FlagThis

Abstract

Cloud Security Posture Management (CSPM) systems detect known vulnerabilities by maintaining a rule set, distributing it to customers, and evaluating it against periodicallycollected asset inventories. To our knowledge, in publicly documented CSPM architectures, the rule set is environment-agnostic and authored or curated centrally by the vendor; updates to it are batched into release cycles and shipped to customers on a cadence that, depending on the vendor and the complexity of the detection, can range from hours to days. The disclosureto-protection windowthe time from a CVE being published in a public catalogue to the customers system being capable of detecting affected assetsis therefore bounded by the vendors release cadence for simple version-match detections, and by additional human authoring time for richer detections that incorporate configuration predicates beyond the affected-software string. This paper proposes an alternative architecture in which the rule set is not vendor-distributed at all but continuously derived, within the customers tenant, from the intersection of public catalogue feeds and the live asset graph. A rule comes into existence when a catalogue entry and an applicable asset are simultaneously present, and goes out of existence when either input ceases to support it. Derivation is bidirectional: new catalogue entries and new assets both trigger it. Derivation incorporates the full structured-field content of catalogue entries, not only the affected-software predicate, producing detections that current automated matching does not generally cover. The live rule set is bounded by environment diversity rather than by catalogue breadth. Prior systems incrementally evaluate a static rule set; we incrementally derive the rule set itself. We present the threat model, the architecture, formal semantics with an equivalence theorem, complexity analysis, a worked example, and an evaluation methodology with experimental design. The contribution is specifically the architectural shift and its latency and resource consequences; rule correctness, alert prioritization, and risks outside structured threat-intelligence catalogues are out of scope and identified as future work.