Why most teams start with cloud posture management

Why is posture the usual first step?

Three reasons. It needs only read-only API access, so there is nothing to deploy on workloads and no change request for every team. It covers every resource in a connected account, including the ones nobody remembered creating. And the findings are concrete: this bucket is public, this database has no encryption, this account has logging switched off.

What does a first posture scan usually show?

Patterns rather than one-offs. The same open setting repeated across accounts because it came from one template; development accounts with looser settings than production; resources in regions nobody uses. Because the cause is often a template, the durable fix is in code, which is why posture tools increasingly scan infrastructure as code too.

Where does posture stop?

At the workload boundary. A posture tool can say a virtual machine accepts traffic from the internet; it cannot say what software runs on it or whether an attacker is active there. For that you need workload protection, either agentless (reading a copy of the disk) or with a sensor.

It also stops at intent. A posture tool reports that a role is wide; it takes CIEM to show the role never uses most of what it has.

Is a free tier enough to start?

It can be for a first look. Microsoft Defender for Cloud includes a free Foundational CSPM tier, and Microsoft says it becomes opt-in for new Azure subscriptions from 27 October 2026. Attack paths, agentless scanning and data checks sit in its paid Defender CSPM plan. Other vendors on this site do not publish a free tier on the pages we read.

When is posture not first?

When the estate is mostly virtual machines with sensitive workloads and few accounts, workload protection may come first. When sensitive data is the main concern, DSPM may. The finder weighs these from your answers.