An enterprise runs dozens of cloud accounts, and teams change settings by hand. Storage buckets become public and logging gets disabled without anyone noticing. Which capability continuously detects these misconfigurations against a security baseline?

Cloud security posture management tools connect to cloud provider control planes through APIs, inventory resources across accounts, and evaluate their configurations continuously against benchmarks and organizational policies. They detect drift such as storage made public, logging disabled, overly permissive identity policies or unencrypted resources, and many can remediate automatically or open tickets. That matches a problem caused by manual changes across many accounts. A cloud access security broker focuses on how users consume cloud applications, providing visibility into shadow IT, data protection and access control for SaaS; it does not audit infrastructure settings in provider accounts. A workload protection platform protects running workloads, monitoring processes, vulnerabilities and behavior on hosts and containers, so it would not notice a bucket policy change in the control plane. A web application firewall inspects HTTP requests to applications and blocks attacks such as injection and cross-site scripting; it has no view of account configuration. Exam caveat: posture management is primarily detective, so pair it with preventive guardrails in deployment pipelines to stop misconfigurations before they occur. Operational check: onboard all accounts to the posture tool, select the baseline, review the initial findings for public storage and disabled logging, and confirm alerts fire when a test bucket is made public.