Best cloud posture check during diligence?

If you mean M&A / investment diligence, I’d use a cloud security posture assessment (CSPM) against CIS benchmarks, but make it risk-based rather than just asking for a “security score.”

Best diligence check

1. Identity & privileged access — highest priority

• MFA for all human/admin access
• No standing root/global-admin access
• Least-privilege IAM
• Service accounts/keys inventoried and rotated
• External/cross-account principals identified
• SSO/centralized identity and offboarding controls

AWS specifically recommends reviewing users, roles, policies, credentials, and unintended external access as part of a security audit.

2. Logging & detection

• Centralized audit logs
• CloudTrail / equivalent enabled across all accounts/subscriptions
• Logs protected from tampering/deletion
• Alerts for privilege, network, and security-control changes
• Evidence that someone actually monitors/responds to alerts

For AWS, the reference architecture calls for multi-Region CloudTrail, centralized log analysis, and protection of the log store.

3. Data exposure

• Public S3/blob/storage resources
• Internet-exposed databases
• Encryption at rest/in transit
• KMS/key-management practices
• Secrets sitting in source code, images, or CI/CD
• Sensitive/regulated data mapped to cloud resources

4. Network & workload exposure

• Open 0.0.0.0/0 ingress, especially SSH/RDP/admin ports
• Flat production networks
• Missing segmentation between prod/non-prod
• Internet-facing workloads without appropriate controls
• Vulnerable/unsupported OS, containers, Kubernetes components

5. Security hygiene / configuration Run the environment against the current CIS cloud benchmarks. CIS currently maintains benchmarks for AWS, Azure, and GCP, among others.

6. Incident history & operational maturity Ask for:

• Security incidents/breaches in the last 3–5 years
• Open critical findings and age of findings
• Pen tests and remediation reports
• Backup/restore evidence
• IR plan + most recent tabletop
• Security exceptions and accepted risks

AWS's broader security framework similarly emphasizes IAM, vulnerability management, infrastructure protection, data protection, threat detection, and incident response.

What I'd actually request in diligence

Rather than a questionnaire alone, ask the target for a read-only CSPM export/report covering 100% of cloud accounts/subscriptions/projects, plus:

1. Critical/high findings with remediation status
2. IAM privileged-access report
3. Externally exposed assets report
4. Cloud asset inventory
5. Audit/logging coverage
6. Security incidents + open vulnerabilities
7. CIS benchmark score/report
8. Architecture/network diagram
9. Pen-test and SOC 2/ISO evidence, if applicable

AWS itself describes a cloud posture assessment as a way to establish a baseline and identify misconfigurations and vulnerabilities; it specifically points to Security Hub CSPM and Prowler as assessment approaches.

The diligence question I'd put at the top of the page:

“Is there any cloud configuration, identity, exposure, or logging gap that could plausibly permit unauthorized access to material company/customer data—and can the target demonstrate that the answer is no?”

That gets you much closer to transaction risk than a generic CSPM percentage score.

The "best" cloud posture check during diligence isn't a massive, multi-week compliance audit—it’s a fast, high-signal, risk-based assessment that targets what can actually sink the deal value, cause a breach on day one, or cost a fortune to remediate post-close.

The most effective approach combines outside-in discovery (before you have internal cloud access) with targeted, agentless runtime visibility (once permission is granted).

Phase 1: Outside-In Discovery (Pre-Access / NDA Stage)

Before poking around inside their AWS/Azure/GCP tenant, map their external footprint to catch forgotten assets and shadow IT.

• Tools like CyCognito, Attaxion , or runZero.
• What to look for: Exposed management ports, forgotten subdomains, dangling DNS entries, and unmanaged public-facing storage or APIs.

Phase 2: Inside-In Rapid Posture Assessment (Clean-Room / Post-LOI Stage)

Ask the target to spin up a temporary, read-only cross-account IAM role for an agentless Cloud Security Posture Management (CSPM) or CNAPP tool. Enterprise platforms like Wiz, Prisma Cloud , or Orca Security can scan an entire multi-cloud environment in minutes without installing software or disrupting workloads.

Focus the review on these "Toxic Combinations" rather than endless low-severity configuration alerts:

1. Publicly Exposed Data + Over-Permissive IAM: Are there S3 buckets, Azure Blobs, or databases containing customer/PII data that are reachable from the internet and tied to an over-privileged service account?
2. Identity & Entitlement (CIEM) Decay: How many inactive, non-human or human accounts have root/admin access? Are access keys unrotated for years?
3. Unencrypted Crown Jewels: Are primary data stores and backups encrypted at rest using proper KMS keys, or left wide open?
4. Secret Sprawl: Did developers hardcode API keys, GitHub tokens, or database passwords inside container images or environment variables?
5. Compliance & Audit Artifacts: Do they have a clean, automated track record for frameworks that matter to your enterprise (SOC 2, ISO 27001, HIPAA), or are they running on duct-taped spreadsheets?

