Cloud security is the set of products that check a company's own part of the cloud: the programs it runs on a cloud provider's servers, the settings of its cloud accounts, and the settings of the business software it rents. The cloud provider looks after the buildings and the machines. The company is responsible for everything it puts inside. This split is called the shared responsibility model.
Consider a 250-person online grocery company in Mumbai. Its app runs on servers rented from a large cloud provider. Its staff use email, a CRM and an HR system, all rented over the internet as SaaS (software as a service). None of these sit behind an office firewall. So the old questions, such as whether the firewall is set up correctly, matter less. The new questions are about settings and about running programs.
The first question is about the cloud settings. Is any storage folder in the cloud open to the whole internet? Can anyone outside reach a database? Cloud security posture management (CSPM) checks the settings of every cloud account against a list of rules. Many CSPM tools check a setting as soon as it changes, and check every account again at least once a day. A wrong setting is called a misconfiguration. Misconfigurations cause many cloud breaches.
The second question is about the running programs. The grocery company's app runs in containers, packaged pieces of an app that run on shared servers. A system called Kubernetes starts and stops them. The page on containers and Kubernetes explains both. Cloud workload protection (CWPP) watches these containers while they run. For example, it notices if a container suddenly starts a program that it has never run before.
The third question is about the rented software. Which of the CRM's thousands of settings lets an outsider read customer records? Which outside app has been given access to everyone's email? SaaS security posture management (SSPM) checks these settings. Its newest task is checking the AI tools and AI agents that staff have connected to company data. The page on AI agent guardrails explains why an agent's access matters.
Other tools complete the picture. Cloud infrastructure entitlement management (CIEM) checks who and what has permission to do what in the cloud. Code and containers are checked before they go live, in application security. What staff do inside the rented apps is watched by a cloud access security broker (CASB), part of network security. Many large security companies now sell CSPM, CWPP and these other checks together, as one platform.