While Foundational CSPM focuses on static misconfigurations, Defender CSPM provides context-aware risk analysis across identity, network, code, and data.
Detailed Feature Matrix
| Capability Category | Foundational CSPM (Free) | Defender CSPM (Paid) |
| Pricing Model | $0 (Free for Azure, AWS, GCP) | Paid (Billed per resource/month) |
| Microsoft Cloud Security Benchmark (MCSB) | Included | Included |
| Classic Secure Score | Included | Included |
| Asset Discovery & Inventory | Included | Included |
| Custom Recommendations | Basic Azure Policy | Advanced Graph Query Custom Policies |
| Agentless VM Vulnerability Scanning | Not Included | Included (OS disk analysis without agents) |
| Attack Path Analysis | Not Included | Included (Context-aware exploit paths) |
| Cloud Security Graph & Explorer | Not Included | Included (Graph queries across identities & data) |
| Data-Aware Security Posture (DSPM) | Not Included | Included (Automated sensitive data discovery) |
| Code-to-Cloud Governance | Basic DevOps visibility | Included (PR annotations & IaC risk mapping) |
| Governance Rules & Task Assignment | Not Included | Included (Assign owners & set SLA deadlines) |
| Regulatory Compliance Frameworks | Basic MCSB Mapping | Full (PCI-DSS, ISO 27001, NIST 800-53, HIPAA) |
Breakdown of Key Features in Defender CSPM
1. Attack Path Analysis
Instead of giving you a disconnected list of 500 alerts, Defender CSPM maps the relationships between resources to reveal multi-step exploit vectors.
- Example: It alerts you if an Internet-facing VM with an unpatched Remote Code Execution (RCE) vulnerability holds a Managed Identity that has read access to a Storage Account containing PII.
2. Agentless Disk & Container Scanning
Scans virtual machine disks (OS and data disks) and container images at rest using Azure storage snapshots. It identifies OS vulnerabilities, installed software flaws (CVEs), and exposed secrets without installing agents or consuming CPU cycles on the target VMs.
3. Cloud Security Graph & Cloud Security Explorer
Constructs a graph database representing your multicloud architecture. Security engineers can run custom KQL-like queries through the Cloud Security Explorer:
- Query Example:
Find all internet-exposed VMs running Linux that have active critical vulnerabilities AND can write to Key Vaults.
4. Data-Aware Security Posture Management (DSPM)
Automatically scans Blob Storage and database instances for sensitive data types (credit card numbers, national identification numbers, private keys). It combines data sensitivity with network exposure to prioritize security fixes on storage accounts hosting high-risk data.
5. Automated Governance Rules
Allows security administrators to enforce SLA-driven remediation targets across engineering teams:
- Automatically assign High Severity recommendations to specific subscription owners via email with a mandatory 30-day remediation SLA.