Table of Contents
- Summary
- CSPM Primer
- Report Methodology
- Decision Criteria Analysis
- Evaluation Metrics
- Key Criteria: Impact Analysis
- Analyst’s Take
- Methodology
- About Chris Ray
- About GigaOm
- Copyright
1. Summary
Cloud security posture management (CSPM) offerings are security solutions designed specifically for cloud environments. They employ the multitude of application programming interfaces (APIs) offered by public cloud service providers to gather data from diverse sources. This rich data stream comprises a broad array of cloud configuration data and workload events. By leveraging this data, CSPM solutions can monitor and identify security risks, such as misconfigurations, vulnerabilities, and risks inside of workloads and CI/CD tooling.
The data harvested via APIs is meticulously sorted, processed, and analyzed using sophisticated algorithms and AI technologies. This in-depth analysis serves to identify risk patterns and anomalies that could indicate potential threats. It helps to mitigate risks proactively by pinpointing potential security gaps and suggesting remedial measures before any actual breach occurs.
CSPM solutions have evolved significantly since their inception. Initially, they were simple tools for API monitoring and data visualization, aimed at giving security teams a clear view of their cloud infrastructure. Those rudimentary solutions have since evolved into comprehensive security platforms that now incorporate features such as identity and access management (IAM) and workload monitoring. Organizations of all sizes and maturity levels find CSPM solutions are able to illuminate risks and advance security objectives almost universally.
As the cloud security landscape evolves and threats become more complex, CSPM vendors continue to innovate. Many vendors are now exploring the integration of advanced security features like static application security testing (SAST) and source code analysis (SCA). These additions signify the vendors’ commitment to developing comprehensive, one-stop-shop solutions for cloud security.
This is the second year that GigaOm has reported on the CSPM space. This report builds on our previous analysis and considers how the market has evolved over the last year.
This GigaOm Key Criteria report details the capabilities (table stakes, key criteria, and emerging technologies) and non-functional requirements (evaluation metrics) for selecting an effective CSPM solution. The companion GigaOm Radar report identifies vendors and products that excel in those capabilities and metrics. Together, these reports provide an overview of the category and its underlying technology, identify leading CSPM offerings, and help decision-makers evaluate these solutions so they can make a more informed investment decision.
How to Read this Report
This GigaOm report is one of a series of documents that helps IT organizations assess competing solutions in the context of well-defined features and criteria. For a fuller understanding, consider reviewing the following reports:
Key Criteria report: A detailed market sector analysis that assesses the impact that key product features and criteria have on top-line solution characteristics—such as scalability, performance, and TCO—that drive purchase decisions.
GigaOm Radar report: A forward-looking analysis that plots the relative value and progression of vendor solutions along multiple axes based on strategy and execution. The Radar report includes a breakdown of each vendor’s offering in the sector.