Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 345 https://internationalpubls.com Cloud Guardian: A Comprehensive Approach to Cloud Security Posture Management with Automated Multi-Cloud and Container Security G Sreenivasa Yadav1, Dr. G Karthick2, Dr. C.H. Mukundha3 1Research Scholar, Department of Computer Science and Engineering, Annamalai University, Annamalainagar – 608 002. Email:sreenivas1803@gmail.com 2Assistant Professor, Department of Computer Science and Engineering, Annamalai University, Annamalainagar – 608 002. Email: karthick18588@gmail.com 3Associate Professor, Department of Information Technology, Sreenidhi Institute of Science and Technology, Hyderabad. Telangana-501301. Email:reddykrishna143@gmail.com Article History: Received: 03-08-2024 Revised: 23-09-2024 Accepted: 03-10-2024 Abstract: As organizations increasingly adopt multi-cloud environments and containerized applications to improve scalability and operational efficiency, managing security across these diverse platforms has become a critical challenge. Traditional security tools and manual processes are insufficient to handle the complexity and dynamic nature of modern cloud infrastructures. This research introduces Cloud Guardian, a cloud security posture management (CSPM) platform that automates security assessments, policy enforcement, and threat detection across multi-cloud platforms and containerized environments. Cloud Guardian addresses the key security challenges associated with multi-cloud and container environments, including misconfigurations, unpatched vulnerabilities, and inconsistent security policies. By integrating real-time threat intelligence and automated remediation capabilities, Cloud Guardian provides continuous protection, ensuring compliance with industry standards such as CIS and NIST. Additionally, the platform’s self-healing mechanisms and rollback capabilities allow for secure and uninterrupted operations by automatically fixing security issues and reverting changes if necessary. This study evaluates Cloud Guardian's effectiveness in securing complex cloud infrastructures through real-world case studies. The findings demonstrate significant improvements in operational efficiency, compliance, and security posture, reducing the risk of breaches and operational disruptions. Cloud Guardian offers a scalable and automated solution for organizations seeking to safeguard their cloud and container environments while minimizing manual intervention and ensuring continuous security and compliance. Keyword: Cloud Guardian, Cloud Security, CSPM, NIST 1. INTRODUCTION In the era of digital transformation, businesses of all sizes are increasingly migrating their infrastructure and services to the cloud. The adoption of cloud computing has revolutionized the way organizations operate, providing them with greater flexibility, scalability, and cost-efficiency. Cloud platforms such as Amazon Web Services (AWS) [1], Microsoft Azure [2], and Google Cloud Platform (GCP) [3] allow organizations to rapidly deploy applications, store vast amounts of data, and manage global operations with ease. However, along with these benefits comes a significant challenge: cloud security. As organizations expand their use of multi-cloud environments and adopt containerized applications (e.g., Docker, Kubernetes), the complexity of managing and securing cloud infrastructures has grown Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 346 https://internationalpubls.com exponentially. The traditional security models, which were designed for on-premise systems, are often inadequate for today’s dynamic and distributed cloud environments. Consequently, organizations face numerous challenges in securing their cloud and container environments against an ever-evolving threat landscape. Many organizations are increasingly adopting multi-cloud strategies to diversify their cloud infrastructure and reduce reliance on a single provider. This approach enables them to distribute workloads across platforms like AWS, Azure, and GCP, optimizing costs, enhancing performance, and ensuring resilience against potential outages. For instance, AWS can be used for running business- critical applications, Azure for managing databases, and GCP for handling machine learning workloads. However, while multi-cloud strategies offer numerous advantages, they also introduce significant security challenges. One key issue is the inconsistency in security configurations. Each cloud provider has its own unique security settings, access control policies, and monitoring tools, making it difficult to manage security policies uniformly across platforms [4]. This complexity can lead to inconsistencies and create security gaps. Additionally, spreading resources across multiple platforms increases the organization’s attack surface, heightening the risk of misconfigurations that could result in unauthorized access, data breaches, or other security incidents. Maintaining visibility and control over resources in a multi-cloud environment is another challenge. Security teams often struggle to gain a unified view of their infrastructure, making it difficult to detect and respond to threats in real time [5]. The adoption of containerization technologies such as Docker and Kubernetes have significantly transformed cloud computing. Containers enable organizations to develop, deploy, and scale applications more efficiently by abstracting them from the underlying infrastructure. This abstraction allows for greater flexibility and resource optimization, making containers a key component of modern cloud-native applications [6]. They are particularly valuable for organizations practicing DevOps and microservices architectures, as they streamline processes and improve scalability [7]. However, despite the operational benefits containers offer, they also introduce unique security challenges. One major challenge is the dynamic nature of containers. Designed to be lightweight and ephemeral, containers can be created, destroyed, and scaled on demand. While this flexibility enhances operational efficiency, it complicates security, as traditional tools are not well-suited to handle such dynamic environments. Another concern is the use of vulnerable container images. Many containers rely on pre-built images that may contain outdated software or known vulnerabilities, posing a risk to the overall security posture. Security teams must ensure that all container images are thoroughly vetted for vulnerabilities before deployment. In addition to these challenges, Kubernetes—the most widely used container orchestration platform— introduces its own security risks. Misconfigurations in Kubernetes clusters, such as improperly defined role-based access controls (RBAC) or insecure network policies, can expose containers to unauthorized access or exploitation [8]. As organizations scale their container usage, the complexity of managing security also increases. Monitoring workloads, enforcing security compliance, and maintaining robust security policies become more difficult as the environment grows in size and complexity. These challenges underscore the need for specialized security strategies and tools to manage the risks associated with containerized environments. The complexity of multi-cloud and containerized environments has led to a growing number of security challenges. One of the most prominent issues is misconfigurations. Numerous studies highlight that misconfigurations are among the leading causes of security breaches in cloud environments. Misconfigured storage buckets, network settings, or access controls can inadvertently expose sensitive data to unauthorized