Tailspin Toys: Posture, Runtime, and Six Thousand Recommendations
Tailspin Toys runs 22 Azure subscriptions, eight AWS accounts, and a GCP pilot. The estate has 1,100 VMs, containers on AKS, and infrastructure as code deployed from GitHub. Secure Score is 41 percent. The company already owns Defender for Servers P2 and Defender for Containers. Defender for Cloud shows 6,000 recommendations, of which 180 involve internet-exposed resources with high-severity issues. Storage accounts and Azure SQL databases hold customer order data and are not covered by any paid plan. The platform team asks whether the foundational CSPM tier is enough, whether they need a database plan, whether agents are required on every VM, and whether pull-request security review is in scope. The CFO wants one number for the board, and a regulator has asked how the Microsoft cloud security benchmark is being met.
1. Explain CSPM versus cloud workload protection, and recommend which Defender for Cloud plans Tailspin should have.
Read the worked answer
CSPM answers "what is misconfigured and how exposed are we" - posture assessment, recommendations, the Microsoft cloud security benchmark, and Secure Score. The foundational CSPM tier is free with every subscription and includes continuous assessment and recommendations.
CWP answers "is something happening right now" - runtime threat detection and alerting per workload type, each licensed separately: Servers, Containers, Storage, Databases, App Service, Key Vault, Resource Manager, DNS.
Recommendation. Add Defender CSPM (paid) because it supplies attack path analysis, cloud security explorer, agentless scanning for data sensitivity, and the regulatory compliance view that maps to the benchmark the regulator is asking about - the free tier gives recommendations but not the multi-standard compliance reporting at that depth. Add Defender for Storage and Defender for Databases for Azure SQL, because those stores hold customer order data and are currently unprotected; posture alone will not detect anomalous access or suspicious exfiltration. Keep Servers P2 and Containers.
Agents. Not required for every VM: P2 includes agentless scanning using disk snapshots, which discovers vulnerabilities, secrets, and malware without installing anything, and complements the Defender for Endpoint agent. Containers use a DaemonSet sensor plus agentless discovery for Kubernetes and registry image scanning.
So foundational CSPM alone is not enough; the gap is runtime coverage for data stores, not more posture.
2. Six thousand recommendations cannot be worked. Explain how to prioritize them and how to answer the CFO's single-number request honestly.
Read the worked answer
Prioritization. Start with the 180 internet-exposed high-severity findings; exposure plus severity plus exploitability is the practical triage order. Use attack path analysis in Defender CSPM to find the small number of findings that combine into a reachable route from the internet to a sensitive data store - these outrank many isolated medium findings because they represent a complete exploitable chain. Cloud security explorer lets the team query that graph directly, for example internet-exposed VM with a managed identity and write access to a storage account. Group the rest by control family rather than by resource, so one remediation - enforcing TLS or private endpoints - clears hundreds of items.
The single number. Secure Score is a percentage of earned points against maximum points for the selected standards, so it is a useful trend indicator and a poor compliance statement. It is scoped to subscriptions and changes when standards change; it does not cover AWS or GCP uniformly unless those connectors are configured, and it says nothing about detective control effectiveness.
Honest framing for the board. Report Secure Score as a trend alongside: count of internet-exposed critical resources, number of complete attack paths, mean time to remediate critical findings, and percentage of the benchmark's controls assessed. One number alone will mislead, and the regulator will notice.
3. Describe how to bring AWS and GCP into the same view without agents everywhere, and how GitHub fits into the security program.
Read the worked answer
Multicloud onboarding. Use the native connectors - a CloudFormation-based connector for each AWS account and a connector for GCP - deployed with least-privilege roles or service accounts. These connectors populate posture across all three clouds into one Secure Score and one recommendation list, and they can be scoped to plan coverage. Autoprovisioning ensures new subscriptions and accounts are covered without a manual checklist, which matters when 22 subscriptions are already growing.
Agentless coverage. Defender for Servers P2 scans machine disks by snapshot rather than installing an agent on every VM, so AWS and GCP instances receive vulnerability, secret, and malware assessment without agent deployment or OS-level dependencies. This is the pragmatic answer for a 1,100-VM estate with mixed ownership. Container images are scanned in registries across clouds, and the AKS cluster gets runtime protection through the sensor.
GitHub. Connect the repository through the DevOps security connector. This gives code-to-cloud context - which pipeline deployed the resource that is now exposed - and surfaces infrastructure-as-code misconfigurations before deployment. With GitHub Advanced Security enabled, pull requests receive inline findings so a public storage bucket or overly permissive security group is caught before merge rather than after. Treat PR gating as the cheapest control in the program, because remediation cost rises by orders of magnitude after deployment.