Examples in this article are illustrative, not customer case studies. Product availability and coverage are described on the linked capability pages.
Open-source CSPM tools read your cloud account configuration through provider APIs and report misconfigurations against a benchmark, at no licence cost. Prowler, ScoutSuite, Cloud Custodian and Steampipe each do a different part of that job, and Trivy, often named alongside them, covers artefacts rather than accounts. Pick by the job, not the star count.
A small security team with a handful of cloud accounts and no budget asks the same thing every year: can open source cover cloud posture? It can cover more than most people expect. This guide describes what each project does, according to its own README, and where the work you will still have to do yourself begins.
The worked example is a two-person platform security team responsible for three AWS accounts and one GCP project. They need a weekly posture report, a way to stop public storage buckets from reappearing, and an answer for the engineering director about which findings matter.
Prowler provides multi-cloud posture checks
Prowler describes itself as an open-source cloud security platform. Its README lists AWS, Azure, GCP and Kubernetes among its providers, plus SaaS platforms such as Microsoft 365 and GitHub, and it maps checks to compliance frameworks including the CIS Benchmarks. Output is available as CSV, HTML and JSON in the OCSF schema, which matters when you want to feed results somewhere else. It is licensed under Apache 2.0.
For the platform team, Prowler is the natural first install. One run per account produces the weekly report, and the framework mapping gives them a vocabulary the engineering director already recognises. What it produces is a list of check results per account, not a view of which result sits in front of a running service.
ScoutSuite produces a point-in-time audit report
ScoutSuite is an open-source, multi-cloud security-auditing tool. Its README lists AWS, Azure and GCP as supported, with several other providers marked alpha. It gathers configuration through provider APIs and renders an interactive HTML report that lets an auditor explore an account without console access. It is licensed under GPL-2.0.
The report format makes ScoutSuite a good fit for an assessment or a second opinion rather than a continuous feed. The platform team might run it quarterly against the GCP project, where they have less experience, and compare its view with Prowler’s.
Cloud Custodian enforces policy rather than only reporting it
Cloud Custodian is a rules engine for cloud accounts and a CNCF incubating project. Policies are YAML documents naming a resource type, filters and actions, and the actions can remediate: tagging, stopping or removing access from matched resources. It runs either on a schedule against the existing fleet or in an event-driven mode, where it deploys serverless functions that react to provider events as they happen. Its README lists AWS, Azure and GCP, and it is licensed under Apache 2.0.
This is the tool that stops the public bucket reappearing. A Custodian policy that fires on bucket creation and removes public access closes the loop that a scanner only reports. The trade-off is operational: automatic remediation in production needs the same review and testing discipline as any other change.
Steampipe turns cloud APIs into SQL you can query
Steampipe exposes cloud and SaaS APIs as SQL tables through plugins, queried live rather than copied into a warehouse first. Benchmarks and dashboards live in the companion Powerpipe project, which runs mods of compliance checks over Steampipe’s tables. Steampipe is licensed under AGPL 3.0.
For the platform team, Steampipe answers the ad hoc questions the scanners do not: which instances have no owner tag, or which roles were created this month. It rewards a team comfortable with SQL and is less of a turnkey posture report.
Trivy is not a CSPM tool, and that is fine
Trivy appears on most open-source CSPM lists, but its README describes targets that are artefacts and clusters: container images, filesystems, git repositories, virtual machine images and Kubernetes. Its scanners find vulnerable packages, IaC misconfigurations, secrets and licences, and it generates SBOMs. Cloud account scanning is not among the targets it lists. It is licensed under Apache 2.0.
Trivy belongs in the pipeline next to your CSPM tool rather than instead of it. The IaC check it runs before apply complements the account check Prowler runs after, which is the pairing described in IaC scanning before apply.
Open-source CSPM tools compared
| Tool | Primary job | Clouds in README | Output | Licence |
|---|---|---|---|---|
| Prowler | Posture checks | AWS, Azure, GCP, more | CSV, HTML, OCSF | Apache 2.0 |
| ScoutSuite | Audit report | AWS, Azure, GCP | HTML | GPL-2.0 |
| Cloud Custodian | Policy and remediation | AWS, Azure, GCP | Logs, metrics | Apache 2.0 |
| Steampipe | SQL over APIs | AWS, Azure, GCP, more | Query results | AGPL 3.0 |
| Trivy | Artefact scanning | Not a cloud account scanner | JSON, SARIF, SBOM | Apache 2.0 |
Open-source CSPM leaves correlation to you
Every tool above reports on its own scope. None of them knows that the security group Prowler flagged fronts the service whose image Trivy flagged, or that the role a workload runs as can reach the database Custodian is protecting. That join is still manual, and it is where the platform team’s time goes when the engineering director asks which finding matters. The ranking problem that follows is the subject of CSPM beyond misconfiguration lists.
Key takeaways
- Start with Prowler for continuous posture checks and add ScoutSuite when you want an independent audit-style report.
- Use Cloud Custodian where you need enforcement, and review its remediation policies like production code.
- Keep Trivy in the pipeline for images and IaC, and do not count it as cloud account coverage.
- Evaluate cross-domain correlation explicitly rather than assuming a scanner report includes deployment and ownership context.
How SecurityVault approaches this
SecurityVault combines supported open-source scanners with native analysis and shared finding context. Cloud posture results can be investigated alongside collected image, workload and identity data instead of being reviewed only as separate reports. Confirm the scanner, provider and connector coverage required for your environment during evaluation.
For an evaluation, keep one existing scanner report as a baseline and compare how its findings appear after ingestion or orchestration. Check identifiers, timestamps, scope and links to the original evidence. Then ask the owning team whether the added deployment or identity context changes the action they would take. This separates the value of the detector from the value of the surrounding workflow. Include operational questions about credentials, updates, failure handling and export so the choice remains workable after the initial demonstration.
Explore Cloud posture or talk to our team about an evaluation with your engineering, security and compliance stakeholders.