If you want to tailor this further, tell me:

• What is the target’s primary cloud environment (AWS, Azure, GCP, or multi-cloud)?
• Is this an early-stage tech acquisition (heavy DevSecOps/IaC) or a traditional enterprise carve-out?

I can give you a prioritized checklist or recommend a specific evaluation path.

For cloud posture diligence in an acquisition, the best approach is not just running a CSPM scan—it is validating whether the target’s cloud environment is known, controlled, recoverable, and transferable. CSPM reviews are commonly included in M&A security diligence alongside IAM, logging, encryption, and network controls.

A strong cloud posture check should cover:

1. Cloud estate discovery (prove what exists)

• Inventory all:
  • AWS accounts / Azure subscriptions / GCP projects
  • Production vs non-production environments
  • SaaS tenants connected to critical workflows
  • Regions and data residency
• Confirm ownership of each account and billing relationship.
• Look for shadow cloud resources.

Red flags

• Unknown accounts
• Former employees with ownership
• Personal/root accounts used for production
• No centralized cloud organization structure

---

2. Identity & access (usually the highest-value check)

Review:

• MFA enforcement
• SSO/federation
• Privileged accounts
• Admin role assignments
• Service accounts
• Access reviews
• Break-glass accounts
• Secrets/key management

Critical findings

• Shared admin credentials
• Long-lived access keys
• No MFA for privileged users
• Excessive permissions (“*” access)

---

3. Misconfiguration and exposure scan

Run CSPM against:

• Public storage buckets
• Public databases
• Open security groups/firewalls
• Overly permissive IAM policies
• Unencrypted resources
• Missing security controls

Tools often used:

• Wiz
• Palo Alto Networks Prisma Cloud
• Microsoft Defender for Cloud
• Amazon Web Services Security Hub

---

4. Logging and detection maturity

Verify:

• Cloud audit logs enabled
• Logs centralized
• Retention periods
• SIEM integration
• Alert ownership
• Incident response playbooks

A buyer should be concerned if the seller cannot answer:

“If an attacker accessed production yesterday, how would you know?”

---

5. Data protection

Check:

• Encryption at rest and in transit
• Key ownership and rotation
• Backup strategy
• Snapshot permissions
• Sensitive data locations
• Customer data segregation

---

6. Infrastructure security

Review:

• Network segmentation
• VPC/VNet design
• Private endpoints
• Kubernetes security (if applicable)
• Container image scanning
• Infrastructure-as-code controls

---

7. Operational maturity

Ask for evidence, not policies:

• Last CSPM report
• Remediation SLAs
• Vulnerability management reports
• Pen tests
• Disaster recovery tests
• Cloud architecture diagrams
• Security exceptions

---

8. Deal-impact scoring

Translate findings into transaction language:

---

A practical 48-hour diligence sprint:

1. Obtain cloud account inventory.
2. Run CSPM assessment.
3. Export IAM privilege report.
4. Review public exposure.
5. Validate logging/backups.
6. Produce a red/yellow/green risk memo.

For software or SaaS acquisitions, I would put IAM, production exposure, secrets management, customer data handling, and cloud ownership transferability above generic compliance certifications. Cloud configuration reviews and identity baselines are specifically called out as key diligence areas in M&A security reviews.

When conducting M&A or investment due diligence, the "best" cloud posture check isn't a single tool—it's a fast, agentless CSPM (Cloud Security Posture Management) scan combined with targeted identity and data exposure analysis. You need zero-friction visibility that proves what is actually exposed or exploitable without disrupting the target company’s engineering teams.

Recommended Approaches for Diligence

• Agentless Commercial Platforms: Deploying a market-leading commercial tool like Wiz or Orca Security via a read-only cross-account role gives you immediate, comprehensive visibility. They map out resource relationships, network accessibility, and toxic combinations (e.g., an internet-facing virtual machine with an over-privileged administrative IAM role) in minutes via graph-based analysis.
• Open-Source CLI Scans: For a lean, fast, or budget-conscious audit of an AWS, Azure, or GCP environment, running Prowler or ScoutSuite with read-only audit credentials provides an instant baseline of CIS benchmark failures and compliance gaps.
• Native Cloud Posture Dashboards: If the target is entirely single-cloud (e.g., Azure-first), checking native tooling like Microsoft Defender for Cloud or AWS Security Hub gives an immediate look at their internal security score and active recommendations.

