https://www.onamsecurity.com Cloud security posture, attack paths, identity risk and compliance — from the Onam Security team. en https://www.onamsecurity.com/resources/blog/onam-vs-wiz-orca-prisma-cloud https://www.onamsecurity.com/resources/blog/onam-vs-wiz-orca-prisma-cloud Running a proof of concept against Wiz, Orca Security or Prisma Cloud? These are the seven questions to ask during the POC that actually separate the platforms — with Onam's answers on the record, and a checklist to score every vendor on your shortlist. Buyer's Guide Sun, 19 Jul 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/cdr-behavioral-threat-detection https://www.onamsecurity.com/resources/blog/cdr-behavioral-threat-detection Rule-based detection catches known attack signatures. Statistical behavioral baselines catch incremental privilege escalation. ML anomaly detection catches the rest. Here's why you need all three. CDR Tue, 14 Jul 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/aws-misconfigurations-first-scan https://www.onamsecurity.com/resources/blog/aws-misconfigurations-first-scan After thousands of first-time AWS scans, the same five misconfigurations show up in nearly every environment. Here's what they are — and how to fix them fast. CSPM Thu, 09 Jul 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/ciem-vs-iam-security https://www.onamsecurity.com/resources/blog/ciem-vs-iam-security They sound identical. They aren't. Here's the practical split between IAM Security and Cloud Infrastructure Entitlement Management — and why you need both. Identity Thu, 02 Jul 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/ai-powered-cloud-remediation https://www.onamsecurity.com/resources/blog/ai-powered-cloud-remediation The average MTTR for cloud security findings is 47 days. AI-powered remediation — context-aware code fixes, Ansible playbooks for CVEs, and threat narratives — is how we close that gap. Engineering Mon, 29 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/attack-path-4000-to-3 https://www.onamsecurity.com/resources/blog/attack-path-4000-to-3 Most CSPM tools surface hundreds of misconfigurations. The ones that actually lead to breaches are the ones that chain together — and most tools can't show you which chains are dangerous. Attack Path Tue, 23 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/fair-model-cloud-risk https://www.onamsecurity.com/resources/blog/fair-model-cloud-risk CVSS scores rank vulnerability severity. FAIR answers the question your board actually cares about: what does this attack surface cost if it's breached? Here's how we apply it at Onam. Risk Tue, 16 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/kubernetes-rbac-pitfalls https://www.onamsecurity.com/resources/blog/kubernetes-rbac-pitfalls A ClusterRoleBinding here, an aggregated role there — and suddenly your read-only role can create pods that mount the host filesystem. Six patterns to audit today. Containers Tue, 09 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/epss-over-cvss https://www.onamsecurity.com/resources/blog/epss-over-cvss CVSS tells you how bad a vulnerability could be. EPSS tells you how likely it is to be exploited in the next 30 days. Guess which one predicts breaches. Vulnerability Tue, 02 Jun 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/why-cloud-iam-permissions-are-never-used https://www.onamsecurity.com/resources/blog/why-cloud-iam-permissions-are-never-used Your IAM policies are accumulating unused permissions faster than your team can audit them. Here's what the data shows and how to close the gap. Identity Wed, 27 May 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/mitre-attack-cloud-mapping https://www.onamsecurity.com/resources/blog/mitre-attack-cloud-mapping How MITRE ATT&CK for Cloud translates abstract threat techniques into concrete cloud misconfigurations — and how your posture score tracks each one. Threat Detection Tue, 19 May 2026 18:30:00 GMT https://www.onamsecurity.com/resources/blog/agentless-cloud-security-architecture https://www.onamsecurity.com/resources/blog/agentless-cloud-security-architecture A technical deep-dive into how Onam scans dozens of cloud services across 7 clouds using only read-only access — no agents, no network changes, no configuration drift. Engineering Tue, 05 May 2026 18:30:00 GMT https://www.onamsecurity.com/learn/cspm https://www.onamsecurity.com/learn/cspm Cloud Security Posture Management (CSPM) is the continuous, automated inspection of cloud infrastructure configuration for misconfigurations, policy violations and compliance drift. It reads cloud provider APIs to evaluate resources — storage buckets, databases, security groups, IAM roles — against a rule set, then reports what is misconfigured and how to fix it. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/cnapp https://www.onamsecurity.com/learn/cnapp A Cloud-Native Application Protection Platform (CNAPP) is a single platform that combines cloud posture management, workload protection, identity entitlement analysis, data security and runtime threat detection on one shared data model — so risks that span those domains are correlated rather than reported separately. