Cloud security, defined the way we build for it

Plain definitions for the cloud security terms used across policy, governance, and enforcement.

Jump to a letter

Faded = no terms

A

Terms

AWS Resource Control Policy (RCP)

An AWS-native control that restricts what a resource will accept, the resource-side counterpart to an SCP, which restricts what a principal can do.

Read definition

AWS Service Control Policy (SCP)

An AWS-native control, set at the AWS Organizations level, that restricts which actions accounts in an organization are allowed to take – one of the primitives a policy engine can build on.

Read definition

Azure Policy

Microsoft's native governance service for evaluating and enforcing rules against Azure resource configurations, at the management-group, subscription, or resource-group level.

Read definition

B

Terms

Blast radius

The maximum damage an attacker could do, or a misconfiguration could expose, once a single resource is compromised.

Read definition

C

This is some text inside of a div block.

CIEM

Cloud Infrastructure Entitlement Management – tooling focused specifically on mapping and right-sizing identity permissions across a cloud environment.

Read definition

ClickOps

Creating or changing cloud resources by hand through a provider's web console, outside of any code-based or reviewed workflow.

Read definition

Cloud attack path

The chain of misconfigurations, permissions, and connections an attacker could follow from an entry point to a sensitive resource. A single blocked step anywhere in the chain can break the whole path.

Read definition

Cloud-native security

An approach to securing cloud environments using controls built for how cloud infrastructure actually works – APIs, managed services, and provider-native policy mechanisms – rather than controls ported over from on-premises data centers.

Read definition

Cloud security compliance

The practice of configuring and maintaining a cloud environment so it continuously meets a required standard, such as CIS, NIST, PCI-DSS, or HIPAA, rather than passing a point-in-time audit and drifting out of scope afterward.

Read definition

Cloud security governance

The framework of policies, ownership, and processes an organization uses to decide what's allowed in its cloud environment and to make sure those decisions are actually enforced, not just documented.

Read definition

Cloud Security Maturity Model (CSMM)

A five-level, twelve-capability framework, developed by the Cloud Security Alliance, Securosis, and IANS Research, for benchmarking how far a program has moved from manual and reactive toward automated and preventive.

Read definition

Cloud security policy engine

A system that lets a team define a security rule once and have it enforced consistently at the cloud control plane, no matter how or where a resource is created or changed.

Read definition

CNAPP

Cloud-Native Application Protection Platform – a broader category bundling CSPM, workload protection, and other cloud security capabilities into one platform.

Read definition

CSPM

Cloud Security Posture Management – tooling that assesses deployed cloud environments against security and compliance policies, identifying and prioritizing posture risks for remediation. Its core model is detect-and-remediate: identify risks in the existing cloud environment and help teams address them.

Read definition

D

This is some text inside of a div block.

Deployment-stage enforcement

Validating and enforcing a change against policy before the requested resource creation or modification takes effect in the cloud environment.

Read definition

Detect-and-remediate model

The traditional, reactive approach where a risk must already exist in your cloud before a scanner can find it and a team can fix it.

Read definition

E

This is some text inside of a div block.

Enforcement-first security

An operating model where policy is enforced automatically the moment a change is attempted, rather than only observed and reported on afterward.

Read definition

Ephemeral misconfiguration

A misconfiguration – like a briefly public resource – that appears and disappears within a short period, often invisible to scanners when it occurs between assessment cycles.

Read definition

Exposure window

The time a misconfiguration sits live and exploitable: time-to-detect plus time-to-remediate. In a purely reactive model, it can never reach zero.

Read definition

G

This is some text inside of a div block.

Granular policy scoping

Applying different rules to different environments, accounts, or resource types, such as stricter rules in production than in a dev sandbox.

Read definition

Guardrail

An enforced boundary that prevents a non-compliant change from taking effect, rather than simply flagging it for someone to review later.

Read definition

I

This is some text inside of a div block.

IaC scanner

A tool that checks Infrastructure-as-Code templates for policy violations before deployment, covering only the activity that flows through that specific pipeline.

Read definition

Impact Assessment

Understanding the effect of a policy before enforcement is enabled, including existing policy violations and the potential impact of moving the policy to Prevent, so teams can safely tune scope and exceptions before blocking begins.

Read definition

Infrastructure as Code (IaC)

Defining cloud resources in version-controlled templates, such as Terraform or Pulumi, instead of configuring them manually.

Read definition

M

This is some text inside of a div block.

Misconfiguration

An unintended or insecure setting on a cloud resource, such as a public storage bucket or an overly permissive role – the leading cause of cloud breaches.

Read definition

P

This is some text inside of a div block.

Policy as code

Writing security and compliance rules in a structured, machine-readable format so they can be version-controlled, tested, and enforced automatically, instead of living only in a written standard.

Read definition

Policy drift

A mismatch between a resource's actual configuration and the state defined by a security policy, regardless of when or how that mismatch was introduced.

Read definition

Policy exception

An approved, tracked departure from a standard policy, used when a legitimate business need genuinely conflicts with the rule.

Read definition

Policy marketplace

A library of ready-to-deploy policies mapped to common frameworks and attack patterns, instead of every rule being written from scratch.

Read definition

Preventive Cloud Security (PCS)

The category name for solutions that stop misconfigurations and risky actions before they happen, instead of detecting them after deployment. PCS tools enable organizations to define and enforce their security policies and guardrails at the cloud control plane, at the moment a change is attempted, regardless of how that change is introduced.

Read definition

S

This is some text inside of a div block.

Shift left

Moving security checks earlier into the development process – for example, scanning code before it merges – so issues surface before reaching a shared environment.

Read definition

Source-agnostic risk

Risk that can be introduced through any path into the cloud – IaC, the console, the CLI, an API call, or an AI agent – not just one pipeline.

Read definition

Z

This is some text inside of a div block.

Zero trust (cloud context)

An architecture principle where no request is trusted by default based on network location or identity alone – every action is checked against policy.

Read definition

No results found.
Try adjusting your search

Ready to take your first proactive step?

Watch a Demo Now!