users, putting organizations at significant risk. Another challenge is the lack of Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 347 https://internationalpubls.com automation in cloud security management. Many organizations still rely on manual processes to oversee security, which is both inefficient and prone to human error. Without automation, security teams struggle to keep pace with the rapid deployment of cloud resources and the increasing number of vulnerabilities that need to be addressed [9]. Threat detection and response also present significant difficulties. Cloud environments are continuously targeted by sophisticated cyberattacks, including ransomware, phishing, and insider threats. The ability to detect these threats in real time and respond swiftly is crucial to minimizing the impact of security incidents. Moreover, organizations must navigate complex compliance and regulatory requirements as they handle more sensitive data in the cloud. Regulations such as GDPR, HIPAA, PCI-DSS, and SOX impose strict standards, and ensuring compliance across multiple cloud platforms and container environments is an overwhelming and ongoing challenge for security teams. These challenges underscore the need for robust, automated security solutions to mitigate risks and ensure compliance in modern cloud environments [9][10]. Motivation Given the complexity and challenges of managing security in multi-cloud and containerized environments, organizations are increasingly adopting CSPM solutions. CSPM platforms, like Cloud Guardian, offer the necessary tools for continuously monitoring cloud environments, enforcing security policies, and automatically detecting and remediating misconfigurations and vulnerabilities. CSPM platforms address several key security challenges. First, they automate security assessments by continuously scanning cloud and container environments for misconfigurations and vulnerabilities, significantly reducing the reliance on manual audits. This automation not only enhances efficiency but also minimizes human error. Second, CSPM solutions ensure consistent enforcement of security policies across all cloud platforms and containerized environments. By applying uniform security measures, they help prevent gaps that could lead to vulnerabilities [11] [12]. Additionally, CSPM platforms provide real-time threat intelligence, integrating live feeds to help organizations detect and respond to emerging threats more quickly. This capability allows security teams to stay ahead of potential attacks. Furthermore, CSPM tools assist organizations in meeting compliance requirements by continuously monitoring security configurations. They also generate reports on compliance with standards such as CIS, NIST, and GDPR, ensuring that organizations stay aligned with regulatory obligations. Problem Statement In the evolving digital landscape, organizations are increasingly adopting multi-cloud environments and containerized applications to enhance scalability, agility, and efficiency. While these technologies offer significant operational benefits, they also introduce a host of security challenges. Managing security across multiple cloud platforms (e.g., AWS, Azure, GCP) and container orchestration systems (e.g., Docker, Kubernetes) has become increasingly complex. Security misconfigurations, unpatched vulnerabilities, and inconsistent policy enforcement pose significant risks, making cloud infrastructure and container workloads vulnerable to breaches and cyberattacks. Traditional security tools and manual processes are insufficient for maintaining the security and compliance of such dynamic and distributed environments. The lack of real-time threat detection, automated security fixes, and consistent policy enforcement across multi-cloud and container platforms leaves organizations exposed to potential data breaches, regulatory non-compliance, and operational disruptions. Cloud Guardian addresses these challenges by offering a comprehensive CSPM solution designed to automate security assessments, policy enforcement, and threat remediation across multi-cloud and container environments. This research aims to investigate how Cloud Guardian streamlines security management, automates vulnerability detection and remediation, and ensures continuous compliance Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 348 https://internationalpubls.com with industry standards. The study focuses on the platform’s ability to automate policy enforcement, integrate real-time threat intelligence, and provide self-healing capabilities to protect cloud and containerized infrastructures from security risks. Through real-world case studies, the effectiveness of Cloud Guardian in mitigating multi-cloud and container security challenges will be evaluated. Significance of the Study This research highlights the effectiveness of Cloud Guardian in addressing security challenges in multi-cloud and containerized environments, where traditional tools often fall short. It emphasizes the importance of automating security posture management, including security assessments, policy enforcement, and incident response, to mitigate risks such as misconfigurations and vulnerabilities. Cloud Guardian improves cloud security posture by integrating real-time threat intelligence and self- healing capabilities, allowing for faster threat remediation. The study also underscores Cloud Guardian’s role in ensuring regulatory compliance for industries like healthcare, finance, and government, by continuously monitoring and enforcing security policies to meet standards such as CIS, NIST, HIPAA, and PCI-DSS. Furthermore, automation enhances operational efficiency by reducing downtime and disruptions caused by security incidents. Overall, this research contributes to cloud security by demonstrating how advanced CSPM platforms like Cloud Guardian can transform security management for multi-cloud and containerized infrastructures. Contribution of this research The contribution of this research is to explore how Cloud Guardian, a CSPM platform, addresses the growing security challenges posed by multi-cloud and containerized environments. As organizations increasingly adopt cloud infrastructures and container technologies, maintaining a consistent and secure posture across diverse platforms such as AWS, Azure, GCP, Docker, and Kubernetes becomes complex and resource-intensive. Cloud Guardian aims to provide a comprehensive and automated solution by: • Automating security assessments to detect misconfigurations, vulnerabilities, and policy violations in real-time across multiple cloud and container platforms. • Enforcing consistent security policies that adhere to industry standards (CIS, NIST) and organizational requirements, ensuring continuous compliance across all environments. • Integrating real-time threat intelligence to proactively identify and mitigate emerging security threats and zero-day vulnerabilities. • Implementing automated remediation to resolve security issues and apply patches without manual intervention, minimizing the window of exposure. • Providing rollback capabilities to ensure operational stability by allowing quick reversion to previous states if automated fixes cause disruptions. This research will demonstrate how Cloud Guardian streamlines cloud security management through automation, improves compliance, and strengthens overall security posture in multi-cloud and container environments, using real-world case studies to validate its effectiveness. 