Core Focus Areas During the Check

1. Identity and Entitlement Management (CIEM): Scrutinize overly permissive administrative roles, non-human identities (service accounts with long-lived access keys), and whether multi-factor authentication (MFA) is strictly enforced on all human users.
2. External Attack Surface & Public Exposure: Identify public-facing storage buckets (S3/Azure Blobs), unauthenticated databases, and open ingress ports/firewall rules that could lead to immediate data leakage.
3. Data Protection & Encryption: Verify whether sensitive datastores are encrypted at rest using customer-managed keys (CMK) and check for unencrypted volume snapshots.
4. Logging and Audit Readiness: Confirm that critical control plane logging (like AWS CloudTrail or GCP Audit Logs) is active, centralized, and immutable across all regions and accounts.

If you'd like to narrow this down, tell me:

• What cloud provider(s) is the target running on (AWS, Azure, GCP, or multi-cloud)?
• Are you looking for a quick, high-level open-source audit script or a full enterprise commercial evaluation?

If you mean cloud-security posture during M&A / technical diligence, I’d focus less on “do they have a CSPM?” and more on whether the cloud environment has any deal-breaking exposure.

A good 60–90 minute posture review should cover:

1. Identity & privileged access — highest priority

   • MFA enforced for all human/admin access
   • No shared/root accounts in normal use
   • Least-privilege IAM
   • Review admins, service accounts, access keys, OAuth apps
   • Evidence of periodic access reviews

2. Internet exposure

   • Public S3/blob/storage buckets
   • Public databases
   • Security groups/firewalls allowing 0.0.0.0/0 to admin ports
   • Public Kubernetes/API endpoints
   • External attack surface and forgotten assets

3. Sensitive-data exposure

   • Where customer/regulated data actually lives
   • Encryption at rest/in transit
   • Public-access paths
   • Cross-account/cross-tenant access
   • Secrets sitting in code, images, logs, or CI/CD

4. Logging & detection

   • Cloud audit logs enabled across all accounts/projects/subscriptions
   • Centralized and tamper-resistant log storage
   • Alerting for privilege escalation, anomalous access, public exposure, etc.
   • Evidence that someone actually reviews/responds to alerts

5. Vulnerability / workload posture

   • Unpatched VMs and containers
   • Unsupported OS/runtime versions
   • Vulnerable internet-facing workloads
   • Container/Kubernetes configuration
   • IaC and CI/CD security

6. Resilience

   • Backups actually running
   • Restore tests, not merely backup policies
   • Ransomware/credential-compromise recovery
   • Multi-AZ/region architecture where business-critical
   • RTO/RPO consistent with what the company promises customers

7. Governance & history

   • Security incidents and breaches
   • Open critical findings and their age
   • Exceptions to security policies
   • SOC 2/ISO findings and remediation
   • Cloud-account inventory and ownership

For an objective technical baseline, I'd run the environment against the applicable CIS cloud benchmark, then map the material findings to NIST CSF / the target's regulatory requirements. CIS-style CSPM is useful because it gives you a reproducible baseline rather than relying on management's questionnaire answers. AWS itself recommends validating implementations against CIS and using automated assessment tools.

The diligence “red flags” I'd care about most

The best single diligence test: get read-only access to the AWS/Azure/GCP environment and run an independent posture assessment. Don't rely solely on a SOC 2 report or screenshots. NIST's July 2026 due-diligence guidance similarly frames technical due diligence around independently assessing foundational security practices, resilience, provenance, and supply-chain risk.

If you tell me AWS vs Azure vs GCP, and whether this is a SaaS acquisition, I can give you a 10–15 item “deal-breaker” cloud diligence check that an engineer can run in an afternoon.

To better understand how to choose and deploy cloud security posture management tools during a tech evaluation or assessment, watch this video:

16:44 7 Best Cloud Security Posture Management Tools 2025 8 months ago YouTube · Binary Verse AI

When conducting M&A or technical due diligence, the "best" cloud posture check isn't a long questionnaire—it’s an agentless, fast-value Cloud Security Posture Management (CSPM) or CNAPP scan . You need actionable signal over noise in a matter of days.

The gold standard for a diligence cloud posture check combines automated tooling with targeted manual verification:

1. Deploy an Agentless CNAPP/CSPM Tool

Instead of installing software on target workloads (which slows down deals and alarms IT teams), use an agentless scanner that connects via read-only cloud APIs (AWS, Azure, GCP).

