Home / Knowledge hub / CSPM
Knowledge hub
CSPM
Tools that keep checking your cloud settings against security good practice.
What it means
Cloud security posture management, or CSPM, is a type of tool that connects to your cloud accounts and keeps checking their configuration against rules. Is a storage bucket public? Is logging switched on? Is multi-factor authentication enforced for the root account? It reports the answers.
The rules usually come from published benchmarks, such as those from the Center for Internet Security, and from the provider's own good practice. The tool reads settings. It does not usually send requests to your application.
Why it matters
Cloud accounts change daily, and a single wrong setting can expose data. A tool that checks continuously catches the mistake made on Tuesday before a stranger finds it on Friday. That matters for audits too, since it produces a record of how settings stood over time.
The risk is false comfort. A clean report means the settings match the rules. It does not mean the application is free of broken access control, injection or logic flaws, which sit above the settings.
How it shows up
You meet CSPM as a dashboard of findings sorted by severity: open storage, unrestricted security groups, unused keys, missing encryption, weak roles. Tools differ in coverage across clouds and in how they prioritise.
Use it for what it is good at, and fix the high-risk items first. Tune it so alerts are meaningful, or alert fatigue sets in. Pair it with testing of the running application, since a correctly configured cloud can still host a vulnerable app. See cloud misconfiguration.
Questions people ask
CSPM, answered
Is CSPM the same as a vulnerability scanner?
No. CSPM reads cloud configuration. A vulnerability scanner looks for known flaws in software and hosts. They answer different questions, and both are useful.
Does CSPM replace a penetration test?
No. It checks settings against rules. A penetration test tries to find and prove flaws in the application and its logic, which settings checks cannot see.
What does a CSPM tool check?
Typically public storage, open ports, encryption, logging, key age, over-broad permissions and compliance against a benchmark. Coverage depends on the product.
Do small companies need it?
Not always as a paid product. Cloud providers include basic checks, and a small estate can be reviewed by hand. The need grows with the number of accounts and the rate of change.
What are its limits?
It sees configuration, not behaviour. It cannot tell whether the application behind an open port is exploitable, and it may report issues that are intended and safe.
Sources
Where this comes from
Related
Terms that sit next to this one
Cloud misconfiguration
A cloud setting left unsafe, such as open storage or an overly broad permission.
Security group
Cloud firewall rules that decide which traffic may reach a server.
Shared responsibility model
The split between what your cloud provider secures and what you must secure yourself.
Vulnerability scanning
Automated checks that look for known weaknesses without proving they can be used.
Cloud penetration testing
Testing cloud accounts and services for weaknesses, within the provider's rules.
Settings clean, app still open?
Cloud settings and application behaviour need separate checks. We test the running application and report what we exploited, with the request and response as proof. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.