A security team is responsible for a rapidly growing multi-cloud deployment spanning AWS and Azure. Developers frequently spin up new storage buckets, databases, and virtual machines using infrastructure-as-code templates. The team keeps discovering publicly exposed storage buckets and security groups that allow 0.0.0.0/0 inbound access only after an incident occurs. They need a solution that continuously assesses their cloud resource configurations against compliance benchmarks and best-practice policies, and alerts on drift across both providers. Which cloud security capability best meets this requirement?