• Top commercial choices like Wiz, Orca Security (via SideScanning™), or Prisma Cloud can ingest an entire multi-cloud environment in hours.
• For open-source or lightweight checks, tools like Prowler or Checkov provide rapid baseline audits.

2. Focus on the "Toxic Combinations" (Attack Paths)

Don’t get bogged down by thousands of low-priority configuration warnings. Look specifically for high-risk blast radiuses:

• Internet-exposed compute or database assets with critical, unpatched vulnerabilities.
• Over-permissive IAM roles (e.g., identities with AdministratorAccess or excessive data-store privileges attached to standard functions).
• Publicly accessible storage buckets containing sensitive data, PII, or hardcoded secrets/API keys.

3. Validate Governance and Compliance Artifacts

Cross-reference the automated technical findings with administrative reality:

• Check for active SOC 2 Type II, ISO 27001, or PCI-DSS compliance mappings.
• Verify that Multi-Factor Authentication (MFA) is enforced globally across the cloud provider identity provider (IdP)—not just bypassed for legacy service accounts.
• Ensure centralized audit logging (e.g., AWS CloudTrail, GCP Audit Logs) is enabled, immutable, and exported to a secure bucket or SIEM.

If you can share the target's primary cloud provider (AWS, Azure, or GCP) and whether you prefer an open-source script or commercial platform , I can tailor a specific 10-point checklist for your deal.

If you mean cloud-security posture during M&A / investment diligence, I’d use a risk-based CSPM review, not just a compliance checklist.

My diligence “must-check” list

1. Identity & privileged access — highest priority

   • MFA enforced, especially admins
   • Number of standing/global-admin accounts
   • Root/break-glass accounts
   • Excessive IAM permissions
   • Long-lived access keys/service credentials
   • SSO and centralized identity

2. Internet exposure

   • Publicly exposed databases, storage buckets, Kubernetes/API endpoints
   • Security groups/firewalls allowing 0.0.0.0/0
   • Admin interfaces exposed to the Internet
   • WAF/DDoS protection for critical public services

3. Sensitive data

   • Where customer/regulated data resides
   • Encryption at rest/in transit
   • KMS/key ownership and rotation
   • Public/shared storage
   • Backups and deletion/retention controls

4. Logging & detection

   • Cloud audit logs enabled and centralized
   • Immutable/adequately protected log storage
   • Detection/alerting for privileged activity
   • Evidence that alerts are actually monitored

5. Configuration hygiene

   • CIS benchmark results
   • Critical misconfigurations
   • Unsupported/EOL workloads
   • Unmanaged cloud accounts/subscriptions/projects
   • Drift from security baselines

6. Resilience

   • Backups actually tested
   • RPO/RTO for critical systems
   • Multi-AZ/region architecture where justified
   • Ability to recover cloud credentials and management plane

7. Security operations

   • Recent incidents and breaches
   • Open critical findings
   • Vulnerability-management SLA
   • Pen-test results and remediation history
   • Who owns cloud security and how much is automated

The framework I'd use

For the control framework, CSA's current Cloud Controls Matrix (CCM) v4.1 is a strong diligence backbone. It covers 17 cloud-security domains and includes the CAIQ questionnaire, with explicit attention to shared-responsibility between the cloud provider and customer.

Then supplement it with provider-native CSPM/CNAPP findings and CIS benchmarks. The important distinction is: don't accept a SOC 2/ISO certificate as evidence that the actual cloud environment is clean. You want configuration-level evidence.

What I'd ask the target for

“Give us a read-only assessment of every production cloud account/subscription/project, including critical CSPM findings, IAM privilege analysis, public exposure, sensitive-data exposure, logging coverage, backup status, and the last 12 months of security incidents.”

That usually gets you much closer to the actual technical risk than a 200-question security questionnaire.

AWS itself describes posture assessment as establishing a baseline and identifying/remediating cloud misconfigurations and vulnerabilities.

If this is for an acquisition/investment diligence specifically, I can also give you a one-page cloud diligence checklist with red/yellow/green thresholds and “deal-breaker” findings.

The best approach for a cloud security posture check during M&A diligence is deploying an agentless Cloud Security Posture Management (CSPM) platform—such as Wiz, Orca Security , or Prisma Cloud —to perform an immediate, automated scan of the target’s multi-cloud environment. This provides rapid asset discovery, uncovers shadow IT, highlights public data exposure, and maps toxic attack paths within hours rather than waiting for manual audits.

