Every cube on the grid is a real-world cloud resource — an S3 bucket, an IAM role, a security group rule, a database, a compute instance — spread across three provider blocks (AWS, Azure, GCP). Left alone, any resource can quietly drift out of its secure baseline: a bucket becomes public, a role picks up an over-broad policy, a network ACL opens a port it shouldn't. A CSPM platform doesn't prevent drift — it continuously scans the estate (the sweeping beam), classifies what it finds against a compliance baseline (CIS Benchmarks, PCI-DSS, GDPR, HIPAA), and — with auto-remediation enabled — rolls the resource back to a safe state after a short delay, the way Prisma Cloud, Wiz or AWS Security Hub trigger automated playbooks.
P(drift) per resource per tick ∝ driftRate
scan sweep detects drifted resources on contact
if autoRemediate: state → fixing → compliant after remedDelay
else: finding stays open (accumulates risk) until scan re-flags it
- Resources — size of the monitored cloud estate; more resources means more surface area for drift to appear on.
- Drift rate — how often a compliant resource randomly slips into a misconfigured or critical (publicly exposed) state.
- Scan speed — how fast the CSPM sweep beam circles the estate; a slower scan leaves misconfigurations undetected longer.
- Remediation delay — the time an automated fix takes to apply once a finding is detected, mirroring real remediation workflows (ticket, approval, playbook execution).
- Auto-remediate toggle — switch it off to see findings pile up the way a detection-only CSPM tool would leave them for a human to triage.
Real-world relevance: most cloud security incidents trace back to misconfiguration, not novel exploits — the value of CSPM is closing the detection-to-remediation gap before an open S3 bucket or an over-permissive IAM role gets found by someone else first.