CSPM Funding Shifts to Identity Risk as AWS Benchmark Gap Exposes Version Lag

Identity-aware posture management draws $67 million in new capital

Rig Security raised $12 million in seed funding from Brightmind Partners and Ten Eleven Ventures for cloud posture management that prioritizes identity threats and attack paths over configuration compliance. Separately, Reco closed a $55 million Series B led by AT&T Ventures for SaaS security posture management, extending the posture-management model beyond infrastructure into application access and data exposure.

The capital allocation reveals a market shift. Traditional CSPM platforms report configuration violations—unencrypted buckets, open security groups, missing patches. The funded companies connect those misconfigurations to exploitable identities, excessive permissions, and business-critical assets. For buyers, this means evaluating CSPM vendors on whether they answer "which misconfiguration creates an exploitable path to sensitive data" rather than "how many policy violations exist."

Rig competes with Microsoft Defender for Cloud, CrowdStrike, Wiz, and Palo Alto Networks' Prisma Cloud. Reco competes with Adaptive Shield, AppOmni, Wing Security, Obsidian Security, and Microsoft Defender for Cloud Apps. Neither company disclosed customer counts, revenue, or measured risk reduction, so the funding signals investor conviction but not verified commercial traction.

The procurement implication: security teams with hundreds of connected SaaS applications face a budget decision between dedicated SSPM platforms and broader CNAPP suites extending into SaaS. The differentiating questions are API coverage for specific applications, detection depth beyond surface-level settings, remediation automation, and integration with identity governance and SIEM workflows.

AWS Security Hub CSPM lags CIS benchmark by two major versions

The CIS AWS Foundations Benchmark reached version 7.1.0, while AWS Security Hub CSPM supports versions 5.0.0, 3.0.0, 1.4.0, and 1.2.0. Some requirements, including metric-filter alarms, remain manual checks. The gap matters because a "compliant" CSPM dashboard may demonstrate adherence only to an older standard or an automated subset of controls.

This is not a new product failure—it is a structural lag between benchmark evolution and vendor implementation. AWS Security Hub competes with Microsoft Defender for Cloud, Google Cloud security tooling, and commercial platforms from Wiz, Palo Alto Networks, and CrowdStrike. Benchmark currency and control automation become differentiators when buyers need audit-ready evidence.

Enterprises pursuing CIS-based assurance should require vendors to state the exact benchmark version assessed, which controls are automated versus manual, implementation timelines for new versions, and whether evidence exports meet auditor requirements. Organizations may need supplemental scripts, consulting, or a second posture tool until their chosen platform supports the required version—a hidden procurement and operational cost.

Microsoft shifts Azure CSPM to opt-in for new subscriptions

Beginning October 27, 2026, Microsoft will change Foundational CSPM in Defender for Cloud from default-enabled to opt-in for new Azure subscriptions. The free tier itself creates no licensing charge, but missed enablement removes baseline recommendations and secure-score visibility from new environments.

The change affects landing-zone automation, Terraform templates, and subscription-provisioning workflows. Azure customers creating subscriptions after October 27 must add CSPM activation to their infrastructure-as-code repositories and control-assurance checklists. The operational cost of missed enablement—delayed security visibility, compliance gaps, manual remediation—exceeds the effort required to update provisioning scripts before the effective date.

Microsoft's free Foundational CSPM competes with AWS Security Hub's native controls, Google Cloud's security services, and paid CNAPP offerings. The opt-in change does not create new costs but shifts the default posture, requiring proactive configuration rather than passive inheritance.

What to watch

The funding pattern suggests buyers are evaluating posture management on identity-risk context and coverage beyond infrastructure. Security teams should test whether vendors connect misconfigurations to privileges, attack paths, and business impact—not merely count violations.

The benchmark-version gap exposes a procurement blind spot. "CIS compliance" is not a binary state. Buyers should audit which benchmark version their CSPM platform assesses, which controls are automated, and how quickly new versions are supported. A compliant dashboard may represent an outdated standard or partial automation.

For Azure users, the October 27 opt-in change requires immediate action. Update subscription factories, policy-as-code templates, and control checklists before new environments lose default posture visibility. The cost of fixing missed enablement later exceeds the cost of updating provisioning workflows now.