Turning CSPM findings into actual fixes
Buying a cloud security posture tool is easy. The hard part is that on day one it hands you 4,000 findings, no owners, and no way to tell which three of them an attacker would actually use.
By Piotr Zenon Żabrowski · Published · Updated
1Discover
- Agentless scan
- Config inventory
- Identity graph
2Prioritise
- Exploitability
- Data sensitivity
- Attack path length
3Route
- Owning team
- Backlog item
- Acceptance test
4Prevent
- Policy as code
- Hardened module
- Drift alert
Why the finding count keeps growing
- CSPM, CWPP and CIEM are converging into single CNAPP platforms, which means one console now surfaces misconfiguration, workload vulnerability and identity risk together — more correlated signal, but also more raw findings than any one team is used to triaging.
- A finding graph turns three individually minor issues — a public endpoint, an over-permissioned identity attached to it, and a path to a data store — into what the industry now commonly calls a toxic combination: not a severity label, but a chain that a severity label alone would never surface.
- Most of the count is duplication: the same misconfigured template deployed fifty times produces fifty findings with one root cause.
Triage by exploitability, not by severity label
| Question | Effect on priority |
|---|---|
| Is the resource reachable from the internet? | Highest multiplier — combine with any weakness below |
| Does it hold or reach production data? | Raises impact regardless of the finding's default severity |
| Does the identity attached to it have wide permissions? | Turns a low finding into a lateral-movement path |
| Would exploiting it require access an attacker does not yet have? | Findings that only matter after an initial foothold move down the queue, not off it |
| Is the misconfiguration created repeatedly by a pipeline? | Fix the template, not the resource |
| Is there a compensating control that already blocks it? | Downgrade and document, do not silently ignore |
The operating model
01Assign ownership by subscription and tag
A finding with no owner is a finding that will not be fixed. Ownership metadata is a security control.
02Split the backlog
Attack-path findings go to an incident-style queue; hygiene findings go into normal engineering sprints.
03Fix the source
Recurring findings are template defects. Correct the Terraform module and the resource-level noise disappears.
04Prevent the reintroduction
Policy-as-code denies the pattern at deployment time; the CSPM tool becomes a detector for drift, not a task generator.
05Report on trend, not count
Track time-to-fix for attack-path findings and the rate of new introductions per team.
Frequently asked questions
Do we need a commercial CSPM?
Native tooling (Defender for Cloud, Security Command Center) covers a large part of the requirement. Commercial tools earn their place mainly on multi-cloud graph analysis and attack-path visualisation.
How do you handle the initial backlog?
Freeze it as a dated baseline, fix attack paths immediately, and hold engineering teams to a no-new-introductions rule while the historical hygiene backlog burns down.
Does exploit-probability scoring (EPSS) replace this triage model?
It sharpens ranking within a severity band rather than replacing it. A misconfiguration is a standing weakness on a resource you own; a scored CVE is a specific flaw with a probability of active exploitation. Blend them: use exploit-probability scoring (EPSS-style) to rank vulnerability findings, and the exposure/privilege/data questions in the table below to rank misconfiguration findings. Both feed the same attack-path priority queue.
Related
Cloud security
Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.
Microsoft Defender for Cloud
Defender for Cloud for Azure-native CSPM, multicloud extension, container posture and AI workload security posture management.
Wiz.io
Wiz for agentless multi-cloud posture management, attack-path graphs and toxic-combination prioritisation, now under Google Cloud.
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
Conditional Access baseline
An Entra ID Conditional Access baseline ordered by blast radius: which policies to ship first, how to stage them, the legacy-policy retirement dates that create silent gaps, and the exclusions that quietly undo them.
Multi-cloud baseline
How to express a single set of security requirements — including AI workload guardrails — across Azure, Google Cloud and Alibaba Cloud without maintaining three unrelated standards.