Cloud security posture management (CSPM) is software that checks the settings of a company's cloud accounts all the time, and reports any setting that leaves data or systems exposed. Posture here means the overall state of the security settings. The best-known example of what it finds is a storage bucket left open to the internet.
A company that uses the cloud rents servers, databases and storage from a cloud provider such as AWS, Microsoft Azure or Google Cloud. Each of these comes with many settings. Who may read this storage? Can anyone on the internet reach this database? Is the activity log switched on? Is the data encrypted? A developer can change any of these settings in a few seconds. Under the shared responsibility model, the settings are the customer's job, not the cloud provider's.
A storage bucket is a folder in the cloud's object storage, where files such as images and documents are kept. If a bucket is set to public, anyone who finds its address can download every file in it. Attackers run programs that search for such buckets all day.
CSPM connects to each cloud account with read-only access. It reads every setting through the cloud provider's APIs. Many tools check a setting again as soon as it changes, and they recheck every account at least once a day. It compares each setting with hundreds of rules. Many rules come from the CIS Benchmarks, published lists of recommended settings for each cloud. The software then ranks the problems it finds. A public bucket full of personal data comes first. A missing label on a test server comes last.
Take, for example, a chain of diagnostic labs in Hyderabad that keeps 3 lakh patient reports as files in a bucket. In March, a developer makes the bucket public for a quick test, and forgets to change it back. Within the hour, CSPM reports the public bucket as its most serious finding. It names the cloud account, the bucket and the person who changed the setting. The team makes the bucket private again the same morning. In the same check, CSPM also finds a database that accepts connections from the whole internet, and an account where the activity log is switched off.
Some CSPM tools fix simple problems automatically, such as making a bucket private again. The findings also go to the SIEM, or to an outside managed detection and response (MDR) provider. Auditors and regulators want proof that the settings are checked. So the results also go to compliance automation software.
CSPM checks settings. Two related tools check other things. Cloud infrastructure entitlement management (CIEM) checks who has permission to do what. Cloud workload protection (CWPP) watches the programs while they run.