Cloud Security

My organization is going through massive digital transformation with migrations to the cloud in several SaaS platforms. We need visibility into the security of our various cloud solutions as well as automated remediation. These platforms include ServiceNow, Salesforce, NetSuite, Dayforce, Mulesoft, Microsoft 365 and Azure, and WebEx to name a few. I also need visibility into the cloud spend.

To identify cloud and application management platforms, service partners, or combined solutions that can simplify operations across a distributed hybrid environment. Our main focus is to improve efficiency, automation, governance, and collaboration across multiple entities while maintaining the security and compliance standards required in a regulated insurance setting. We are especially interested in solutions that can reduce manual coordination, improve centralized visibility, and fit well within a mostly MS environment with a large azure footprint, some AWS and GCP usage in acquired entities, and a sizeable on prem legacy estate still in transition. Our ideal target outcome: Select 1 or more vendors for a PoC or PoV within the international markets platform, starting with a limited number of entities and a clear path to broader rollout if there is value. We want to validate ease of deployment, operational fit, integration quality, user experience, and measurable improvements in visibility, automation, and governance before making a wider decision.

Evaluate and select a high-performance CSPM tool capable of automated discovery and real-time monitoring of assets within AWS, Azure, and Google Cloud Platform. The tool must offer robust risk prioritization to combat alert fatigue, support automated remediation workflows for critical vulnerabilities, and provide detailed reporting to satisfy internal audits and external regulatory requirements such as SOC 2

We have a project in plan for this fiscal year, with budget allocated, to evaluate solutions that will assess the security posture of SaaS applications, identify connected applications and AI agents, and help us to reduce risk through more secure configurations and by limiting the actions of connected applications and AI agents. I am the executive sponsor of this project. The cost of the solution will be borne from my budget, and my team will conduct the evaluations.