What is CSPM?
CSPM stands for Cloud Security Posture Management.
CSPM, or Cloud Security Posture Management, is the continuous assessment of cloud accounts against configuration baselines to find misconfigurations — public storage, over-broad permissions, missing encryption, disabled logging — and track them as they drift over time.
In depth
Understanding CSPM
Cloud breaches are overwhelmingly configuration failures rather than software vulnerabilities: a storage bucket made public, a security group opened to the internet, an access key that outlived the person who created it. None of these is a bug in the provider's software, so no patch fixes them.
CSPM works by reading cloud configuration through the provider's own APIs — normally with a scoped read-only role — and grading resources against a benchmark. The CIS Foundations benchmarks are the common baseline, with framework-specific rulesets layered on top where they exist.
The word that carries the weight is posture, not scan. A single audit produces a snapshot; posture is the ongoing state, which means drift detection matters as much as the initial finding. A correctly configured account that becomes misconfigured on a Tuesday is the case CSPM exists for.
In RedStrike
How RedStrike handles CSPM
RedStrike audits AWS accounts, Azure subscriptions, GCP projects, and Kubernetes clusters against CIS Foundations benchmarks using scoped read-only role delegation and short-lived credentials — long-lived keys never leave your environment. On AWS, framework-labelled rulesets are also available for PCI DSS, HIPAA, SOC 2, GDPR, ISO 27001, NIST SP 800-53, and NIST CSF. Azure, GCP, and Kubernetes have CIS benchmarks only; that asymmetry comes from the underlying auditing engine and is stated wherever cloud coverage is described.
See also
Related terms
FAQ
Frequently asked questions
Common questions about CSPM.
How is CSPM different from my cloud provider's native security tools?
Native tools live in one cloud and one console — AWS Security Hub sees AWS, Azure Defender sees Azure. A CSPM platform unifies providers under one benchmark and one severity model, which matters as soon as you run more than one cloud or need a single number to report.
Does CSPM need an agent installed?
No. CSPM reads configuration through the provider's management APIs, normally with a read-only role. It is agentless by nature, which is also why it sees configuration rather than what is happening inside a running workload.
What does CSPM not cover?
It reads configuration, so it does not test your application's logic, find vulnerabilities in your code, or observe runtime behaviour inside a workload. A public bucket is a CSPM finding; a broken authorization check in your API is not.
See CSPM in practice
Run continuous, verified security testing across your applications, APIs, and cloud accounts.