Security scanning

What is CSPM?

Cloud Security Posture Management: continuously auditing live cloud accounts for misconfiguration and policy drift.

By Cláudia FernandesUpdated 2026-10-02

CSPM connects to your cloud provider's APIs and evaluates what is actually deployed, not what your Terraform says should be deployed. It catches drift, console changes and resources created outside your IaC pipeline entirely.

It overlaps with IaC scanning but answers a different question. IaC scanning asks 'is this template safe to apply'; CSPM asks 'is what is running right now safe'. Tools in this directory that offer it usually do so as a lighter-weight feature than a dedicated cloud security platform.

What to look for

Which cloud providers and services are covered
Whether it detects drift from your declared infrastructure
Scan frequency, and whether findings tie back to the owning team
Depth compared to a dedicated CSPM product, if that is your main need

Best 4 code quality, security and code review tools with CSPM

Every tool in the directory whose documentation covers this, 3 fully and 1 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform