1 Executive Summary

The KuppingerCole Leadership Compass provides an overview of a market segment and the vendors in that segment. It covers the trends that are influencing that market segment, how it is further divided, and the essential capabilities required of solutions. It also provides ratings of how well these solutions meet our expectations. This analysis is based on the KuppingerCole Leadership Compass Methodology.

This Leadership Compass covers solutions that ….

Provide a way to continuously identify and control certain risks associated with the use of cloud services. They provide visibility into vulnerabilities in the way these services are configured, secured, and used and assess the risks against common regulatory obligations, security frameworks, and organizational policies. They automate the discovery and reporting of these risks and automate appropriate corrective action. An important trend, which these solutions must evolve to cover and exploit, is the use of machine learning (ML) and artificial intelligence (AI), which are based on cloud computing.

Most organizations now have a hybrid IT environment where services are delivered in multiple ways, some delivered as cloud services from multiple providers, while others remain on premises or at the edge. Cloud Infrastructure as a Service (IaaS) is used to develop and deliver new applications, reengineer existing ones, as well as to store data. This provides an environment well suited to digital transformation without the need for capital expenditure or lengthy procurement delays to obtain hardware. However, it also brings new challenges including increased complexity, ephemeral resources, and shared responsibility for security.

The responsibility for security of cloud services is shared between the Cloud Service Provider (CSP) and the cloud customer. While the CSP must take steps to secure the service it provides, it is up to the cloud customer to secure the way they use the service. The customer must implement what are known as Complementary User Entity Controls (CUECs) to achieve this. Cloud Security Posture Management (CSPM) tools are intended to help organizations using cloud services to identify and manage the risks under their control.

The second challenge is the ephemeral nature of cloud resources that are created and destroyed as they are needed using shared physical resources. The traditional basis for security is to know what you have in order to protect it. A static approach does not work for dynamic cloud service resources. CSPM solutions can help to implement policies and guardrails that control the creation of dynamic resources to mitigate risks.

Additionally, each cloud service provides its own set of capabilities for the customer to implement their controls. These capabilities, tools, and APIs are provided in ways that are different for each cloud. Where enterprises are using multiple clouds, this makes a common approach to security management extremely hard. CSPM as part of a cloud security fabric provides a common way of specifying security policies, implementing controls, and monitoring their effectiveness across the multi-cloud hybrid IT environment.

The market for CSPM solutions is growing rapidly due to the increasing adoption of cloud services and the corresponding need for security. Key drivers in this market include the rising number of data breaches, stricter regulatory requirements, and the complexity of multi-cloud environments. CSPM solutions offer automation, real-time monitoring, and advanced analytics, which are important for maintaining security in cloud settings.

This report offers an in-depth analysis of the market for CSPM solutions within the context of today’s hybrid IT services. The market for these solutions is now well established and was valued at $10.81 billion in 2024 and is growing annually at 20.2%. The market is continuing to evolve with the emergence of cloud-native solutions that exploit AI and ML

The large cloud service providers like AWS, Microsoft Azure, and Google Cloud all offer tools with CSPM capabilities for their cloud. Specialized security firms like Palo Alto Networks and Check Point offer CSPM solutions with cross cloud capabilities as part of their wider Cloud Native Application Protection Packages (CNAPP). In addition, other IT risk management vendors such as JupiterOne and Qualys offer capabilities that cover cloud services as well as non-cloud IT services.

Organizations are starting to adopt AI and ML, mainly delivered as cloud services. This introduces further security challenges including protecting the training data and AI models as well as ensuring confidentiality of training data. CSPM must evolve to cover these challenges. Additionally, AI and ML can play a significant role in enhancing cybersecurity, through capabilities such as advanced threat detection and automated security processes, data sensitivity analysis, and improved disaster recovery. Solutions should exploit these technologies to predict and prevent attacks and automate routine tasks to reduce human error. They can also assist in ensuring compliance with regulatory requirements.

1.1 Key Findings

What are the top considerations buyers should know about?

• The report evaluates a wide range of CSPM vendors, categorizing them into leaders, challengers, and followers based on product strength, innovation, and market presence.
• The leading vendors in the CSPM market include Check Point, Microsoft, Palo Alto Networks, Uptycs, and Wiz.
• The market for CSPM solutions is growing rapidly, driven by increased cloud service adoption, demand for security, and regulatory compliance. The market is valued at $10.81 billion in 2024, growing annually at 20.2%.
• Key drivers in this market include the rising number of data breaches, stricter regulatory requirements, and the complexity of multi-cloud environments.
• CSPM solutions help customers to monitor and manage their security controls consistently across multiple clouds, and some solutions also cover non-cloud IT services.
• General cybersecurity vendors such as Check Point, Palo Alto Networks, and Qualys offer CSPM and CNAPP as part of broader security portfolios.
• There is a growing number of born-on-the-cloud vendors with CSPM solutions offered as part of a cloud security platform.
• There is some market consolidation taking place: in August 2024 Fortinet announced the completion of its acquisition of Lacework.
• Leading IaaS vendors like AWS, Microsoft Azure, and Google Cloud all provide CSPM capabilities but with a focus primarily on their own offering.
• Most CSPM solutions are now delivered as part of a Cloud Native Application Protection Platform (CNAPP).
• Essential CSPM capabilities include a dynamic service inventory, with risk assessments covering vulnerabilities in user entitlements, data storage, networks, compute services, and DevOps as well as reporting security posture against a range of common frameworks and regulations.
• Most CSPM solutions now exploit ML, and a few exploit GenAI to enhance their capabilities.
• Only a few solutions provide capabilities to monitor the technical risks around the development of AL and ML-based applications.