Security Posture Management

Last reviewed: August 2026

Overview

Because resources in cloud environments are created and changed rapidly, you need a framework to continuously assess security status and detect and respond to threats. This is collectively referred to as Security Posture Management.

Key areas:

Area	Role	Examples
CSPM (Cloud Security Posture Management)	Detects cloud configuration errors	S3 public exposure, missing encryption, excessive IAM permissions
CWPP (Cloud Workload Protection Platform)	Runtime protection for workloads (VMs, containers, serverless)	Malware detection, file integrity monitoring, runtime vulnerabilities
Threat Detection	Identifies abnormal activity and signs of attack	Unauthorized API calls, cryptocurrency mining, data exfiltration attempts
SIEM/SOAR	Collects, analyzes, and automatically responds to security events	Log correlation analysis, automated isolation, ticket creation

Vendor Security Posture Services

Area	AWS	Azure	Google Cloud	OCI
CSPM	Security Hub	Defender for Cloud (CSPM)	Security Command Center Enterprise — the CSPM component of the Google Unified Security portfolio. Integrates Mandiant threat intelligence	Cloud Guard
CWPP	GuardDuty Runtime Monitoring + Inspector	Defender for Servers/Containers	SCC Premium (VM Threat Detection)	Cloud Guard (Threat Detector)
Threat detection	GuardDuty	Defender for Cloud + Sentinel	SCC Event Threat Detection	Cloud Guard (Activity Detector)
SIEM/SOAR	Security Lake + third party	Microsoft Sentinel	Chronicle SIEM	OCI Logging Analytics (log analysis) + third-party SIEM
Cost	GuardDuty pay-as-you-go, Security Hub billed per check	Billed per Defender plan	SCC Standard free / Premium & Enterprise billed	Cloud Guard free

CIS Benchmarks

What Is a CIS Benchmark

CIS (Center for Internet Security) Benchmarks are secure configuration baselines for OSes, cloud platforms, databases, containers, and more. They are the most widely used security configuration standard in the industry, forming a basic framework for audits and compliance.

Key benchmarks:

Target	Example benchmarks
Cloud accounts	CIS AWS Foundations, CIS Azure Foundations, CIS Google Cloud Foundations, CIS OCI Foundations
OS	CIS Amazon Linux 2023, CIS Ubuntu, CIS Windows Server
Containers	CIS Docker, CIS Kubernetes
Databases	CIS Oracle Database, CIS PostgreSQL, CIS MySQL

Automated CIS Assessment by Vendor

Vendor	Service	CIS support
AWS	Security Hub	Automated assessment against CIS AWS Foundations Benchmark v1.4/v3.0. Score dashboard
Azure	Defender for Cloud	Compliance dashboard based on CIS Azure Foundations. Automatically generates recommendations
Google Cloud	Security Command Center	Scans based on CIS Google Cloud Foundations. Security Health Analytics
OCI	Cloud Guard	Ships with detector recipes based on CIS OCI Foundations Benchmark

Why CIS Reports Matter

Audit response — provides evidence of “meeting the security configuration baseline” for internal/external audits
Baseline setting — guarantees a minimum security level when creating new accounts/projects
Continuous monitoring — automatically detects configuration drift (unintended changes)
Executive reporting — communicates current status quantitatively through a security score
Compliance mapping — CIS items are mapped to ISO 27001, SOC 2, and country-specific certification controls (Compliance)

CIS Operational Best Practices

Regular scans — automated scans at least once a week. Environments that change frequently should use real-time monitoring
Exception management — document non-compliant items with a valid business justification, along with compensating controls
Score targets — set a minimum compliance rate as organizational policy (e.g., 100% Critical, 95%+ High)
Automated remediation — automatically fix items where possible (e.g., automatically block public S3 buckets)
Trend tracking — track monthly score trends to understand whether the security posture is improving or worsening

Threat Detection Details

AWS GuardDuty detection types

Detects threats by analyzing VPC Flow Logs, DNS logs, CloudTrail, S3 data events, EKS audit logs, and Lambda network activity.

Category	Examples
Unauthorized access	Console login from an unusual region, API calls from a known malicious IP
Cryptocurrency mining	Detects mining pool communication from EC2/EKS
Data exfiltration	Abnormally large downloads from an S3 bucket, data exfiltration via DNS
Privilege escalation	Abnormal API call patterns following an IAM policy change

Azure Defender + Sentinel

Defender for Cloud detects threats per workload, while Sentinel collects and correlates logs as a SIEM. Sentinel’s SOAR (automated response) capability enables automated isolation, alerting, and ticket creation through playbooks.

Google Cloud Security Command Center

Event Threat Detection analyzes Cloud Audit Logs and VPC Flow Logs to detect threats. Integrating with Chronicle SIEM enables large-scale log analysis and threat hunting.

OCI Cloud Guard

Consists of a Detector and a Responder. When configuration issues or activity anomalies are detected, it automatically executes response actions (disabling a resource, adding a tag, sending an alert, etc.). Included by default at no additional cost.

Auto-Remediation

A pattern where, after a threat or configuration error is detected, it is automatically corrected without human intervention.

Vendor	Automated response approach
AWS	Security Hub → EventBridge → Lambda/Step Functions (custom remediation)
AWS	GuardDuty → EventBridge → Lambda (automated isolation, SG changes)
Azure	Defender recommendations → Logic Apps / Azure Functions (automated remediation)
Azure	Sentinel Playbook (SOAR) → automated isolation, account disabling
Google Cloud	SCC Finding → Cloud Functions / Workflows (automated remediation)
OCI	Cloud Guard Responder → automated actions (stop resource, add tag, send alert)

Design Principles for Auto-Remediation

Phased rollout — start with alerts only, then move to automated remediation once stable
Whitelisting — pre-register intended exceptions (e.g., public access in a dev environment)
Reversibility — automated remediation actions must be reversible
Parallel alerting — notify the responsible party whenever an automated remediation runs (for after-the-fact verification)
Test environment first — validate automated response rules in non-production before applying them to production

Security Posture Operations Framework

graph LR
    subgraph "NIST CSF 2.0 — Continuous Security Posture Management"
        A["Govern<br/>Policy, roles,<br/>risk management"] --> B["Identify<br/>Asset inventory, CIS assessment,<br/>vulnerability scanning"]
        B --> C["Protect<br/>IAM, encryption,<br/>network"]
        C --> D["Detect<br/>GuardDuty, CSPM,<br/>CWPP"]
        D --> E["Respond<br/>Automated isolation, SOAR,<br/>IR process"]
        E --> F["Recover<br/>DR recovery, forensics,<br/>post-mortem"]
    end

This framework maps to the six functions of the NIST Cybersecurity Framework 2.0.

Common Mistakes

Applying auto-remediation to production without validation — false positives cause automated isolation of legitimate resources, resulting in service outages. Validate in non-production first
Leaving CIS Benchmark non-compliant items unaddressed without documentation — even when there’s a valid business reason, failing to manage the exception leads to audit findings
Enabling CSPM alerts without defining a response process — alerts pile up with no one handling them, causing real threats to be missed

Checklist

Is CSPM (Security Hub, Defender for Cloud, SCC, Cloud Guard) enabled, and is automated CIS Benchmark assessment performed?
Are automated response rules validated in non-production before being applied to production?
Are secure score targets set, with monthly trends tracked?