Question

A security architect manages a hybrid estate: Azure subscriptions, an AWS organization with 12 accounts, and a GCP organization. Leadership wants a single, prioritized posture management view that scores all three clouds against a consistent baseline of security controls, surfaces cross-cloud attack paths, and lets teams track remediation progress over time. The architect must recommend the design with the least custom engineering effort. Which approach should the architect recommend?

Accepted Answer

Onboard AWS and GCP via native Defender for Cloud cloud connectors, enable the Defender CSPM plan, and rely on the Microsoft cloud security benchmark to normalize Secure Score across all three clouds.

Answer

Deploy Azure Arc agents to every AWS EC2 and GCP Compute Engine instance and use Azure Policy guest configuration to compute posture scores per machine.

Answer

Export AWS Security Hub and GCP Security Command Center findings into a Log Analytics workspace and build custom workbooks to calculate a unified score.

Answer

Enable Microsoft Defender External Attack Surface Management (EASM) for each cloud and use its discovery inventory as the primary posture baseline.