Security guide

What Is CSPM? Cloud Security Posture Management Guide

Cloud security posture management (CSPM) is continuous checking of your cloud configuration, plus guidance on what to fix. A CSPM tool inventories resources across accounts, tests them against security controls and reports misconfigurations. The skill that separates a useful programme from a noisy one is triage: deciding which findings sit on a route to something valuable, who owns them and which can wait.

This guide covers how CSPM works, how to prioritise, how to route and exempt findings, where automation helps and where it bites, and what CSPM does not cover. Product behaviour is cited from Microsoft, Google Cloud and AWS documentation read on 4 November 2026.

Updated 4 November 2026 (last reviewed)

TL;DR

The short version

5 points

CSPM = continuous visibility into cloud configuration plus guidance, across AWS, Azure and Google Cloud.
Rank by attack path and data value, not by severity labels; toxic combinations are one problem split across several rows.
Route every finding to an owner with a due date; track by owner, not by the security team's inbox.
Handle noise with scoped, expiring exemptions and narrow automation rules, never by disabling checks wholesale.
Automate only safe, reversible fixes first, and add preventive guardrails so the same finding stops coming back.

How CSPM works

A CSPM service connects to your cloud accounts, builds an inventory of resources and evaluates them against controls. Microsoft's Defender CSPM offers a foundational tier and a paid tier with attack path analysis and risk prioritisation; AWS Security Hub CSPM runs security control checks and also ingests findings from other AWS services and partner products so you can work from one view; Google's Security Command Center detects misconfigurations, exposed resources and leaked credentials and lets you define a posture and watch for drift.

Sources (accessed 4 November 2026): Defender CSPM overview; Security Hub CSPM; Security Command Center overview.

Prioritise by path, not by label

An attack path, in Microsoft's words, is a series of steps an attacker uses to breach an environment and reach assets, starting at an external entry point such as an internet-exposed vulnerable resource. Google's Risk Engine simulates attacks against a set of high-value resources you define, and it surfaces toxic combinations and chokepoints. Practical consequences:

Define your high-value resources (crown jewels) with data owners. Google's attack path scoring depends on that set being defined.
A medium finding that sits on a reachable route can outrank a critical on an isolated resource. This is our synthesis of the documentation, not a vendor rule.
Break a path where it is cheapest and most certain, then schedule the rest.

Sources (accessed 4 November 2026): Attack paths; SCC attack exposure.

Owners, exemptions and automation rules

Ownership. Defender for Cloud governance rules can assign an owner and a due date of 7, 14, 30 or 90 days to recommendations, so remediation has a service-level agreement.
Exemptions. Record scope, justification and review period for false positives, compensating controls, deferrals and accepted risks, and reassess at expiry. Be careful: an exemption marked as mitigated counts as healthy in the score.
Automation rules. Security Hub CSPM automation rules can suppress findings, change severity and add notes for findings that match criteria. Keep the criteria narrow and review them.

Sources (accessed 4 November 2026): Governance rules; Exempt resources; Security Hub automation rules.

Auto-remediation: stage it by blast radius

AWS Config lets you remediate noncompliant resources with managed automation documents, choose manual or automatic remediation per rule, and configure retries that apply only when remediation fails. The rule of thumb in our lab, which is PlayCISO practice rather than a vendor statement: automate reversible fixes with limited permissions in non-production first, keep approval for production, and notify owners.

Sources (accessed 4 November 2026): AWS Config remediation; AWS Config auto-remediation.

What CSPM does not do

It is not runtime threat detection for workloads, and it does not govern SaaS apps (see What is a CASB?).
A score is a trend. Microsoft says a higher score means lower identified risk, but a rising score can coexist with an open path to critical data.
Fixing after the fact is detective. Pair it with preventive guardrails such as deny policies so the same misconfiguration is not recreated.
AI systems add assets a classic CSPM may not model: see What is AISPM?

Sources (accessed 4 November 2026): Defender CSPM overview; Security Command Center overview.

Choosing a tool and practising the judgement

If you are choosing, start with the CNAPP Selector, the CNAPP guide and open-source CSPM. To measure programme maturity, use the CSPM Readiness Scorecard. To practise the judgement calls with a queue in front of you, play the CSPM Triage Lab; for single misconfigurations, the Cloud Posture Lab.

Frequently asked questions

What does CSPM stand for?

Cloud security posture management. Microsoft describes it as providing continuous visibility into the security state of cloud assets and workloads, with actionable guidance to improve posture across Azure, AWS and Google Cloud.

What does a CSPM tool actually do?

It inventories cloud resources, checks their configuration against security controls and benchmarks, and produces findings. AWS describes Security Hub CSPM as running checks against security controls and generating control findings, and receiving findings from other services and products for one view.

How should CSPM findings be prioritised?

By reachability and what the issue leads to, not severity alone. Microsoft describes attack paths as steps from an external entry point, such as an internet-exposed resource, toward important assets; Google simulates attack paths to high-value resources and highlights toxic combinations.

Can CSPM fix problems automatically?

Some platforms can. AWS Config, for example, lets you choose manual or automatic remediation per rule and set retries. Automatic fixes change real resources, so start with reversible, low-risk ones in non-production.

How do I handle false positives?

With a scoped exemption that records the justification and a review period, not by disabling the rule everywhere. Microsoft describes exemptions for findings reviewed and judged false positives, covered by another control, deferred or accepted as risk.

What is the difference between CSPM, CNAPP and CASB?

CSPM checks cloud account configuration. CNAPP is a broader platform that usually adds workload protection and code scanning. CASB governs SaaS app use and the data inside. See the linked guides.

How can I practise triage?

Try the free CSPM Triage Lab: eleven scored decisions on a fictional multi-cloud findings queue.