Strengthening Cloud Security Posture Across AWS and Azure

Overview

As our cloud footprint expanded across AWS and Azure, we needed a consistent way to understand security posture without relying on separate provider consoles or introducing agents into customer environments.

We built CloudSec internally as a self-hosted, multi-cloud Cloud Security Posture Management platform focused on three principles:

• Zero-cost access through free, read-only management-plane APIs
• Zero-write operation with no changes made to scanned resources
• Actionable security context through findings, coverage, attack paths, and compliance analysis

One security view. Multiple clouds. Clearer risk.

The Challenge

Cloud security findings are often fragmented across accounts, subscriptions, services, and security tools.

For our internal requirements, we wanted to answer:

• What resources exist across AWS and Azure?
• Which configurations violate our security policies?
• Which findings matter most?
• Can isolated findings be connected into a realistic attack path?
• How does posture change between scans?
• Which compliance frameworks are affected?
• Can the platform operate without write permissions or data-plane access?

A simple findings list was not enough. We needed context around the environment and the relationships between risks.

What We Built

CloudSec is a self-hosted CSPM and compliance scanning platform for AWS and Azure.

It uses read-only management-plane APIs to inspect cloud configuration and security posture. The platform does not require data-plane access and does not modify the resources it scans.

The platform supports:

• AWS and Azure
• 898 automated security checks
• 40 compliance frameworks
• 20 service categories
• Self-hosted deployment
• 30-scan retention
• Resource Watch
• Attack Path analysis
• Security Findings
• Coverage analysis
• Compliance reporting

From Findings to Connected Risk

One of the most important capabilities we developed was Attack Path analysis.

Traditional CSPM output can produce hundreds of individual findings. Each finding may be valid, but reviewing them independently makes it difficult to understand potential impact.

CloudSec builds a graph from the latest scan results. The graph models security techniques, relationships between techniques, progression toward critical resources, and potential blast radius.

This allows an analyst to move from:

"What is misconfigured?"

to:

"How could these conditions combine into a meaningful attack path?"

That shift makes security data easier to prioritize.

Continuous Resource Awareness

Security posture changes as infrastructure changes.

CloudSec includes Resource Watch, which checks for new and removed resources at regular intervals.

This helps identify environmental changes between full security scans and provides another signal for deciding when deeper investigation is needed.

Environment changes
        ↓
Resource Watch detects change
        ↓
Security posture is re-evaluated
        ↓
Findings and relationships change
        ↓
Analyst investigates priority risks

Compliance Without Losing Security Context

Make cloud risk easier to see, easier to understand, and harder to overlook.

About CloudSec

CloudSec is CloudFabric's cloud security posture and compliance platform for AWS and Azure.

It combines security scanning, compliance analysis, resource monitoring, coverage visibility, and graph-based attack-path analysis in a self-hosted, read-only architecture.