather than reported separately. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/cwpp https://www.onamsecurity.com/learn/cwpp A Cloud Workload Protection Platform (CWPP) secures the compute workloads running in a cloud environment — virtual machines, containers, serverless functions and managed hosts — by inspecting what is installed and running inside them, rather than how the surrounding cloud infrastructure is configured. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/ciem https://www.onamsecurity.com/learn/ciem Cloud Infrastructure Entitlement Management (CIEM) determines the effective permissions of every identity in a cloud environment — human users, service accounts and machine identities — after policies, role chains, service control policies and permission boundaries are resolved, then compares that against permissions actually used. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/dspm https://www.onamsecurity.com/learn/dspm Data Security Posture Management (DSPM) discovers where sensitive data resides across cloud storage, databases and warehouses, classifies it by sensitivity, and determines which identities and network paths can reach it — shifting the security question from how a store is configured to what is actually inside it and who can read it. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/sspm https://www.onamsecurity.com/learn/sspm SaaS Security Posture Management (SSPM) continuously assesses the configuration and identity posture of SaaS applications — such as Microsoft 365, Google Workspace, GitHub and Snowflake — detecting misconfigured sharing settings, unprotected admin accounts, excessive permissions and disabled audit logging. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/cloud-attack-path https://www.onamsecurity.com/learn/cloud-attack-path A cloud attack path is a chain of individually low- or medium-severity findings that together create a route from an entry point — usually the public internet — to a high-value asset such as a database holding sensitive data. Attack path analysis computes these chains across posture, identity, network and workload data. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/agentless-cloud-security https://www.onamsecurity.com/learn/agentless-cloud-security Agentless cloud security assesses cloud infrastructure and workloads without installing any software on them. Configuration is read through cloud provider APIs with read-only credentials, and workload contents are inspected by analysing point-in-time volume snapshots out-of-band, so nothing runs on the systems being scanned. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/cloud-risk-quantification https://www.onamsecurity.com/learn/cloud-risk-quantification Cloud risk quantification is the practice of expressing security risk as a financial figure — a probable dollar loss — rather than a severity label or a proprietary score. It commonly uses the FAIR model (Factor Analysis of Information Risk), which combines how often a loss event is likely to occur with how much that event would cost. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/choke-point https://www.onamsecurity.com/learn/choke-point A choke point is a single resource — often an over-privileged identity or a shared network node — that appears on a large number of distinct attack paths. Because so many routes pass through it, remediating one choke point removes more risk than fixing many isolated findings, which makes it the highest-leverage fix in a cloud environment. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/kspm https://www.onamsecurity.com/learn/kspm Kubernetes Security Posture Management (KSPM) is the continuous evaluation of Kubernetes clusters against security baselines — RBAC bindings, pod security context, network policy, admission control and secrets handling. It reads cluster state through the Kubernetes API and reports which objects violate policy, why it matters, and how to correct it. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/code-security https://www.onamsecurity.com/learn/code-security Code security is the practice of finding security defects in the artefacts that build a system — application source, dependencies, infrastructure-as-code templates and pipeline configuration — before they are deployed. It combines static analysis, dependency analysis, IaC scanning and secret detection, applied continuously as code changes. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/secrets-management https://www.onamsecurity.com/learn/secrets-management Cloud secrets management is the practice of storing, distributing, rotating and auditing credentials — API keys, database passwords, tokens and certificates — so that no application holds a long-lived secret in code or configuration. Secrets live in a dedicated store, are fetched at runtime, and every access is logged. Learn Thu, 06 Aug 2026 00:00:00 GMT