Cloud Security Posture Management (CSPM)

What it is

CSPM tools continuously scan a cloud environment against security best practices and compliance baselines, flagging misconfigurations — a public storage bucket, an overly permissive security group — automatically and continuously.

Key points

• Why continuous, not one-time: cloud environments change constantly as teams self-serve infrastructure — a one-time audit is stale within days; CSPM re-checks continuously.
• Misconfigurations, not just vulnerabilities: CSPM's focus is distinct from vulnerability scanning — it catches "this is configured wrong" (a public S3 bucket) rather than "this software has a known CVE."
• Prioritization matters: CSPM tools generate a large volume of findings — the practical skill is triaging by actual exploitability and blast radius, not treating every finding as equally urgent.
• Auto-remediation for well-understood, low-risk findings (tagging, minor policy tightening) reduces the backlog, freeing human review for findings that need actual judgment.