AWS Security Hub CSPM
Operate AWS security standards, findings, controls, and workflow integrations across the agreed organization and account scope.
Managed cloud security posture
Managed multi-cloud security posture, from findings to verified fixes.
CirOps operates cloud security posture across AWS, Microsoft Azure, and Google Cloud using native and cross-cloud platforms, including AWS Security Hub CSPM, Microsoft Defender for Cloud, and Wiz. We prioritize meaningful risks, implement agreed remediation, validate fixes, and maintain evidence over time.
Managed outcome
A managed remediation workflow, not another findings dashboard.
Platform scanning produces findings. The managed service establishes coverage, triage, ownership, change control, remediation, validation, exception handling, and reporting around them.
Known cloud and account coverage
Prioritized risks with assigned ownership
Agreed remediation workflows
Validated finding closure
Visible exceptions and aging
Consistent posture and evidence reporting
Platforms and cloud coverage
Operate the platform that fits the environment.
The selected tooling, cloud scope, enabled plans, integrations, permissions, and commercial licensing are agreed during onboarding. No engagement assumes every capability from every platform.
Microsoft Defender for Cloud
Operate posture assessment across Microsoft Azure, AWS, and Google Cloud where the relevant plans, connectors, and permissions are configured.
Wiz
Operate contextual multi-cloud posture across AWS, Microsoft Azure, Google Cloud, Kubernetes, and supported cloud services within the licensed environment.
Core managed CSPM
From connected scope to finding closure.
Platform assessment may run continuously. Human triage, escalation, remediation, and validation follow the coverage window and responsibilities defined in the operating agreement.
- Cloud organization, account, subscription, and project onboarding
- Asset and configuration visibility
- Benchmark and policy configuration
- Misconfiguration and public-exposure review
- Contextual risk prioritization
- Finding deduplication, ownership, and workflow integration
- Remediation guidance and implementation according to scope
- Change validation and finding closure
- Exception and risk-acceptance tracking
- Compliance-posture mapping and evidence retention
- Monthly reporting and service review
Broader cloud-native security
Add deeper context through separately scoped extensions.
CIEM, CWPP, DSPM, KSPM, IaC security, and AI security posture are separately scoped extensions based on platform support, licensing, environment, workload, and agreement. CNAPP is the platform category that can unify several of these capabilities, not another workstream automatically added beside them.
CIEM
Identity permissions, excessive entitlements, inactive access, and identity-related exposure.
Scoped extension
CWPP
Virtual machine, container, serverless, vulnerability, and runtime workload protection.
Scoped extension
DSPM
Sensitive-data discovery and exposure context across supported data services.
Scoped extension
KSPM
Kubernetes configuration, RBAC, cluster, and workload posture.
Scoped extension
IaC security
Terraform, CloudFormation, ARM, and delivery-pipeline checks before deployment.
Scoped extension
AI security posture
Supported AI services, model endpoints, connected data, identities, and cloud configuration.
Scoped extension
Connected security systems
Connect posture work without blurring ownership.
SIEM
A SIEM centralizes and analyzes security events. It is not replaced by CSPM, and its detection and investigation workflows remain separately owned.
SOC/MDR
A SOC or MDR service investigates and responds to active threats. It is not automatically included in managed posture.
CASB
A CASB governs cloud-application access and data movement. That application-access scope is separate from infrastructure posture.
SSPM
SSPM evaluates SaaS-application configuration. It is adjacent to CASB and distinct from IaaS and PaaS configuration posture.
Process
A finding-to-fix operating workflow.
1
Discover
Confirm cloud coverage, asset inventory, integrations, enabled controls, and visibility gaps.
2
Prioritize
Evaluate severity together with available exposure, identity, workload, data, and business context.
3
Assign
Identify the responsible CirOps or customer owner and the approved change path for each finding.
4
Remediate
Implement or coordinate the agreed configuration, identity, code, or platform change.
5
Validate
Confirm the control change and verify finding closure or document an approved exception.
6
Report
Maintain the finding record, evidence, trends, aging, exceptions, and next priorities.
Coverage and operating agreement
Define coverage before assigning operational responsibility.
Coverage windows, escalation paths, response objectives, and remediation responsibilities are defined for each engagement. Business-hours, extended-hours, and 24/7 coverage options are available according to scope.
Automated findings may be generated at any time. Human triage, escalation, and remediation follow the contracted operating agreement.
- Business-hours, extended-hours, or contracted 24/7 coverage
- In-scope clouds, accounts, subscriptions, projects, clusters, and workloads
- Enabled platforms, plans, policies, and integrations
- Severity model and prioritization method
- Escalation contacts and communication channels
- Response and remediation objectives
- CirOps-managed changes and customer-owned changes
- Approval, maintenance, exception, and emergency-change processes
- Reporting, review, evidence, and retention expectations
Reporting and governance
A cadence for operations, evidence, and decisions.
Monthly cloud security posture reporting is the standard cadence. Critical escalation, operational reviews, evidence requests, and governance reporting follow the agreed service scope.
| Cadence | Deliverable |
|---|---|
| Onboarding | Baseline posture assessment, connected scope, enabled standards, visibility gaps, initial findings, exclusions, and remediation backlog. |
| Event-driven | Critical-finding escalation according to the contracted coverage window and response objectives. |
| Ongoing | Triage, assignment, remediation, validation, exception, and aging updates during agreed service hours. |
| Weekly when agreed | Remediation backlog updates during onboarding, major remediation programmes, or other high-change periods. |
| Monthly | Standard cloud security posture report and service review. |
| Quarterly when scoped | Governance and trend review for stakeholders responsible for risk and investment decisions. |
| On demand when scoped | Technical evidence package or review-query support for the agreed programme. |
What the monthly report covers
The report distinguishes enabled coverage from gaps and includes deeper workload, data, Kubernetes, and AI risks only when those modules are in scope.
- Cloud, account, subscription, project, and tool coverage
- Findings by severity, platform, and age
- New, resolved, reopened, accepted, overdue, and outstanding findings
- Critical attack paths or compound risks where the platform provides context
- Public exposure and identity risk where covered
- Workload, vulnerability, Kubernetes, data, or AI risk only where those modules are scoped
- Completed remediation and validation evidence
- Exceptions and accepted risks
- Compliance-framework posture and evidence status
- Coverage gaps, disabled controls, and integration issues
- Recurring root causes and priorities for the next reporting period
Responsibility model
Keep technical ownership and risk authority explicit.
CirOps owns within scope
Platform operation, finding triage, assigned remediation, validation, reporting, evidence, and escalation.
Customer owns unless delegated in writing
Business-risk acceptance, application changes outside scope, organizational approvals, legal conclusions, third-party dependencies, and customer-owned remediation.
Some findings require product, application, data, or business-owner action. CirOps tracks those findings and their aging without claiming authority that remains with the customer.
Readiness and continuous posture
Start independently or continue after readiness work.
Managed Cloud Security Posture can begin independently, follow Cloud Compliance Readiness, or supply recurring evidence and drift detection for an existing security programme. Tool-generated framework mappings support a programme but do not establish certification or legal compliance.
Explore Cloud Compliance Readiness →Managed cloud security posture questions
Define the posture scope and operating agreement.
Tell us which clouds, tools, accounts, workloads, findings, coverage window, and remediation responsibilities are in scope.
Discuss your cloud security posture