Taking stock of your cloud estate before you choose a tool
Why start with an inventory?
A cloud security tool is a way of looking at an estate. Before choosing how to look, it helps to know what is there. Teams that skip this step tend to buy the tool that demos best rather than the one that covers what they run, and find the gaps after the contract is signed.
What goes on the page?
- Clouds and accounts. List each provider (AWS, Azure, Google Cloud, Oracle Cloud and others) and roughly how many accounts, subscriptions or projects sit in each. Note any private cloud, on-premises servers or disconnected environments that must be covered too.
- Workload types. Virtual machines, containers and Kubernetes clusters, serverless functions, managed databases and storage, and AI services. A rough share of each is enough.
- Sensitive data. Where customer, payment, health or employee data lives, and which teams create new data stores.
- Code and pipelines. Where code is hosted and how it reaches production.
- Owners. Who can change each part, and who would fix a finding.
- Constraints. Whether agents can be installed, which compliance obligations are firm, and which security products are already in place.
How does the page map to tool categories?
Each line points somewhere. Many accounts across several clouds point to posture (CSPM) and identity (CIEM). Virtual machines and clusters point to workload protection (CWPP) and vulnerability management. Sensitive data in many stores points to DSPM. If most lines point somewhere, a CNAPP is worth a look.
The finder asks the same six questions and applies published rules to them, so the inventory doubles as your answers.
What is a common mistake?
Listing only production. Development and test accounts are where public storage and wide permissions tend to appear first, and attackers do not distinguish between them. Another is listing clouds but not regions or providers outside the big three: a vendor that does not name a cloud you run cannot be assumed to cover it.
What next?
With the page done, read how responsibility splits between you and your provider, then use the finder.