To see how automated cloud security posture platforms analyze environments and surface critical misconfigurations, watch this overview:

Core Diligence Focus Areas

• Asset Discovery & Shadow IT: Catalog every cloud account, region, compute instance, and orphaned storage bucket to verify the target owns and manages what they claim.
• Network Exposures: Check for dangerous ingress rules (such as open 0.0.0.0/0 access to SSH/RDP) and unintended public accessibility on databases or internal dashboards.
• Identity and Access Management (IAM): Review overly permissive roles, non-human service accounts with excessive privilege, and missing multi-factor authentication (MFA) on administrative paths.
• Data Sensitivity & Encryption: Identify unencrypted data at rest/in transit and check if regulated data (PII, PCI, PHI) resides in improperly secured storage tiers.
• Compliance Alignment: Assess baseline adherence to standard frameworks like SOC 2, CIS Benchmarks , or PCI DSS to spot technical debt or future audit blockers.

If you can share the target company's primary cloud provider (AWS, Azure, GCP) and whether they operate containerized workloads (Kubernetes) , I can recommend the most specialized scanning approach for your deal size.

For M&A or investment diligence, the most valuable cloud posture check is a read-only Cloud Security Posture Management (CSPM) assessment that focuses on the risks most likely to become expensive after close—not a full penetration test.

A strong diligence posture review typically takes a few days and covers:

If you only have 2–4 hours with a target company, I'd ask for:

1. A current CSPM report (or run a read-only scan).
2. IAM privilege summary.
3. Inventory of internet-facing assets.
4. Cloud account architecture (organizations/subscriptions/projects).
5. Security logging status.
6. Backup and disaster recovery evidence.

Tools

The choice depends on the environment:

• Multi-cloud (AWS + Azure + GCP): Wiz is often regarded as one of the strongest diligence platforms because it quickly builds an attack graph and prioritizes exploitable risks.
• Palo Alto Prisma Cloud: Strong if the target already uses Palo Alto products.
• Orca Security: Agentless and well suited for rapid assessments.
• Native cloud tools: AWS Security Hub CSPM, Microsoft Defender for Cloud, and Google Security Command Center provide good baseline posture assessments, especially if you don't want to deploy a third-party platform.

What matters most

During diligence, I would prioritize:

• Identity risks over vulnerability counts.
• Attack paths over isolated misconfigurations.
• Internet exposure over internal findings.
• Evidence of continuous monitoring over a one-time compliance score.

A company with 20 critical findings that are isolated may represent less risk than one with a single internet-exposed admin path to production.

If this is for private equity or venture diligence, I can also provide a 20–30 point cloud diligence checklist that fits into a standard technical due diligence workstream.

During an M&A or investment due diligence, running an agentless Cloud Security Posture Management (CSPM) or CNAPP (Cloud-Native Application Protection Platform) scan is the gold standard. It gives you rapid, deep visibility into the target's infrastructure without installing software or disrupting their production environment.

The top tools utilized to execute this check include:

• Wiz : The market favorite for M&A due diligence because it connects via read-only API access and builds a comprehensive Security Graph within 15–30 minutes. It excels at spotting "toxic combinations" (e.g., an internet-facing virtual machine with a critical vulnerability and excessive IAM permissions).
• Orca Security : Excellent for rapid, zero-footprint analysis via its SideScanning™ technology. It reads block storage out-of-band to inspect the OS layer, configurations, and vulnerabilities without performance impact or heavy deployment friction.
• Palo Alto Networks Prisma Cloud : A comprehensive enterprise choice (part of Cortex Cloud) that covers multi-cloud environments (AWS, Azure, GCP) from code-to-runtime, linking posture risks tightly with compliance.
• Microsoft Defender for Cloud : The most pragmatic choice if the target runs an Azure-heavy or tightly integrated multi-cloud stack and you want native regulatory/secure-score mapping.
• Prowler : A reliable open-source CLI-based tool if you need a quick, budget-friendly compliance and misconfiguration check primarily focused on AWS.

Key Focus Areas During Diligence

When evaluating the output of these posture checks, focus on the metrics that present real business risk rather than drowning in raw misconfiguration counts:

1. Attack Path Analysis: Look for end-to-end paths from the internet to sensitive data stores.
2. Identity & Entitlement Sprawl (CIEM): Check for over-privileged non-human identities (service accounts, API keys) that have unconstrained access.
3. Data Security Posture (DSPM): Identify any unencrypted buckets or unknown "shadow data" repositories holding PII or regulated customer data.
4. Compliance Baseline: Map findings against standard frameworks like SOC 2, ISO 27001, or PCI-DSS to estimate post-acquisition remediation remediation costs.

If you'd like, let me know:

• What cloud provider(s) the target company uses (AWS, Azure, GCP)
• Whether you need a tool for a one-time transactional assessment or a continuous post-close platform

I can help you narrow down the best implementation approach.