2. LITERATURE REVIEW Traditional security models are no longer sufficient, leading to the development of CSPM solutions. These tools automate security assessments, policy enforcement, and vulnerability management to address issues like misconfigurations and inconsistent security policies. Research emphasizes the importance of automation, real-time threat detection, and continuous compliance to manage modern cloud infrastructures. However, challenges remain in achieving consistent security across Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 349 https://internationalpubls.com heterogeneous cloud environments and containers. The review also explores how Cloud Guardian offers an automated, unified approach to overcoming these challenges in cloud and container security management. Diogenes et al. introduced a method to assist companies in identifying business opportunities and addressing gaps in their existing on-premise security frameworks, which could be enhanced by adopting cloud security solutions. In recent years, cloud security has evolved significantly, offering organizations compelling advantages for actively monitoring their assets and improving security measures. Cloud security features, ranging from threat intelligence to geo-location- based conditional access, provide robust protection for corporate devices, regardless of their physical location [14]. Wijenayake et al. emphasized the relevance of graph-based approaches in selecting security-conscious cloud service providers for bidirectional, multi-cloud data workflows. As data- intensive scientific applications traverse multiple cloud environments, their security posture requirements shift during the data transfer process [15]. Bulut et al. proposed a framework called NL2Vul, designed to assess vulnerability scores with minimal human intervention. By utilizing deep neural networks, NL2Vul is trained on software vulnerability descriptions from the National Vulnerability Database (NVD) to predict these scores. To adapt the trained NVD model for various data sources used in evaluating risk posture in Cloud Security Posture Management (CSPM), NL2Vul employs transfer learning, enabling rapid retraining [16]. Coppola et al. explored the design of a Cloud Security Posture Management (CSPM) tool focused on monitoring AWS assets, using the NIST Cybersecurity Framework v1.1 (NIST CSF) as a reference. The tool provides continuous threat intelligence monitoring and misconfiguration alerts, leveraging AI to identify risks and offer remediation strategies. By integrating AWS services such as VPC traffic logs, GuardDuty, and CloudTrail, the tool can be tailored to meet an organization's specific security needs. The paper details the CSPM tool's design, monitoring, and reporting features to enhance cloud security and compliance. Through the strategic application of AI and Big Data, the tool helps organizations strengthen their cloud security posture and mitigate environmental risks. This work impacts cloud data management, digital connectivity, and smart mobility, all of which are crucial components of smart cities [17]. Williams et al. examined the expanded attack surface of an organization’s infrastructure and applications, particularly in cases where cloud and mobile computing extend beyond the traditional physical boundaries of the organization. This extension introduces challenges in assessing the overall security posture. The study reviewed methodologies such as vulnerability assessments and penetration testing, which help identify vulnerabilities that contribute to risk assessment and the development of security policies. These methodologies also aid in evaluating the effectiveness of countermeasures, determining whether they provide value for money and a positive return on investment [18]. Haim et al. introduced a system designed to perform a coarse-grained assessment of an organization's security posture against a standard control framework. They proposed an AI-based model to automate the mapping process and empirically evaluated its performance. Building on this, they developed a domain-specific taxonomy that enhances the granularity of the assessment while also providing explainability. Additionally, they discussed how this system is currently used in production environments [19]. An et al. proposed a cloud security tool called CloudSafe, which automates security assessments and enforces optimal security controls by integrating various security tools. To demonstrate its practicality, they implemented CloudSafe and conducted security assessments on Amazon AWS. They also analyzed four security countermeasures: Vulnerability Patching, Virtual Patching, Network Hardening, and Moving Target Defense. Virtual Patching, Network Hardening, and Moving Target Defense were found feasible for deployment, with proof-of-concept demonstrations developed to validate the effectiveness of each feasible countermeasure [20]. Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 350 https://internationalpubls.com 3. PROPOSED WORK In today’s rapidly evolving digital landscape, adopting cloud computing and containerized applications has become ubiquitous. As organizations increasingly migrate workloads to multi-cloud environments and adopt container technologies like Docker and Kubernetes, the complexity of securing these environments grows exponentially. Traditional security practices often fail to address these cloud ecosystems' dynamic nature, leading to misconfigurations, vulnerabilities, and potential security breaches. Cloud Guardian is a novel CSPM platform designed to tackle these challenges head-on. By integrating multi-cloud and container security capabilities with advanced automation, Cloud Guardian provides a comprehensive solution for securing cloud infrastructures. The platform automates security assessments, policy enforcement, and incident response, ensuring that cloud environments remain compliant with industry standards and resilient against evolving threats. With real-time threat intelligence and self-healing mechanisms, Cloud Guardian acts as a sentinel, continuously monitoring cloud workloads, detecting misconfigurations, and applying automated security fixes. 3.1 Multi-Cloud and Multi-Container Support As cloud adoption accelerates, organizations are increasingly utilizing multiple cloud platforms like AWS, Azure, and GCP to gain flexibility, redundancy, and scalability. Simultaneously, container technologies such as Docker and Kubernetes have become essential for efficiently developing, deploying, and scaling applications. However, managing the security of such diverse cloud and container environments presents significant challenges, as each platform has its own unique security tools, APIs, and configuration requirements. Cloud Guardian addresses these challenges by seamlessly integrating with multi-cloud environments (AWS, Azure, GCP) and container orchestration platforms (Docker and Kubernetes), offering comprehensive security management across these varied infrastructures. By supporting both cloud and container platforms, Cloud Guardian enables organizations to maintain a unified security posture, ensuring consistent security policies, real-time threat monitoring, and automated response mechanisms. The key benefits of Cloud Guardian’s multi-cloud and multi-container support include cross-platform visibility, which consolidates security insights across various cloud providers and container platforms, giving organizations a single-pane-of-glass view of their entire cloud ecosystem. Additionally, it offers unified policy management, allowing security policies to be defined and enforced consistently across all environments, minimizing the risk of gaps or misconfigurations. Finally, Cloud Guardian is scalable, growing alongside organizations as they expand their operations across multiple clouds and containerized applications, ensuring continuous security monitoring at every stage. 