4.2.2. Cloud Security Posture Management (CSPM)
💡 First Principle: CSPM is the discipline (and the specific Defender for Cloud capability) of continuously scanning cloud resource configurations against security best practices and compliance benchmarks, surfacing misconfigurations — like an exposed storage account or a missing encryption setting — before an attacker finds them first.
CSPM is fundamentally about configuration, not runtime attacks — it answers "is this resource set up correctly?" rather than "is this resource currently under attack?" (the latter is cloud workload protection, 4.2.4). Defender for Cloud's free tier includes foundational CSPM for every connected subscription automatically.
⚠️ Exam Trap: CSPM identifies misconfigurations and posture gaps — it is a preventive/detective posture capability, not the same as active threat detection during an ongoing attack.
Reflection Question: A storage account is accidentally configured to allow public read access. Would this be caught by CSPM, by active workload protection, or both — and why?
