Defender for Cloud, explained: posture, pipelines, and workload protection
"Is our cloud secure?" is really three questions — are we configured well, is our pipeline safe, and are our running workloads under attack? Defender for Cloud is the one platform that answers all three, and gives your posture a number you can move.
New to cloud? CAMPUX is a free, build-first course. Start here →
Cloud security sprawls: a misconfigured storage account here, a leaked secret in a repo there, a suspicious login on a VM at 3am. Chasing those separately is how gaps open. Microsoft Defender for Cloud pulls them into one place. Microsoft calls it a "Cloud Native Application Protection Platform (CNAPP)... a unified solution that combines multiple cloud security tools to protect applications across their entire lifecycle," across Azure, AWS, GCP, and on-premises. The way to hold it in your head is its three pillars.
Pillar 1 — CSPM: are we configured well?
Cloud Security Posture Management answers the everyday question: is our environment set up safely? It continuously checks resources against a security benchmark, turns each gap into a recommendation, and then, the part that makes it stick, rolls it all up into a Secure Score. As you remediate recommendations, the score goes up. That single number is quietly powerful: it turns "security" from a vague worry into a metric a team can track and a manager can ask about. The foundational CSPM tier is free, so every Azure user already has posture management available.
Pillar 2 — DevSecOps: is the pipeline safe?
Security that only looks at running resources is looking too late. Defender for Cloud extends into the development stage, connecting to GitHub, Azure DevOps, and GitLab to find infrastructure-as-code misconfigurations and exposed secrets in the code, then correlating those findings with the rest of your cloud posture. This is "shift left" made concrete — the vulnerability is caught in a pull request on a Tuesday instead of becoming an incident in production.
Pillar 3 — CWPP: are our workloads under attack?
Cloud Workload Protection Platform is the runtime defence. Through per-resource Defender plans, it watches your servers, containers, storage, databases, Key Vaults, and more for active threats, and raises severity-rated security alerts when it sees something — an anomalous storage access, a suspicious SQL query, a container escape attempt. Where CSPM asks "could we be attacked?", CWPP answers "are we being attacked right now?" and gives you the alert to respond to.
| Pillar | Question it answers | Signature feature |
|---|---|---|
| CSPM | Are we configured securely? | Secure Score + recommendations |
| DevSecOps | Is our pipeline/code safe? | IaC + secret findings in the repo |
| CWPP | Are workloads under attack now? | Threat alerts per Defender plan |
Posture asks "could we be attacked?" Workload protection asks "are we, right now?" You need both — and a score to prove it is improving.
Foundational CSPM — Secure Score, recommendations, multicloud posture — is free and on by default. The deeper protections (Defender for Servers, Containers, Storage, Databases, Key Vault, and so on) are paid plans you enable per workload type. So you can start improving your Secure Score today at no cost, then turn on workload protection where the risk justifies it.
Where to start
The honest first move is not to buy every plan. It is to open Defender for Cloud, look at your Secure Score, and start working the recommendations from most impactful down. That alone closes the misconfigurations that cause most real incidents, and it costs nothing. Then enable the workload-protection plans for your highest-value resources, and wire the DevSecOps connectors so problems get caught in code. Do that, and when an interviewer asks how you would raise a cloud's security posture you can walk them through a sequence you have actually run: score first, protect the crown jewels, then close the loop back in the pipeline.
Questions people also ask
What is Microsoft Defender for Cloud?
It is a cloud native application protection platform (CNAPP) that combines three jobs in one product: checking your configuration against a security benchmark (CSPM), catching misconfigurations and secrets in your code before it deploys (DevSecOps), and watching running resources for active threats (CWPP).
Is Microsoft Defender for Cloud free?
The foundational CSPM tier is free and on by default for every Azure subscription, and it already gives you Secure Score and recommendations. The deeper protections, such as Defender for Servers, Containers, Storage, and Key Vault, are paid plans you turn on per workload type.
How is Secure Score calculated in Defender for Cloud?
Secure Score is the ratio of healthy to total resources across the security controls in the Microsoft Cloud Security Benchmark. Not every control counts equally; controls tied to critical risks carry a higher maximum score, and your total is the sum of the individual control scores.
What is the difference between CSPM and CWPP?
CSPM asks whether your environment is configured safely before anything goes wrong, scoring your posture and handing you recommendations. CWPP asks whether a workload is under attack right now, watching servers, containers, and databases at runtime and raising severity-rated alerts when it sees a real threat.
Does Defender for Cloud work with AWS and GCP?
Yes. Defender for Cloud is multicloud by design. You connect AWS and GCP accounts alongside your Azure subscriptions, and CSPM, DevSecOps, and the relevant Defender plans then apply across all three, not just Azure.