ACSETalk to us
  1. Home
  2. Learn
  3. What is CSPM?

Guide

What is cloud security posture management?

Cloud security posture management, or CSPM, is the practice of continuously checking how your cloud is configured against a known good baseline. It answers a simple question at scale: is anything set up in a way that exposes you?

Talk to usSee how it works
Detection across the estateChecks pass over every resource. Most pass; three fail and are labelled with the reason: public access, a plain HTTP listener, and storage not encrypted at rest.public accessplain http listenerunencrypted at restCHECKS RUN IN YOUR ACCOUNTread-only · on a schedule or on demand
01

Know what CSPM is for

It finds misconfigurations: settings that leave a resource more open than intended.

02

Know where it stops

Posture is one discipline among several. Knowing the boundary avoids false confidence.

03

Know why findings pile up

Finding problems is the easy part. Most programs stall at fixing and proving.

The idea

Posture, in plain terms

Your cloud provider secures the infrastructure underneath. How you configure what you build on it is yours. A storage bucket left open to the public, a load balancer that accepts plain HTTP, an encryption setting left off: these are misconfigurations, and they are among the most common causes of cloud exposure.

Posture is the sum of those settings across every account and project. CSPM reads them continuously, compares them with a baseline such as a benchmark or a regulatory framework, and reports what fails.

Three layers of one systemYour cloud estate on top, the risk graph that connects its findings in the middle, and the signed evidence chain underneath.DETECT · YOUR ESTATEaws · google cloud · azure · k8sFIX · THE PATH THAT MATTERSrisk graph · attack pathsPROVE · THE RECORDsigned · in your cloud

How it works

Four steps, on every scan

  1. Read the configurationThrough read-only cloud APIs, the tool lists resources and their settings across accounts, projects and subscriptions.
  2. Normalize itSettings from different services and clouds are mapped to common shapes, so one rule can apply to many resources.
  3. Evaluate checksEach check tests one setting and returns pass, fail or unknown. Checks are mapped to the framework controls they support.
  4. Report and trackFailures become findings with a severity. Posture scores per framework show the trend over time.
Controls mapped to checksA layer of framework controls for PCI DSS, NIST, ISO, SOC 2 and CIS sits above the layer of checks that evaluate them; one failing check is traced to the control it affects.PCINISTISOSOC 2CISCONTROLSeach framework versioned and signedCHECKSone check can satisfy many controls

Scope

What CSPM covers, and what it doesn’t

Cloud security is several disciplines. Platforms often bundle them, but each answers a different question.

01

Posture (CSPM)

Is the cloud configured safely? Settings on storage, networks, identities, encryption and logging.

02

Workload scanning

Do the machines and containers run vulnerable software? A separate discipline.

03

Data security posture

Where is sensitive data, and who can reach it? A separate discipline.

04

Threat detection

Is someone attacking right now? Runtime and activity monitoring, a separate discipline.

Where programs stall

Finding is the easy part

01

Findings without owners

Thousands of findings land in a queue no team owns. The backlog grows faster than it shrinks.

02

Fixes that drift back

A setting changed in the console is reverted by the next infrastructure-as-code deploy.

03

Status that isn’t proof

A green dashboard shows today’s state. It doesn’t show an auditor how, when or by whom a fix was made.

How ACSE approaches it

Detection that leads to a governed fix

ACSE’s checks run in your own account as deterministic policy, across AWS, Google Cloud and Azure. A fact ACSE can’t establish is reported as unknown, and unknown never counts as a pass.

Each finding is the start of a case, not the end of a report: ACSE finds the code that owns the resource, proposes a validated fix as a draft pull request, and records the decision, the deployment and the verification as evidence you keep.

  • Misconfiguration detection only, stated plainly
  • Checks mapped to the frameworks you report on
  • Every finding can end in a sealed record
A fix you can readA storage bucket shown as an exploded drawing. Versioning and encryption are already in place; the public access block is the change ACSE proposes, as a draft pull request.VERSIONINGenabled · checkedPUBLIC ACCESS BLOCKthe fix · in a draft prDEFAULT ENCRYPTIONaws:kms · checkedaws_s3_bucket.data

Questions

What people ask us

Is CSPM the same as a CNAPP?

No. A cloud-native application protection platform usually bundles CSPM with workload scanning, identity analysis and other capabilities. CSPM is the posture part.

How often should posture be checked?

Continuously, or at least on a frequent schedule and after changes. Cloud configuration changes daily, and a point-in-time check goes stale quickly.

What does “unknown” mean in a posture check?

The tool couldn’t establish the fact, often because a permission was missing. A careful program treats unknown as not compliant until shown otherwise.

Does ACSE replace a CSPM tool?

It can be your posture tool, and it can also work alongside one you have. See how ACSE works with your tools.

Keep reading

Related

Learn

Attack path analysis

Attack path analysis links cloud findings into a route from the internet to your data. Learn the building blocks, how to prioritize and where paths stop.

ReadPlatform

Detect

ACSE checks every resource in your clouds against the frameworks you choose, from inside your own account, and explains each finding in plain words.

ReadACSE

Why ACSE

ACSE sits beside your cloud security platform and cloud-native tools. They find; ACSE adds the governed fix and the evidence, and can fix what other tools find.

Read

Talk to us

See ACSE on your cloud.

Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.

Talk to usExplore the platform