CSPM
CSPM continuously checks how the cloud environment is configured against good-practice and compliance rules: which buckets are public, which identities hold too many rights, where encryption is off, where logging is off. Instead of someone clicking manually through the console, the tool watches the whole account or subscription and flags when a setting drifts into danger.
Term
description · examples · notesCSPM continuously checks how the cloud environment is configured against good-practice and compliance rules: which buckets are public, which identities hold too many rights, where encryption is off, where logging is off. Instead of someone clicking manually through the console, the tool watches the whole account or subscription and flags when a setting drifts into danger.
Description
In practice you get a list of concrete misconfigurations ranked by risk — 'this bucket is public', 'this role can be assumed by anyone', 'these databases aren't encrypted' — often with the option to fix automatically or open a ticket. You know where you stand instead of guessing.
The value is speed: the cloud changes in seconds, a developer opens a bucket in an instant, and a manual review once a quarter never catches it in time. CSPM closes the gap between 'we changed something' and 'someone noticed it's dangerous'.
What people often say
- 'CSPM secures our cloud' — no, it tells you where it's insecure; the fix is still on you
- 'If CSPM is green, we're safe' — it checks configuration, not whether an attacker is already inside
Covers / does not cover
Covers
- Detecting cloud misconfiguration (storage, identity/access, network, encryption, logging)
- Mapping to compliance
- Flagging drift across multiple accounts
Does not cover
- It doesn't stop someone from misconfiguring — it reports after the fact
- It doesn't protect the data content itself
- It doesn't cover application-code vulnerabilities
- It doesn't replace IAM or PAM — it watches them
Notes
- CSPM sees the mistake but doesn't fix the culture that makes it. If someone keeps reopening the bucket, the problem is in the process, not the tool.
Mentioned in the news
Threats
reduces 5Threats it reduces. Select one to open its page.
Techniques
neutralizes 3Techniques it neutralizes. Select one to open its page.