3.1.1 API Integration for Multi-Cloud Platforms (AWS, Azure, GCP) Cloud Guardian integrates with major cloud providers—AWS, Azure, and GCP—by utilizing their native APIs. Each cloud platform offers unique APIs to access security configuration data, network settings, user permissions, and runtime activity. Through these integrations, Cloud Guardian ensures real-time synchronization with each platform’s infrastructure, providing comprehensive security management. For AWS integration, Cloud Guardian connects with services such as AWS Config, CloudTrail, and GuardDuty via their APIs. This allows continuous monitoring for security risks like misconfigured S3 buckets, excessive permissions in IAM roles, or exposed EC2 instances. In the case of Azure, Cloud Guardian interacts with Azure Security Center, Azure Policy, and Azure Resource Manager (ARM) through Azure’s API to enforce security policies, detect vulnerabilities, and monitor compliance with industry standards. Similarly, for GCP, Cloud Guardian integrates with services like Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 351 https://internationalpubls.com Google Cloud Security Command Center, Google IAM, and VPC security settings, ensuring that security policies are enforced across all GCP workloads, including virtual machines, databases, and networking components. These integrations offer key benefits such as automated configuration monitoring. Cloud Guardian continuously monitors security configurations through cloud APIs, detecting misconfigurations and alerting administrators or automatically correcting issues. Additionally, the API integration enables Cloud Guardian to provide security posture visualization, presenting data on security controls through a unified dashboard, allowing organizations to see the overall security posture across all cloud environments at a glance. 3.1.2 Container Orchestration Support (Docker, Kubernetes) Cloud Guardian is fully integrated with container platforms like Docker and Kubernetes, allowing containerized applications to be secured alongside traditional cloud workloads. For Docker, Cloud Guardian connects with Docker’s API to scan images, monitor containers, and enforce security best practices. This integration enables automated vulnerability scans of Docker images and running containers to identify outdated software, insecure configurations, or exposed services. Additionally, Cloud Guardian enforces container runtime security policies, ensuring compliance with least-privilege principles, container isolation, and network security best practices. With Kubernetes, Cloud Guardian leverages the Kubernetes API to offer comprehensive cluster-wide security management. It communicates with the Kubernetes control plane to monitor the security posture of nodes, pods, and services, ensuring that role-based access control (RBAC) policies are enforced, containers are properly isolated, and network policies are applied. Furthermore, Cloud Guardian manages the security contexts of Kubernetes workloads, verifying that no container has unnecessary privileges and that pods are configured securely. The platform also continuously benchmarks Kubernetes clusters against the Center for Internet Security (CIS) Kubernetes standards, providing insights into the security posture and recommending improvements to enhance overall security. 3.1.3 Cross-Platform Security Management To ensure consistent security across diverse cloud and container environments, Cloud Guardian’s architecture is designed for effective cross-platform security management. It features centralized policy management, where security policies defined in Cloud Guardian are centrally controlled and uniformly applied across AWS, Azure, GCP, Docker, and Kubernetes. This approach simplifies the management of multiple security tools and platforms, reducing overall complexity. Cloud Guardian also integrates unified threat intelligence feeds, allowing for simultaneous identification and mitigation of vulnerabilities and attack vectors across all platforms. This ensures a comprehensive approach to threat detection and response. Furthermore, Cloud Guardian provides automated incident response capabilities. When a vulnerability is detected in any cloud or container environment, Cloud Guardian can initiate automated remediation processes, such as patching or configuration adjustments, across all affected platforms. By delivering unified security management, Cloud Guardian effectively addresses the complexities of securing modern cloud-native architectures, enhancing overall security posture and minimizing risk. 3.2 Automated Security Assessment and Policy Enforcement In dynamic cloud environments where infrastructure and workloads can change rapidly, manual security assessments and policy enforcement are often insufficient to maintain continuous compliance and protection. Cloud Guardian addresses this challenge by incorporating automated security assessment and policy enforcement mechanisms that ensure cloud environments remain secure, compliant, and resilient against evolving threats. By automating these processes, Cloud Guardian helps Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 352 https://internationalpubls.com organizations prevent misconfigurations, enforce security standards, and respond quickly to vulnerabilities or security incidents. 3.2.1 Policy Automation Automated policy enforcement is essential for maintaining a consistent security posture across multi- cloud and container environments, and Cloud Guardian excels in this area. It allows for the centralized definition of security policies based on organizational standards and industry best practices. These policies are then applied consistently across AWS, Azure, GCP, Docker, and Kubernetes. Cloud Guardian automates policy enforcement through real-time monitoring, configuration management, and dynamic updates. It continuously monitors resources and containers, detects deviations from policies, and triggers alerts or automated responses. Integration with cloud and container platforms ensures that security policies are applied during resource provisioning and adjusted as infrastructure changes occur. The platform ensures continuous compliance by regularly assessing resources against predefined policies and generating automated compliance reports for regulatory audits. Key benefits include proactive security, scalable enforcement across multiple platforms, and increased efficiency by reducing the risk of human error and saving time. 3.2.2 Self-Healing Incident Response In cloud environments, security incidents can occur at any time due to misconfigurations, vulnerabilities, or malicious attacks. Cloud Guardian incorporates a self-healing incident response mechanism that automatically detects, isolates, and remediates security issues. This ensures that breaches or policy violations are quickly resolved without manual intervention, minimizing the time vulnerabilities remain exposed. The self-healing mechanism works through several key processes. First, Cloud Guardian enables automated detection through continuous monitoring of cloud infrastructure and container workloads for suspicious activities, misconfigurations, or vulnerabilities. It monitors network traffic, access control changes, and unusual behaviors in container environments. Real-time alerts are triggered when security violations are detected, integrating with cloud-native monitoring tools like AWS CloudWatch, Azure Monitor, and Kubernetes logs to detect issues such as exposed services or unauthorized access. When incidents