Notifications
Clear all
Topic starter
11/06/2026 12:01 am
TL;DR: Cloud security maturity is still best understood as a layered progression, starting with CSPM and CIEM for visibility and entitlement control before moving into CWPP, DSPM, runtime detection, AI security, and AppSec, according to Orca Security. The lesson is that programmes fail when they try to defend what they have not mapped, and identity context has to lead.
NHIMG editorial — based on content published by Orca Security: cloud security maturity and the layered path from CSPM to CNAPP
Questions worth separating out
Q: How should security teams sequence cloud security controls for better identity governance?
A: Start with CSPM and CIEM, then add workload and data controls, then runtime detection and AI security, and only then layer AppSec where the organisation can connect code to live cloud behaviour.
Q: Why do service accounts and shadow identities matter so much in cloud programmes?
A: Because cloud compromise often follows excessive entitlement rather than infrastructure failure.
Q: What breaks when organisations skip entitlement management and go straight to runtime tools?
A: Runtime tools can see activity, but they cannot explain whether the activity was expected, overprivileged, or simply impossible to correlate without identity context.
Practitioner guidance
- Establish CSPM as the environment baseline Map assets, public exposure, compliance drift, and configuration risk across every cloud account before expanding into deeper controls.
- Build CIEM review around shadow identities Review unused permissions, privilege escalation paths, rogue service accounts, and cross-account entitlements as a distinct workstream.
- Correlate data sensitivity with entitlement paths Tie DSPM findings to identity and access data so sensitive stores are evaluated by who can reach them, not just whether they are encrypted or exposed.
What's in the full article
Orca Security's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step maturity path for deciding where to begin in a cloud security programme.
- The specific role of CSPM, CIEM, CWPP, DSPM, CDR, AI Security, and AppSec in the layered model.
- The vendor's full breakdown of how CNAPP correlates posture, identity, data, and runtime signals.
- Examples of how the layered approach applies across AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, and Kubernetes.
👉 Read Orca Security's cloud security maturity guidance on CSPM, CIEM, and CNAPP →
Cloud security maturity: are CSPM and CIEM the real starting point?
Explore further
12/06/2026 6:32 am
Cloud security maturity still starts with identity visibility, not platform consolidation. The article is right to treat CSPM and CIEM as the base layers because cloud security fails first at the point of incomplete inventory and excessive entitlement. CNAPP can correlate signals, but correlation does not replace the need to know which identities, workloads, and data stores actually exist. Practitioners should treat visibility as the precondition for every later control decision.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 23.7% of organisations share secrets through insecure methods such as email or messaging applications, which still leaves a sizeable governance gap in NHI handling.
A question worth separating out:
Q: When should teams introduce AppSec in a cloud maturity model?
A: Introduce AppSec when the organisation can trace vulnerabilities from source code into running workloads and back to the identities that deploy or access them. If that code-to-cloud link is missing, AppSec produces findings that are hard to prioritise. The goal is to connect application risk to identity, runtime, and data context.
👉 Read our full editorial: Cloud security maturity starts with visibility, not CNAPP
