What is CSPM? Cloud security posture management explained
What does a CSPM tool do?
A posture tool connects to each cloud account with read-only API access and builds an inventory of resources and their settings. It compares those settings with policies, from built-in rule sets to your own, and reports what does not match.
Most CSPM tools map findings to compliance frameworks so the same scan produces an audit view, and many can track drift: a setting that was correct yesterday and is not today.
Because it works from APIs, a CSPM covers every account it is connected to, including resources nobody remembered creating.
When do you need CSPM?
- You run more than a handful of cloud accounts or subscriptions.
- You need continuous evidence for compliance reviews.
- You cannot install agents yet but need visibility now.
- Several teams create cloud resources and you need a single view of how they are configured.
When is CSPM not enough?
Posture is the outside view of a resource. A CSPM can tell you a virtual machine is reachable from the internet; it cannot, on its own, tell you that the machine runs a vulnerable package or that an attacker is active on it. That takes workload scanning (agentless snapshots or an agent) and runtime detection. A CSPM also reports what is wrong; fixing it at scale needs the change to land in code or pipelines.
Which finder answers point to CSPM?
- +2 if you pick at least one public cloud
- +2 if you pick two or more public clouds
- +3 if you need continuous compliance reporting
- +1 if you need US public-sector authorization
- +1 if you protect serverless functions
- +1 if you protect AI services, models or agents
Which vendors describe CSPM?
9 of 9 vendors describe CSPM on the pages we read, and 0 are not in our sources.
| Vendor | Status | What their pages say | Source |
|---|---|---|---|
| Aqua Security | Described | CSPM is listed among the capabilities on its pricing page, alongside CWPP, agentless and agent-based scanning and eBPF runtime detection. | Source: Aqua pricing, read . |
| CrowdStrike Falcon Cloud Security | Described | Agentless CSPM enriched with adversary intelligence. | Source: CrowdStrike Falcon Cloud Security, read . |
| Microsoft Defender for Cloud | Described | Foundational CSPM is free; Defender CSPM adds attack path analysis and the cloud security explorer. | Source: Microsoft Learn: Defender for Cloud CSPM plans, read . |
| Orca Security | Described | CSPM and multi-cloud compliance are listed as modules. | Source: Orca Security platform overview, read . |
| Palo Alto Networks Cortex Cloud | Described | Cloud posture security lists CSPM with attack path analysis. | Source: Cortex Cloud posture security, read . |
| SentinelOne Singularity Cloud | Described | CSPM is listed in Singularity Cloud. | Source: SentinelOne Singularity Cloud, read . |
| Sysdig Secure | Described | CSPM is listed. | Source: Sysdig Secure, read . |
| Upwind | Described | CSPM is listed. | Source: Upwind homepage, read . |
| Wiz | Described | Agentless, API-connected scanning of cloud resources, including Alibaba Cloud, as the vendor states. | Source: Wiz extends CNAPP leadership with protection for Alibaba Cloud, read . |
Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.
What should you ask a CSPM vendor?
- Which clouds and account types are supported by name?
- Is there a free or entry tier, and what moves you to a paid tier?
- Can findings be mapped to the frameworks your auditors use?
- Can a finding open a ticket or a pull request in the tools your teams already use?
Frequently asked questions
Is CSPM agentless?
Yes. A posture tool reads configuration through the cloud provider's APIs and installs nothing on workloads.
Is there a free CSPM?
Microsoft Defender for Cloud includes a free Foundational CSPM tier. Microsoft says that from 27 October 2026 it will no longer be enabled by default on new Azure subscriptions, though it remains free.
Does CSPM cover Kubernetes?
Partly. Posture tools read managed Kubernetes service settings through cloud APIs. What runs inside the cluster needs workload scanning or a sensor.