Lesson 2 — Cloud Security Posture Management
Cloud Security Posture Management continuously examines cloud environments for weak configurations, excessive exposure, missing controls and relationships that could create a path to critical assets.
Microsoft Defender for Cloud uses assessments, security recommendations, Cloud Secure Score, risk prioritisation, attack paths and Cloud Security Explorer to turn thousands of resource settings into practical security work.
This lesson explains how CSPM works, how foundational and advanced capabilities differ, why a recommendation is more than a warning, how the modern risk-based score should be interpreted, and how Agent Foskett investigates a sudden change in cloud posture.
What you will learn
This lesson shows how Defender for Cloud turns continuous assessment into prioritised posture improvement.
Learning objectives
After completing this lesson, you should be able to explain how Defender for Cloud assesses posture and converts findings into prioritised remediation work.
- Define Cloud Security Posture Management.
- Explain continuous assessment and configuration drift.
- Understand foundational and advanced CSPM capabilities.
- Read a security recommendation correctly.
- Interpret Cloud Secure Score.
- Explain risk-based prioritisation and asset criticality.
- Investigate attack paths and resource relationships.
- Build a repeatable remediation workflow.
What CSPM asks
CSPM continuously asks whether cloud resources are configured securely, whether controls are missing, whether exposure has increased and whether separate weaknesses combine into a realistic risk.
It is the security posture layer of Defender for Cloud.
The CSPM operating model
Posture is not threat detection
Posture management identifies conditions that could be exploited. It does not require evidence that an attacker is already present.
An exposed management port can create a recommendation even when no malicious sign-in or process has been detected.
CSPM and CWPP
CSPM focuses on weaknesses, configuration and exposure. Cloud Workload Protection focuses on threats affecting running workloads.
Mature cloud security uses both: reduce exploitable conditions and detect activity that bypasses prevention.
CSPM versus workload protection
| Area | CSPM | CWPP |
|---|---|---|
| Main question | Where is the environment weak? | Is a workload under attack? |
| Primary output | Recommendations, score and attack paths | Alerts and workload detections |
| Typical example | Public storage or excessive permissions | Suspicious access or malware activity |
| Response | Remediate the weakness | Investigate and contain the threat |
Continuous discovery
Defender for Cloud discovers supported resources across connected Azure, AWS and Google Cloud environments.
New subscriptions, accounts, projects and resources can change the posture picture as soon as they become visible to the platform.
Continuous assessment
Resources are evaluated against enabled security standards and assessment logic.
The platform then records whether each resource is healthy, unhealthy, not applicable or otherwise unable to be assessed.
Configuration drift
A resource can begin in a secure state and later drift because a firewall rule, role assignment, network setting or storage permission changes.
Continuous reassessment is essential because yesterday’s secure deployment can become today’s exposed asset.
New resources change the result
A score can fall without an existing resource becoming weaker. A newly connected environment may introduce previously unseen risk.
The platform is not necessarily reporting deterioration. It may be reporting greater visibility.
Assessment lifecycle
Foundational CSPM
Foundational CSPM capabilities are available when Defender for Cloud is enabled for supported environments.
They provide essential posture features such as recommendations, inventory, Cloud Secure Score and benchmark-based assessments.
Defender CSPM
The paid Defender CSPM plan adds advanced posture capabilities designed to provide deeper context and prioritisation.
Examples can include attack path analysis, advanced risk assessment, agentless scanning, sensitive-data context and governance capabilities, depending on current availability and supported resources.
Foundational CSPM and Defender CSPM
| Capability area | Foundational CSPM | Defender CSPM |
|---|---|---|
| Basic recommendations | Included | Included |
| Asset inventory | Included | Included with richer context |
| Cloud Secure Score | Included | Included with advanced prioritisation context |
| Attack path analysis | Limited or unavailable | Advanced capability |
| Cloud Security Explorer | Limited or unavailable | Advanced graph-based exploration |
| Advanced risk context | Basic | Expanded |
Security standards
Security standards group assessments around a benchmark or regulatory framework.
The Microsoft Cloud Security Benchmark is a central source of built-in cloud security guidance within Defender for Cloud.
Azure Policy relationship
Many Azure posture assessments are implemented through Azure Policy definitions and initiatives.
Azure Policy provides assessment and governance mechanics, while Defender for Cloud adds security context, prioritisation and investigation views.
Security controls
Related recommendations can be grouped into controls that represent a broader security objective.
This helps teams understand whether several findings are symptoms of the same underlying control gap.
Custom standards
Organisations can add custom policy initiatives and standards where built-in assessments do not cover internal requirements.
Customisation should be governed carefully so that noise does not overwhelm higher-value findings.
What a recommendation contains
| Field | What it tells the analyst |
|---|---|
| Title and description | What security issue was identified |
| Affected resources | Which assets require review |
| Risk level | How urgently the issue should be considered |
| Risk factors | Which environmental conditions increase exploitability or impact |
| Attack paths | Whether the issue contributes to a route toward a critical asset |
| Remediation | How the underlying weakness can be corrected |
| Owner and status | Who is responsible and whether work is overdue |
Recommendation examples
- Management ports should not be exposed to the internet.
- Storage accounts should restrict public access.
- Privileged identities should use stronger protection.
- Resources should enable supported security plans.
- Machines should remediate identified vulnerabilities.
- Critical data stores should reduce excessive access.
Healthy and unhealthy resources
A recommendation may apply to many assets, with some healthy and others unhealthy.
The recommendation title alone does not show the operational workload. Analysts must review the affected-resource list and scope.