occur, Cloud Guardian initiates automated remediation using predefined actions. For example, if a misconfigured firewall rule in AWS is detected, the platform automatically reconfigures it to meet security policies. Similarly, if a vulnerability is found in a Docker image, Cloud Guardian rebuilds the image with necessary patches and redeploys the container. Incident playbooks can also be defined by administrators to automate responses based on incident severity. Cloud Guardian’s self-healing in action addresses various scenarios. Misconfigurations, like unencrypted S3 buckets or containers with excessive privileges, are automatically corrected. Vulnerabilities are patched using an up-to-date knowledgebase, reducing exposure. A rollback mechanism is also available for high-impact fixes, allowing users to restore previous configurations if necessary, minimizing operational disruptions while maintaining security. Post-incident, Cloud Guardian provides detailed audit logs documenting each detected and remediated incident. Additionally, root cause analysis is offered, helping security teams understand the vulnerabilities or misconfigurations that led to the issue, and allowing them to improve security policies. Key benefits of Cloud Guardian’s self-healing mechanism include faster response times, reducing the potential damage from vulnerabilities. It also minimizes manual intervention, enabling security teams to focus on more complex tasks. Moreover, it works in the background, ensuring issues are resolved without disrupting normal business operations. Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 353 https://internationalpubls.com 3.3 Real-Time Threat Intelligence and Self-Updating Knowledgebase Cloud Guardian tackles this challenge by integrating real-time threat intelligence and a self-updating knowledge base. These features ensure that the platform is always aware of emerging threats, enabling it to assess, detect, and mitigate risks across multi-cloud and container platforms with minimal manual intervention. 3.3.1 Threat Intelligence Cloud Guardian enhances cloud security by integrating real-time threat intelligence feeds from various sources, including public databases like the NVD and CVE lists, as well as private and commercial providers. It also incorporates cloud-specific threat data from platforms such as AWS Guard Duty, Azure Security Center, and Google Cloud’s Security Command Center. The platform continuously updates with new threat information, assesses its impact on cloud workloads and containers, and promptly addresses critical issues with automated patches. Cloud Guardian prioritizes vulnerabilities based on their severity using CVSS scores and cloud-specific context. It also correlates data from multiple feeds to detect coordinated attacks across different platforms. Key benefits include a proactive defense approach, continuous protection against new threats, and effective prioritization of remediation efforts. 3.3.2 Self-Updating Knowledgebase Cloud Guardian features a self-updating knowledgebase that is crucial for maintaining up-to-date vulnerability data, threat information, and security guidelines. This component autonomously gathers data from various sources, ensuring that Cloud Guardian’s security assessments and remediation processes are based on the most recent intelligence. The knowledgebase is updated by integrating information from multiple threat intelligence sources, vulnerability databases, and security benchmarks. It pulls data from open databases such as the NVD and CVE, as well as cloud-specific data related to AWS, Azure, GCP, Docker, and Kubernetes. These updates occur in real-time or at scheduled intervals, with the data converted into flexible formats like JSON for efficient querying. Once new data is integrated, it is categorized based on severity and relevance, which informs Cloud Guardian's security assessment engine and policy enforcement mechanisms. The platform automatically reassesses security postures and updates policies to address newly discovered vulnerabilities. For instance, if a vulnerability in a Docker base image is identified, Cloud Guardian will adjust its policies to detect and mitigate issues related to that image. Additionally, Cloud Guardian’s knowledge base utilizes machine learning to analyze threat patterns and predict future risks, improving its ability to anticipate and address potential security issues. Historical data is also stored for trend analysis, providing insights into the evolution of the security posture over time. The self- updating knowledgebase offers several benefits: it ensures security assessments are based on current data, reduces manual effort by automating updates, and allows for quicker response to emerging threats. 3.4 Security Benchmarking and Visualization Effective cloud security management requires real-time threat detection and remediation and a way to measure and monitor the overall security posture of cloud infrastructures and containerized environments. Cloud Guardian provides robust security benchmarking capabilities that allow organizations to assess their compliance with industry standards, such as the Center for Internet Security (CIS) and the National Institute of Standards and Technology (NIST). Additionally, Cloud Guardian’s security dashboard provides real-time visualizations to give stakeholders comprehensive insights into their cloud and container security posture, facilitating informed decision-making. Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 354 https://internationalpubls.com 3.4.1 Benchmarking Benchmarking is a critical component in maintaining a strong security posture in cloud environments. By comparing security configurations against established industry standards, organizations can ensure that their cloud resources are configured securely and are in compliance with regulatory and best- practice guidelines. Cloud Guardian integrates with several widely recognized security frameworks, such as CIS and NIST, to provide comprehensive security posture benchmarking across multi-cloud and container environments. A. How Benchmarking Works in Cloud Guardian Cloud Guardian incorporates established security guidelines to ensure robust protection across various technologies. It integrates the CIS Benchmarks, which provide configuration standards for securing cloud platforms and container orchestration systems. For cloud environments, Cloud Guardian applies specific CIS guidelines tailored to services like AWS, Azure, and Google Cloud. This includes evaluating secure IAM role management, VPC configurations, and data encryption both at rest and in transit. In the context of containerized environments, Cloud Guardian uses the CIS Kubernetes Benchmark to assess Kubernetes clusters, focusing on RBAC (Role-Based Access Control), pod security, and network policies. Additionally, Cloud Guardian aligns with the NIST Cybersecurity Framework (CSF), which adopts a risk-based approach to enhancing cybersecurity resilience. The platform evaluates cloud environments against NIST standards in crucial areas such as identity management, access control, and incident response. It also incorporates NIST Special Publication 800-53, which outlines comprehensive security and privacy controls for federal information systems, ensuring compliance for organizations, particularly in highly regulated industries like finance and healthcare. B. Automated Security Assessments Continuous Monitoring: Cloud Guardian continuously monitors the cloud environment and container workloads, running automated assessments against predefined benchmarks. This provides organizations with ongoing assurance