Overview of cloud security posture management (CSPM)

Run security checks on cloud assets

• Scenario: To perform security checks on all your cloud resources, you can use a combination of cloud product configuration risk check and baseline risk check.

• Instructions:

  • Initial assessment: Use the 100+ free check items to run an initial risk scan on your cloud products and servers.

  • In-depth scan and remediation: After you activate a paid edition (pay-as-you-go or subscription), you can use all check items for in-depth scans and remediate the detected risks.

Meet compliance or internal standards

• Scenario: To meet specific security standards, such as MLPS 2.0, or your organization's internal security baseline requirements, you can use the baseline risk check feature for automated compliance auditing and continuous monitoring.

• Instructions: This feature includes built-in compliance check packages for mainstream standards like MLPS 2.0 and CIS, and supports custom policies, making it the preferred option for automated compliance auditing.

Analyze and block internal attack paths

• Scenario: Use the attack path analysis feature to analyze and block paths that attackers can use to pivot from compromised resources to other critical assets.

• Instructions: This feature intelligently connects scattered configuration risks and visualizes the complete attack path. For example: Publicly accessible ECS → Bound to a high-privilege RAM role → Can control all core OSS buckets.

Region restrictions

Product version restrictions

Billing concepts

• Billing instance: The billing unit for paid Agentic CSPM features. Billing is based on the number of billable cloud service instances scanned, verified, and remediated per billing cycle. Multiple scans, verifications, and remediations within a single billing cycle do not incur additional charges.

  An instance refers to a specific network device or application instance, such as a bucket in Object Storage Service (OSS), an ECS instance, or an ECS security group.

  Instances are classified into billable instances and non-billable instances:

  • Billable instances: Examples include buckets in OSS and ECS instances.

  • Non-billable instances: Examples include ECS security groups.

  For example, if you have 100 billable instances and perform 5 scans within a single billing cycle, you are charged for 100 instances, not 500.

• Check item: Check items are categorized as free or paid.

  • Free check items: The Cloud Service Configuration Risk feature provides some free check items for basic risk awareness. You can perform an unlimited number of scans and verifications. Billing applies only to remediations using paid check items.

    Important

    Users who authorized CSPM (formerly cloud product configuration check) before July 7, 2023, can continue to receive the number of free check items corresponding to their Security Center edition (Anti-virus: 80+, Advanced: 90+, and Enterprise/Ultimate: 250+) until their current edition expires.

  • Paid check items: You must purchase the corresponding edition or separately enable the CSPM service. Fees are included in the edition's service or billed based on the number of billable instances.

For more billing information, see Billing.

Billing details

Security Center offers two billing models: subscription and pay-as-you-go. These models cover the cloud product configuration risk check, system baseline risk check, and attack path analysis features. The following tables describe the feature support and billing details for each model.

Billing and authorizations

• Can I switch from the subscription model to the pay-as-you-go model?

  You cannot switch directly. You must wait for your subscription instance to expire or unsubscribe from it before you can activate the pay-as-you-go service.

  Important

  After you unsubscribe or the subscription expires, any unused authorizations are reset to zero and cannot be transferred.

• What happens if the number of scanned instances exceeds my subscription quota?

  • Subscription model:

    • With burstable protection enabled (enabled by default for new subscribers): When the actual number of scanned instances exceeds the subscription quota, the excess is automatically billed on a pay-as-you-go basis. The price is CNY 0.5/instance/day. Security checks are not interrupted.

    • Without burstable protection: The scan task stops prematurely when the subscription quota is exhausted. To avoid interruption, enable burstable protection or purchase additional subscription quota. Refer to Upgrade to upgrade your edition or purchase more quota.

  • Pay-as-you-go model: There is no instance quota limit. The system continuously bills based on the actual number of billable instances scanned, verified, or remediated each day.

Feature usage

• How do I get started with CSPM for security hardening?

  1. Activation and authorization: Activate the CSPM service and follow the prompts to grant management permissions for your cloud products.

  2. Add assets to check: Add the cloud product instances you want to check, such as ECS and RDS, to Security Center.

  3. Scan and remediate: Configure a check policy and run a scan. After the scan is complete, perform security hardening based on the risk report and remediation suggestions.

• How do I use Security Center to improve the configuration security of my databases?

  Security Center enhances database security in two ways:

  • Cloud security posture management (CSPM):

    • Detection scope: Checks for external configuration risks.

    • Check examples: Checks if access control whitelists are too permissive or if automatic backup and log audit are enabled.

  • Baseline risk check:

    • Detection scope: Checks for internal security flaws on the database's host server.

    • Check examples: Checks if database login accounts use weak passwords or if server configurations follow security best practices.

Unsubscribe and disable

How do I disable the cloud security posture management (CSPM) feature?

• Free edition: No action is required. The Free edition provides only limited detection features and does not involve fees or authorization consumption.

• Subscription edition: In the order management center, follow the instructions in Upgrade or downgrade editions to downgrade your Security Center edition to one that does not include CSPM features.

• Pay-as-you-go edition: On the Overview page, in the Enable Pay-as-You-Go Service area, turn off the CSPM switch.