What is CSPM?
Cloud security posture management (CSPM) is a class of tools that watch the configuration of cloud accounts, subscriptions and projects and report settings that break security policy. In infrastructure and platform services, the provider secures the hardware and the underlying platform, but the customer configures identities, network rules, storage permissions, encryption and logging. Those settings change constantly through console clicks, scripts and deployment templates, and one wrong value can expose data to the whole internet. CSPM exists to catch that drift soon after it happens rather than at the next audit.
How CSPM works
- Connect: the tool receives a read-only role in each cloud account and reads configuration through the provider's APIs. No agent runs inside the virtual machines.
- Inventory: it lists every resource across accounts and regions, which often turns up forgotten ones.
- Evaluate: it compares each resource with policy rules drawn from sources such as the CIS Foundations Benchmarks, the provider's own best practices and compliance frameworks like PCI DSS.
- Alert and fix: findings go to a console, a ticketing system or the SIEM, ranked by severity. Many tools can remediate automatically, though teams usually limit that to low-risk rules, since an automatic change can break a working application.
Each major provider offers native posture features, such as Microsoft Defender for Cloud, AWS Security Hub and Google Security Command Center, and third-party tools cover several clouds from one console.
Example: findings from one evaluation
| Rule | Resource | Severity |
|---|---|---|
| Database snapshot shared publicly | orders-db-snap-0412 | Critical |
| Root user has no MFA | Account billing-prod | Critical |
| Access key unused for 400 days and still active | User ci-deploy-old | High |
| Audit logging disabled in a region | eu-west-2 | High |
None of these is a software vulnerability, and a traditional scanner would report none of them. The 2019 Capital One breach showed what this layer can cost: a server-side request forgery flaw let an attacker obtain credentials for a cloud role that could read far more storage than its job required.
CSPM vs. vulnerability scanning vs. CASB vs. CWPP
- CSPM checks the cloud control plane: accounts, identities, network rules, storage settings and logging.
- Vulnerability scanning checks the software inside hosts and containers for missing patches and known CVEs.
- CASB (cloud access security broker) governs how users reach and use SaaS applications, enforcing access and data policies.
- CWPP (cloud workload protection platform) protects running workloads such as virtual machines, containers and serverless functions.
Products that bundle posture management, workload protection and related features are often sold as a cloud-native application protection platform (CNAPP). Scanning infrastructure-as-code templates before deployment catches the same misconfigurations even earlier, before they reach a live account.
CSPM on the CompTIA Security+ exam
CSPM is part of SY0-801 objective 4.3, where it is one of the ways to identify vulnerabilities, along with scanning, IPAM and code review. Wording such as "continuously detect cloud misconfigurations," "a storage bucket was made public," "cloud accounts drifting from the benchmark" or "check many cloud accounts against compliance rules" points to CSPM. Distractors include a vulnerability scanner, which looks inside hosts rather than at cloud settings; a CASB, which controls user access to cloud apps; and a quarterly audit, which is far too infrequent for settings that can change in seconds.