that their infrastructure is secure and compliant. Policy Enforcement Based on Benchmarks: When discrepancies between the benchmark and actual configurations are detected (e.g., unpatched vulnerabilities, insecure network configurations, overly permissive IAM roles), Cloud Guardian enforces security policies to automatically remediate these issues or notify administrators. C. Customizable Benchmarking: Custom Benchmarks: While Cloud Guardian provides default benchmarks from industry standards like CIS and NIST, organizations can also define custom benchmarks tailored to their specific compliance needs or security goals. For example, a financial institution might create custom benchmarks based on regulatory requirements such as PCI-DSS. Multi-Cloud and Multi-Container Benchmarking: Cloud Guardian’s benchmarking applies across various cloud environments (AWS, Azure, GCP) and container platforms (Docker, Kubernetes), providing a unified and comprehensive assessment of an organization's entire cloud security posture. D. Benchmarking Process: Data Collection: Cloud Guardian collects security configuration data from the cloud platforms and container environments using APIs. This includes network configurations, user permissions, resource provisioning settings, and more. The platform compares the collected data against industry standards like CIS or NIST to identify any deviations or misconfigurations. Based on the benchmark results, Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 355 https://internationalpubls.com Cloud Guardian generates a comprehensive report detailing areas of compliance and non-compliance, along with recommendations for improving the security posture. 3.4.2 Visualization Security visualization is essential for decision-makers to understand the current state of cloud security, identify risks, and take informed actions. Cloud Guardian’s security dashboard provides real-time visualizations that present security posture insights in an intuitive and actionable way. This dashboard enables cloud administrators, security teams, and executives to monitor security metrics, compliance status, and the overall risk profile of their cloud and container environments at a glance. Real-Time Security Dashboard The Cloud Guardian dashboard provides a centralized view of an organization's cloud and container security posture, consolidating data from multiple cloud platforms—such as AWS, Azure, and GCP— and container environments like Docker and Kubernetes. It offers real-time updates, delivering live security assessments, threat alerts, and compliance reports to give immediate visibility into the security status of all cloud resources. Users can explore the dashboard in detail, with drill-down capabilities allowing them to investigate specific areas such as vulnerabilities, non-compliant resources, and incidents. For instance, selecting a particular AWS instance reveals detailed information about its security configuration, compliance with CIS benchmarks, and any detected threats. Key Visualizations and Metrics The Cloud Guardian dashboard offers a comprehensive view of an organization’s compliance and security status. It displays an overall compliance score based on selected benchmarks, such as CIS and NIST, highlighting compliant resources and those needing remediation. Compliance heatmaps facilitate the identification of non-compliance areas across different cloud services and regions. The dashboard also visualizes threat alerts detected through real-time intelligence feeds, categorizing them by priority levels like critical, high, and medium, based on severity and exploitability. Threat graphs illustrate trends over time, helping security teams monitor spikes in vulnerabilities or attacks and adjust defenses accordingly. Additionally, Cloud Guardian provides historical trend graphs that track the evolution of the organization’s security posture, allowing for an assessment of whether security efforts are improving, stagnating, or deteriorating. Benchmarking progress is visualized to show improvements in compliance with standards like CIS and NIST, and to pinpoint areas needing attention. The dashboard includes real-time data on policy enforcement and incident response, showcasing automated fixes, rollback actions, and resolved incidents. An interactive incident timeline offers insights into the occurrence, resolution, and remediation time of security incidents, helping organizations determine if further actions are necessary. Customizable Dashboards Cloud Guardian’s dashboard is designed to be customizable according to different user roles. Security teams can tailor their views to focus on detailed compliance issues and vulnerabilities, while executives can access high-level overviews of the organization’s overall cloud security and compliance scores. The dashboard also supports customizable widgets, enabling users to track specific metrics such as unpatched vulnerabilities, network configurations, or particular compliance requirements. Additionally, users can generate and export reports directly from the dashboard, allowing for the creation of compliance summaries or detailed security insights needed for audits or internal reviews. Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 356 https://internationalpubls.com Automated Alerts and Notifications The Cloud Guardian dashboard features real-time notifications that automatically alert relevant stakeholders when security thresholds are breached. For instance, if a cloud resource deviates from compliance with a CIS benchmark, the system can immediately notify administrators. Additionally, the dashboard integrates with incident response platforms and ticketing systems, such as Jira or ServiceNow. This integration allows Cloud Guardian to automatically create tasks for security teams, facilitating the prompt resolution of critical vulnerabilities or non-compliant resources. 3.5 Automated Security Fixes with Rollback In cloud and container environments, manual remediation of vulnerabilities and misconfigurations can lead to delays, increased risk of security breaches, and inefficiencies. Cloud Guardian addresses these issues through automated security fixes, which apply immediate remediation actions when security gaps are identified, and a rollback capability, ensuring that any changes made can be reverted if necessary. This approach minimizes downtime, maintains operational stability, and allows for agile security management. 3.5.1 Automated Fixes Automating security fixes is crucial for effective CSPM, especially in dynamic multi-cloud and containerized environments. Cloud Guardian enables real-time remediation by automatically detecting and addressing vulnerabilities and misconfigurations, which minimizes the need for manual intervention and reduces the risk of exploitation. The platform continuously monitors cloud environments (AWS, Azure, GCP) and container platforms (Docker, Kubernetes), identifying issues such as unpatched software or misconfigured policies. Automated assessments determine necessary actions, following predefined playbooks based on best practices. For example, insecure IAM policies or vulnerable Docker images are automatically corrected or updated. Cloud Guardian also applies fixes to misconfigurations, like enforcing encryption on public cloud storage services. It uses context-aware, intelligent remediation to ensure minimal disruption and allows organizations to set custom security policies for handling different types of vulnerabilities. This automation significantly shortens the time from vulnerability detection to remediation, enhancing security and reducing the burden on security teams. 