Cloud Posture with Safeguard: Cloud Security Posture Management (CSPM), IaC Security and Kubernetes Security Posture Management (KSPM)

IntermediateFree5 modules · 15 lessons

About this course

A platform engineering guide to Safeguard's cloud posture engines: Cloud Security Posture Management (CSPM), Infrastructure as Code (IaC) security for Terraform, CloudFormation, Helm and Kubernetes manifests, and Kubernetes Security Posture Management (KSPM). You will learn to read posture findings without drowning in them, catch bad configuration in CI before it ever reaches the cloud, detect drift between IaC and the running environment, work through KSPM specifics including CIS Benchmarks, Pod Security, RBAC and exposure, and prioritise posture findings against reachable vulnerabilities in one combined queue.

What you'll learn

Cloud Posture as a Connected Input

What CSPM, IaC Security and KSPM Each Actually Check
Connecting Cloud Accounts and Clusters: What Safeguard Reads for Posture
Reading a Posture Finding Without Drowning: Severity, Exposure and Blast Radius

IaC Security in CI

Terraform and CloudFormation Checks Before a Single Resource Is Created
Helm and Kubernetes Manifest Checks: Catching Bad Config Before It Ships
Wiring IaC Checks Into the Pipeline So Bad Config Never Reaches the Cloud

Drift Between IaC and Reality

What Drift Is and How It Actually Happens
Detecting Drift: Reconciling the IaC State With the Live Account
When a Clean IaC Scan and a Dirty Posture Scan Disagree

01Cloud Posture as a Connected Input3 lessons

What CSPM, IaC Security and KSPM Each Actually Check
Connecting Cloud Accounts and Clusters: What Safeguard Reads for Posture
Reading a Posture Finding Without Drowning: Severity, Exposure and Blast Radius

02IaC Security in CI3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

CIS Kubernetes Benchmark Checks in Practice
Pod Security: Privileged Containers, hostPath and Capabilities
RBAC and Exposure: Overly Broad Roles, Service Account Tokens and Public Endpoints

CSPM and Prioritisation

AWS, Azure and GCP Misconfiguration Checks: Account-Level versus Resource-Level Findings
Prioritising Posture Findings Against Reachable Vulnerabilities
Building One Queue: Combining Posture, Vulnerability and Exposure Signal

Terraform and CloudFormation Checks Before a Single Resource Is Created

Helm and Kubernetes Manifest Checks: Catching Bad Config Before It Ships

Wiring IaC Checks Into the Pipeline So Bad Config Never Reaches the Cloud

03Drift Between IaC and Reality3 lessons

What Drift Is and How It Actually Happens
Detecting Drift: Reconciling the IaC State With the Live Account
When a Clean IaC Scan and a Dirty Posture Scan Disagree

04KSPM Specifics3 lessons

CIS Kubernetes Benchmark Checks in Practice
Pod Security: Privileged Containers, hostPath and Capabilities
RBAC and Exposure: Overly Broad Roles, Service Account Tokens and Public Endpoints

05CSPM and Prioritisation3 lessons

AWS, Azure and GCP Misconfiguration Checks: Account-Level versus Resource-Level Findings
Prioritising Posture Findings Against Reachable Vulnerabilities
Building One Queue: Combining Posture, Vulnerability and Exposure Signal

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.