Not applicable results
Some assessments do not apply to every resource type, operating system, region or configuration.
Not applicable is not the same as healthy. It means the assessment is outside the resource’s relevant conditions.
Unavailable assessments
An assessment can be unavailable because of missing permissions, incomplete onboarding, unsupported resources or delayed data.
Coverage gaps must be investigated before assuming the absence of findings means the absence of risk.
Risk-based prioritisation
Defender for Cloud considers environmental context instead of ranking recommendations only by a static severity label.
Configuration, network exposure, permissions, exploitability and business impact can all influence prioritisation.
Asset criticality
A weakness affecting a critical identity, production database or sensitive storage account can matter more than the same weakness on a low-value test resource.
Criticality improves the connection between technical posture and business risk.
Recommendation priority model
Cloud Secure Score
Cloud Secure Score provides an overall assessment of cloud security posture and helps measure risk-reduction progress.
The modern risk-based model incorporates factors such as asset risk and criticality to improve prioritisation.
What the score is good for
- Tracking posture over time
- Showing improvement trends
- Comparing connected scopes
- Supporting leadership reporting
- Identifying areas where remediation has stalled
What the score cannot prove
A high score does not prove that an environment cannot be compromised.
It reflects supported assessments and available context, not every possible control, threat, business process or unknown vulnerability.
Why a score changes
- A resource was remediated.
- A resource drifted into an unhealthy state.
- A new environment was connected.
- A standard or assessment changed.
- A criticality value changed.
- New resource context became available.
Cloud Secure Score workflow
Attack path analysis
Attack path analysis uses the cloud security graph to identify exploitable routes through connected assets, identities, permissions and weaknesses.
The result shows how an attacker could move from an entry point toward a critical target.
Why attack paths matter
One recommendation can look routine. Several connected recommendations can reveal a serious breach route.
Attack paths help teams remediate the combinations that matter most instead of treating every finding independently.
Breaking an attack path
An attack path does not always require every finding to be fixed before risk is reduced.
Removing public exposure, reducing a role assignment or protecting a credential may break the path at a high-value control point.
Cloud Security Explorer
Cloud Security Explorer allows analysts to query the cloud security graph using built-in or custom exploration scenarios.
It is useful for finding risky relationships, exposed assets and combinations that may not appear in a simple resource inventory.
From recommendation to attack path
Prioritisation questions
- Is the resource internet-facing?
- Does it hold sensitive data?
- Is the resource business-critical?
- Does an attached identity have broad permissions?
- Is the recommendation part of an attack path?
- Is exploitation known or straightforward?
- Can one remediation break several paths?
Do not use severity alone
Static severity is only one input. A medium-severity weakness on a critical, exposed resource can be more urgent than a high-severity issue on an isolated test asset.
Prioritisation should combine platform risk context with operational knowledge.
Recommendation ownership
Posture improvement fails when every finding belongs to “the cloud team.”
Assign clear owners, due dates and escalation paths based on the resource, service and business process involved.
Remediation choices
- Manual configuration change
- Automated remediation
- Infrastructure-as-code correction
- Policy-based enforcement
- Governance assignment
- Time-limited exemption with documented risk acceptance
Exemptions require discipline
An exemption removes or changes how a recommendation is represented; it does not remove the underlying technical condition.
Use exemptions only with a clear reason, owner, expiry date and compensating controls.
Investigation and remediation workflow
Agent Foskett investigation: “The Cloud Secure Score dropped overnight…”
What Agent Foskett checked
- Score history and scope changes
- Recently connected subscriptions
- Newly discovered resources
- Highest-risk recommendations
- Attack paths involving critical assets
- Identity permissions and public exposure
- Defender plan coverage
- Assigned resource owners
Operational lesson
A posture metric must always be interpreted with scope, coverage and environmental change.
Before declaring that security became worse, determine whether the environment changed, the assessment changed or visibility improved.
Common mistakes
- Using Secure Score as the only priority list.
- Ignoring newly connected scopes.
- Closing recommendations without validating resources.
- Fixing easy points before critical attack paths.
- Using permanent exemptions for temporary problems.
- Assuming “not assessed” means “secure.”
- Failing to assign owners and due dates.
Best practices
- Review posture at tenant, management-group and subscription scope.
- Confirm inventory and onboarding completeness.
- Use risk factors and asset criticality.
- Prioritise attack paths to critical assets.
- Correct the source template or pipeline where possible.
- Track ownership, due dates and exceptions.
- Validate that remediation survives reassessment.
Key takeaways
- CSPM identifies weaknesses before they become active incidents.
- Continuous assessment detects new assets and configuration drift.
- Foundational CSPM provides core posture capabilities.
- Defender CSPM adds advanced risk and attack-path context.
- Recommendations must be read with affected resources, risk factors and ownership.
- Cloud Secure Score is a posture metric, not proof of complete security.
- The modern score uses risk and asset criticality to improve prioritisation.
- Attack paths connect separate weaknesses into exploitable routes.
- Cloud Security Explorer helps investigate graph relationships.
- A score drop can indicate expanded visibility rather than security deterioration.
- Remediation must be validated through reassessment.
Related Agent Foskett resources
Continue learning
What is Cloud Security Posture Management?
Cloud Security Posture Management continuously assesses cloud resources for misconfiguration, exposure, missing controls and relationships that could create attack paths to critical assets.
Microsoft Defender for Cloud CSPM Lesson
This Agent Foskett lesson explains continuous assessment, foundational CSPM, Defender CSPM, security recommendations, risk-based Cloud Secure Score, asset criticality, attack path analysis, Cloud Security Explorer and remediation workflows.
