CSPM Triage Lab: Prioritise Multi-Cloud Findings
You work a fictional multi-cloud findings queue and decide what actually gets fixed first. Rank by reachability and data value instead of severity, break a toxic combination, route findings to owners, handle duplicates and false positives, put guardrails on auto-remediation and stop the same finding coming back. New to the term? Read What is CSPM? first.
You are Jordan Lee, the cloud security lead at Harbor & Pine Foods, a fictional food distributor (harborpine.example) running on AWS, Azure and Google Cloud. A new posture tool has produced a queue of findings and every one says "high". Across 11 decisions you prioritise by exposure and attack path rather than severity alone, route findings to owners, handle duplicates and false positives, set guardrails on auto-remediation and stop the same finding coming back. Everything is fictional: the company, the accounts, the resources and the story numbers. No commands or templates appear. Each call is scored 0 to 10 with the vendor documentation behind the rationale.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab for cloud security engineers and leads: a fictional food distributor (harborpine.example) on AWS, Azure and Google Cloud has a queue where everything says "high", and you make 11 scored decisions.
- Topics: exposure versus severity, attack paths and toxic combinations, defining high-value assets, ownership and due dates, duplicate findings, false positives, time-limited risk acceptance, auto-remediation guardrails, automation rules, score versus risk and preventing drift.
- Every rationale cites the vendor documentation behind it, read on 4 November 2026. Where a step is PlayCISO practice rather than a vendor statement, the feedback says so.
- Free to play, no sign-up needed to run it. A final score and grade, a shareable scorecard and next-step links.
- Defensive and educational only. The company, accounts and resource names are fictional, with documentation-reserved identifiers; nothing connects to a real cloud.
How this lab differs from the other posture tools here
The CSPM Readiness Scorecard is a maturity self-assessment of your programme. The Cloud Posture Lab is a single misconfiguration console where you fix settings. This lab sits between them: the findings already exist, and your job is judgement across clouds. For tool selection, see the CNAPP Selector, the CNAPP guide and open-source CSPM.
Frequently asked questions
What is CSPM triage?
CSPM (cloud security posture management) tools produce long lists of misconfiguration findings. Triage is deciding which to fix first, who fixes them, which to exempt and which to automate. The hard part is ranking: Microsoft and Google both describe attack paths from external entry points to valuable assets as the way to find the highest-risk issues, rather than reading severity labels one by one.
How is this different from the CSPM Readiness Scorecard?
The scorecard is a maturity self-assessment: it tells you how ready your programme is. This lab is hands-on: you work a fictional queue of findings and make scored prioritisation, routing and automation calls.
How is this different from the Cloud Posture Lab?
The Cloud Posture Lab is a single-console exercise in fixing individual misconfigurations. The triage lab starts after the tool has found everything and asks which findings matter, who owns them, which are noise and how to stop them recurring, across AWS, Azure and Google Cloud.
Why not just sort by severity?
Severity describes one issue in isolation. Attack path analysis looks at whether an attacker can reach the issue from outside and what it leads to, and Google describes toxic combinations as findings worth prioritising because the combination creates the route. A medium finding on a reachable server can matter more than a critical on an isolated one.
Is auto-remediation safe?
It can be, if you choose what to automate. AWS Config lets you pick manual or automatic remediation per rule and set retries. The lab's position, which is PlayCISO practice rather than a vendor statement: automate reversible, well-understood fixes in non-production first, with a limited-permission role, and keep approval for production.
Does it need cloud accounts?
No. It is a decision lab in your browser with fictional resources and documentation-reserved identifiers. You do not connect to any cloud or enter account details.
Can I download my debrief?
The debrief is shown on the page for free. Downloading it as Word, PDF or Markdown needs a paid plan.
Sources
Read on 4 November 2026. Written in our own words; no vendor or standards text is reproduced.
- Microsoft Learn: What is Cloud Security Posture Management (CSPM), Microsoft Defender for Cloud
- Microsoft Learn: Security explorer and attack paths in Microsoft Defender for Cloud
- Microsoft Learn: Drive recommendation remediation by using governance rules (Defender for Cloud)
- Microsoft Learn: Exempt resources from recommendations (Defender for Cloud)
- Google Cloud: Overview of attack exposure scores and attack paths (Security Command Center)
- Google Cloud: Security Command Center overview
- AWS Documentation: What is AWS Security Hub CSPM?
- AWS Documentation: Understanding automation rules in Security Hub CSPM
- AWS Documentation: Remediating noncompliant resources with AWS Config
- AWS Documentation: Setting up auto remediation for AWS Config rules
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.