Security posture describes the current state of an organization’s defenses across its entire environment, and in practice it is assessed domain by domain. Cloud security posture reflects how securely cloud infrastructure and services are configured; application security posture reflects the risk in the organization’s software and code; identity posture covers access rights, privileged accounts, and authentication strength; and SaaS security posture covers the configuration of business applications. Each domain has developed into its own discipline, with approaches such as cloud security posture management (CSPM) and application security posture management (ASPM) dedicated to continuously monitoring it.
Organizations typically measure security posture through a combination of indicators: the volume and severity of open exposures, how quickly critical issues are resolved, the coverage of security controls across assets, alignment with frameworks such as the NIST Cybersecurity Framework or ISO 27001, and the results of testing and validation exercises. Because each domain produces its own data, an accurate picture of overall posture depends on bringing these views together, since attackers move across domains rather than staying within one.