What is CSPM (without buzzword)
CSPM (Cloud Security Posture Management) is a platform that continuously audits the configuration of your cloud accounts (AWS, Azure, GCP, OCI) against security benchmarks, finds misconfigurations, and prioritizes what to fix first.
In practice: "is this S3 bucket public? Does this security group have port 22 open to the internet? Is RDS encrypted? Is CloudTrail enabled in all regions?" Multiply by 12k+ resources in a typical environment and you understand why nobody checks manually.
It is not: EDR, WAF, SIEM, DLP or code scanner. CSPM only looks at cloud control plane configuration. Stops where the workload starts.
CSPM vs CWPP vs CNAPP
CSPM
Control plane
Configuration of the cloud account. Finds: public buckets, open ports, non-rotated keys, missing MFA, drift from benchmarks.
Reads: CloudTrail, Config, Azure Activity, GCP Audit
CWPP
Workload plane
Content of the workload. Finds: vulnerabilities in containers, malware in VMs, non-compliant runtime, dangerous processes.
Reads: container images, VM processes, Kubernetes pods
CNAPP
Unified
Consolidation of CSPM + CWPP + CIEM + IaC scanning + Kubernetes security in a single platform. Trend since 2024.
Examples: Orca, Wiz, Prisma Cloud, Defender CSPM
Pragmatic recommendation for a medium-large environment: start with CSPM, add CWPP in 6 months, consolidate to CNAPP in year 2 if the budget allows.
How to prioritize 5,000 findings
Every modern CSPM returns thousands of findings in day 1. The mistake is opening all of them as tickets. The Evernow approach is a three-dimensional filter:
- Dim 1 — Blast radius: Does the misconfiguration allow reaching personal data (LGPD), money (payment systems), or the control plane (root)? Yes → critical regardless of CVSS.
- Dim 2 — Exploitable today: Is it reachable from the internet and the exploit is public? Yes → highest priority.
- Dim 3 — Effort: Is the fix an IaC PR of 3 lines or a data-level migration? Cluster similar fixes in the same sprint to optimize effort.
- Result: 5,000 findings become ~120 actionable tickets in week 1, 40 in week 3, < 20 in week 6. Auto-suppression of findings in non-production environments.
Frequent questions about CSPM
Native CSPM (AWS Security Hub) or third-party (Orca, Wiz, Prisma)?
Native for single-cloud and tight budget. Third-party is mandatory for multi-cloud and when you need CIEM, CNAPP or cross-account correlation. Native tools do not talk to each other across clouds.
How much does a CSPM cost for a 200-person engineering org?
Licenses are priced by number of cloud accounts or workloads. A typical environment (20-40 accounts, 3-5k workloads) is around USD 90-250k/year. Managed operation by Evernow adds R$ 25-60k/month depending on scope.
Will it break our CI/CD or DevOps workflow?
Only if you turn on enforce-mode in week 1. The Evernow approach is: month 1 observability only, month 2 PR gating with override, month 3 hard gating for critical IaC rules. No delivery friction.
Does CSPM replace pentest of the cloud environment?
No. CSPM checks known misconfigurations against benchmarks. Pentest chains findings, exploits business logic, attacks CIEM/IAM boundaries, validates what is actually exploitable. They complement.
