What CSPM checks
A CSPM tool connects to your cloud provider with read access and compares how each resource is configured against known-good practice. Typical checks:
- Exposure: storage buckets readable by anyone, databases and virtual machines reachable from the internet, security groups or firewall rules open to 0.0.0.0/0.
- Identity: roles and users with admin or wildcard permissions, unused access keys, missing multi-factor authentication, roles that workloads don't need.
- Data protection: unencrypted volumes, snapshots and buckets, and backups shared outside the account.
- Visibility: audit logging (CloudTrail, Cloud Audit Logs) turned off, or logs that anyone can delete.
- Compute hygiene: instances without IMDSv2 on AWS, outdated images, and serial-console or SSH access left open.
Why a list of findings isn't a status
Most accounts produce hundreds of findings on the first scan. Ranked by severity alone, a public test bucket with nothing in it sits next to a production database open to the internet. Teams either try to fix everything and stall, or stop reading the list.
The questions people actually ask are different: can someone on the internet reach our customer data, through which resources, and what is the single change that closes that route? Answering them needs context the individual findings don't have.
Context that changes the ranking
- Reachability: is the resource exposed to the internet, directly or through a load balancer?
- Identity: which role does the workload run as, and what can that role read or change?
- Data: does the path end at a data store you've marked as sensitive, for example with a data-class=pii tag?
- Environment: is it production, or a sandbox you can deal with later?
From findings to attack paths
Put those together and findings link up into routes: an internet-facing instance with a known vulnerability, running as a role that can read a bucket of customer records. That route is an attack path, and breaking its weakest link often closes several findings at once. See what attack path analysis is.
What to look for in a CSPM tool
- Read-only access you can audit and remove, ideally a role with an external ID rather than long-lived keys.
- A ranking by what an attacker could reach, not only by severity.
- Fixes written for your resources (CLI, Terraform, CloudFormation or console steps), not just a link to a benchmark rule.
- A rescan that checks the fix worked and closes the issue by itself.
- Code and cloud in one view, so a vulnerable dependency on an exposed server comes first.