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/cwpp https://www.onamsecurity.com/learn/cwpp A Cloud Workload Protection Platform (CWPP) secures the compute workloads running in a cloud environment — virtual machines, containers, serverless functions and managed hosts — by inspecting what is installed and running inside them, rather than how the surrounding cloud infrastructure is configured. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/ciem https://www.onamsecurity.com/learn/ciem Cloud Infrastructure Entitlement Management (CIEM) determines the effective permissions of every identity in a cloud environment — human users, service accounts and machine identities — after policies, role chains, service control policies and permission boundaries are resolved, then compares that against permissions actually used. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/dspm https://www.onamsecurity.com/learn/dspm Data Security Posture Management (DSPM) discovers where sensitive data resides across cloud storage, databases and warehouses, classifies it by sensitivity, and determines which identities and network paths can reach it — shifting the security question from how a store is configured to what is actually inside it and who can read it. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/sspm https://www.onamsecurity.com/learn/sspm SaaS Security Posture Management (SSPM) continuously assesses the configuration and identity posture of SaaS applications — such as Microsoft 365, Google Workspace, GitHub and Snowflake — detecting misconfigured sharing settings, unprotected admin accounts, excessive permissions and disabled audit logging. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/cloud-attack-path https://www.onamsecurity.com/learn/cloud-attack-path A cloud attack path is a chain of individually low- or medium-severity findings that together create a route from an entry point — usually the public internet — to a high-value asset such as a database holding sensitive data. Attack path analysis computes these chains across posture, identity, network and workload data. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/agentless-cloud-security https://www.onamsecurity.com/learn/agentless-cloud-security Agentless cloud security assesses cloud infrastructure and workloads without installing any software on them. Configuration is read through cloud provider APIs with read-only credentials, and workload contents are inspected by analysing point-in-time volume snapshots out-of-band, so nothing runs on the systems being scanned. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/cloud-risk-quantification https://www.onamsecurity.com/learn/cloud-risk-quantification Cloud risk quantification is the practice of expressing security risk as a financial figure — a probable dollar loss — rather than a severity label or a proprietary score. It commonly uses the FAIR model (Factor Analysis of Information Risk), which combines how often a loss event is likely to occur with how much that event would cost. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/choke-point https://www.onamsecurity.com/learn/choke-point A choke point is a single resource — often an over-privileged identity or a shared network node — that appears on a large number of distinct attack paths. Because so many routes pass through it, remediating one choke point removes more risk than fixing many isolated findings, which makes it the highest-leverage fix in a cloud environment. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/kspm https://www.onamsecurity.com/learn/kspm Kubernetes Security Posture Management (KSPM) is the continuous evaluation of Kubernetes clusters against security baselines — RBAC bindings, pod security context, network policy, admission control and secrets handling. It reads cluster state through the Kubernetes API and reports which objects violate policy, why it matters, and how to correct it. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/code-security https://www.onamsecurity.com/learn/code-security Code security is the practice of finding security defects in the artefacts that build a system — application source, dependencies, infrastructure-as-code templates and pipeline configuration — before they are deployed. It combines static analysis, dependency analysis, IaC scanning and secret detection, applied continuously as code changes. Learn Thu, 06 Aug 2026 00:00:00 GMT https://www.onamsecurity.com/learn/secrets-management https://www.onamsecurity.com/learn/secrets-management Cloud secrets management is the practice of storing, distributing, rotating and auditing credentials — API keys, database passwords, tokens and certificates — so that no application holds a long-lived secret in code or configuration. Secrets live in a dedicated store, are fetched at runtime, and every access is logged. Learn Thu, 06 Aug 2026 00:00:00 GMT