3.5.2 Rollback Capability Cloud Guardian’s rollback capability addresses potential disruptions from automated changes by allowing users to revert changes if needed. The rollback process starts with automatic snapshots of configurations before applying fixes, ensuring that changes can be undone if issues arise. Cloud Guardian maintains version control for cloud configurations and container settings, enabling easy restoration to previous states. Rollbacks can be triggered automatically by detecting critical errors or manually by administrators if operational problems occur. The process is designed to minimize downtime and disruption. Post-rollback, Cloud Guardian provides audit logs and root cause analysis to understand and improve future fixes. Additionally, the rollback feature integrates with CI/CD pipelines, allowing seamless reversion of changes that impact development or staging environments. Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 357 https://internationalpubls.com Figure 1: The proposed design and architecture of Cloud Guardian 3.6 Design and Architecture of Cloud Guardian Cloud Guardian's architecture is designed to provide a robust and scalable CSPM platform that integrates seamlessly with multi-cloud and containerized environments which is shown in figure 1. Cloud Platforms (AWS, Azure, GCP), Container Platforms (Docker, Kubernetes), and the CSPM Core, which handles automated security assessments, threat intelligence, policy enforcement, and remediation across these environments. The integration with various cloud platforms and container systems is achieved via APIs. For instance, Cloud Guardian connects to AWS APIs to monitor configurations, IAM policies, and resource usage. It does the same with Azure by integrating with Azure Security Center and Azure Resource Manager, assessing virtual machines, databases, and network settings. In GCP, Cloud Guardian monitors VMs, storage services, and IAM roles. Similarly, for container platforms like Docker and Kubernetes, Cloud Guardian scans container images and running containers for vulnerabilities and monitors configurations to ensure secure deployment practices. Central to Cloud Guardian's operation is the CSPM Core, which processes the data collected from these cloud and container environments. This core component includes several key functions. It collects configuration and security data from cloud and container platforms, which is then assessed for compliance with predefined security policies and benchmarks, such as CIS and NIST. Automated fixes are applied as needed to address any detected vulnerabilities or misconfigurations. The core also incorporates real-time threat intelligence from public and private feeds, keeping the system updated on the latest vulnerabilities. This intelligence is used to cross-check cloud and container environments and trigger automated responses to new threats. The CSPM Core also benchmarks the security posture against industry standards, displaying the results on the Cloud Guardian Dashboard. This visualization provides administrators with real-time insights into the security status, compliance, and ongoing remediation efforts. Automated fixes are applied to address issues, with a rollback mechanism in place to restore previous configurations if necessary, ensuring system stability and minimizing disruption. The overall data flow begins with the collection of information from cloud and container platforms, which is then assessed for security compliance. Automated fixes are applied based on these assessments, and real-time threat intelligence helps detect and respond to new vulnerabilities. The system visualizes benchmarking results and security insights on the dashboard, improving security posture and ensuring compliance with industry standards. Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 358 https://internationalpubls.com 4. RESULTS AND DISCUSSION The Continuous Improvement Loop is then implemented, during which network traffic and system logs are continuously monitored. Security events are analyzed in real time and correlated with historical data and predefined security policies. Feedback from stakeholders is solicited to gain insights into the effectiveness of the Continuous Improvement Loop, and the results of the experimentation are thoroughly documented. These findings are compiled into a comprehensive report that highlights the efficiency and effectiveness of the Continuous Improvement Loop in enhancing the security posture within the organization’s cloud environment. The report also includes recommendations for further refinement and areas for future research. The outcomes of classified events detected by the Suricata Intrusion Detection System (IDS) are displayed in Figure 2. This figure illustrates how Suricata thoroughly analyzes network traffic and system logs. Figure 3 showcases Suricata’s classification of analyzed content and presents event alerts within the Kibana dashboard of the ELK stack. Figure 2. Results of classified events flagged by Suricata. Figure 3. Suricata Event Alerts These real-time alerts indicate security incidents detected by Suricata. Each alert contains detailed information, such as the threat type, impacted entity, source and destination IPs, and a timestamp accurate to milliseconds. Moreover, alerts are color-coded to indicate severity levels, allowing security personnel to quickly prioritize and address critical issues. This visualization enables real-time traffic Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 359 https://internationalpubls.com monitoring and situation assessment, ensuring the security status remains intact. When an incident occurs, the response team can swiftly act to minimize potential damage. Additionally, the integration of Suricata with the ELK stack has strengthened the organization’s 24/7 security monitoring capabilities. The system continuously tracks alerts, analyzes log data, and identifies areas for improvement. By learning from these logs, security measures can be refined, maintaining optimal protection over time. 5. CASE STUDIES: DEMONSTRATING THE EFFECTIVENESS OF CLOUD GUARDIAN The following case studies illustrate how Cloud Guardian has successfully managed security across multi-cloud and container platforms, providing organizations with a robust solution for enhancing their security posture, automating policy enforcement, and mitigating vulnerabilities in real time. Case Study 1: Financial Institution – Managing Security in a Multi-Cloud Environment A major financial institution with operations across multiple countries adopted a multi-cloud strategy, using AWS for application development, Azure for data analytics, and GCP for machine learning workloads. As the institution grew, the complexity of managing security across multiple platforms became a challenge. The organization needed a unified security solution that could ensure continuous compliance, real-time threat detection, and automated remediation across its diverse cloud environments. Challenges • Inconsistent Security Policies: Each cloud platform had different security configurations, which led to inconsistencies in IAM permissions, network configurations, and data protection practices. • Manual Vulnerability Management: The institution’s security team struggled to manually track and patch vulnerabilities across AWS, Azure, and GCP environments, leading to delays in remediation. • Compliance Requirements: As a financial institution, they needed to comply with stringent regulations, including PCI-DSS and GDPR. Ensuring compliance across three cloud platforms was time-consuming and prone to errors. Cloud Guardian Solution • Multi-Cloud Integration: Cloud Guardian seamlessly integrated with AWS, Azure, and GCP via their APIs, providing a single pane of glass for monitoring security configurations, access control policies, and data protection measures. • Automated Policy Enforcement: Using CIS benchmarks and custom compliance policies, Cloud Guardian automatically enforced consistent security policies across all three cloud platforms. This ensured that configurations met the institution’s internal security standards. • Automated Vulnerability Management: Cloud Guardian’s real-time threat intelligence detected vulnerabilities across all platforms, and its automated remediation engine applied patches to virtual machines, databases, and container images without manual intervention. • Compliance Monitoring and Reporting: Cloud Guardian continuously monitored for compliance with PCI-DSS and GDPR, providing the institution with real-time compliance reports and recommendations for improving their security posture. Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 360 https://internationalpubls.com Results: • 95% Reduction in Manual Security Tasks: Cloud Guardian’s automated security assessment and policy enforcement significantly reduced the need for manual security checks, allowing the institution’s security team to focus on higher-priority tasks. • Improved Compliance: The institution achieved continuous compliance with PCI-DSS and GDPR, passing regulatory audits without any significant security findings. • Faster Vulnerability Remediation: With Cloud Guardian’s automated fixes, the institution reduced its vulnerability remediation time by 80%, minimizing the window of exposure for potential exploits. Case Study 2: E-Commerce Company – Securing Containers in a Hybrid Cloud Environment Background An e-commerce company running a hybrid cloud environment with on-premise Kubernetes clusters and cloud-based containers in AWS and Azure faced challenges in managing container security across its platforms. The company’s developers used Docker and Kubernetes extensively to deploy microservices, leading to concerns over misconfigurations, unpatched container images, and inconsistent security policies. Challenges • Container Security Risks: The company experienced multiple security incidents caused by vulnerable Docker images and misconfigured Kubernetes clusters, which exposed sensitive customer data. • Lack of Visibility Across Platforms: The security team lacked visibility into container security across both on-premise Kubernetes clusters and cloud-based containers, leading to difficulties in identifying and responding to vulnerabilities. • Manual Remediation: The company’s security team manually monitored and patched vulnerabilities in containers, resulting in significant delays between vulnerability detection and resolution. Cloud Guardian Solution • Container Security Integration: Cloud Guardian integrated with the company’s on-premise Kubernetes clusters and cloud-based Docker containers via the Kubernetes API and Docker’s container management tools, providing a unified view of container security across all platforms. • Automated Container Scanning: Cloud Guardian’s automated container vulnerability scanning identified outdated Docker images and insecure container configurations in both Kubernetes and cloud environments. • Self-Healing Incident Response: Using automated remediation playbooks, Cloud Guardian fixed misconfigurations in real-time, such as removing unnecessary container privileges and patching vulnerable software. The platform also applied rollback capabilities to quickly revert any changes that disrupted the production environment. • CIS Kubernetes Benchmarking: Cloud Guardian applied the CIS Kubernetes benchmark to the company’s on-premise clusters and cloud environments, enforcing security best practices for pod security, RBAC policies, and network configurations. Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 361 https://internationalpubls.com Results: • Complete Visibility: Cloud Guardian provided the company with complete visibility into container security across on-premise and cloud environments, enabling faster detection and remediation of security issues. • 85% Reduction in Security Incidents: By automating container scanning and remediation, the company experienced an 85% reduction in security incidents caused by misconfigured or vulnerable containers. • Compliance with Industry Standards: Cloud Guardian’s CIS Kubernetes benchmarking ensured that the company’s container environments adhered to industry standards, improving overall security and reducing risk. 6. CONCLUSION As multi-cloud environments and containerized applications become increasingly prevalent, managing security across these platforms has grown into a significant challenge for organizations. Traditional security methods are no longer sufficient to address the complexity and dynamic nature of modern cloud infrastructures. In response, this research introduced Cloud Guardian, a comprehensive Cloud Security Posture Management (CSPM) platform designed to automate security assessments, enforce policies, and detect threats across multi-cloud and containerized environments. The results of the study, demonstrated through real-time analysis and event detection via Suricata, emphasize the effectiveness of Cloud Guardian in addressing key security challenges, such as misconfigurations, unpatched vulnerabilities, and inconsistent security policies. By integrating advanced features like real-time threat intelligence, automated remediation, and self-healing mechanisms, Cloud Guardian significantly enhances the security posture of cloud infrastructures. The platform not only ensures compliance with industry standards like CIS and NIST but also minimizes manual intervention by automating routine tasks and providing continuous security monitoring. The continuous improvement loop, supported by automated feedback and analysis, showcased Cloud Guardian’s capacity to evolve with emerging threats, contributing to a more secure and resilient operational environment. Furthermore, the integration of Suricata within the ELK stack for intrusion detection and log analysis provides a robust framework for real-time threat detection and proactive incident response. References [1]. Kewate, N., Raut, A., Dubekar, M., Raut, Y., & Patil, A. (2022). A review on AWS-cloud computing technology. International Journal for Research in Applied Science and Engineering Technology, 10(1), 258-263. [2]. Copeland, M., Soh, J., Puca, A., Manning, M., Gollob, D., Copeland, M. & Gollob, D. (2015). Microsoft azure and cloud computing. Microsoft Azure: Planning, Deploying, and Managing Your Data center in the Cloud, 3-26. [3]. Bisong, E., & Bisong, E. (2019). An overview of google cloud platform services. Building Machine learning and deep learning models on google cloud platform: a comprehensive guide for beginners, 7-10. [4]. Pachala, S., Rupa, C., & Sumalatha, L. (2021). An improved security and privacy management system for data in multi-cloud environments using a hybrid approach. Evolutionary Intelligence, 14, 1117-1133. [5]. Alshammari, M. M., Alwan, A. A., Nordin, A., & Al-Shaikhli, I. F. (2017, November). Disaster recovery in single- cloud and multi-cloud environments: Issues and challenges. In 2017 4th IEEE international conference on engineering technologies and applied sciences (ICETAS) (pp. 1-7). IEEE. [6]. Bentaleb, O., Belloum, A. S., Sebaa, A., & El-Maouhab, A. (2022). Containerization technologies: Taxonomies, applications and challenges. The Journal of Supercomputing, 78(1), 1144-1181. [7]. Riungu-Kalliosaari, L., Mäkinen, S., Lwakatare, L. E., Tiihonen, J., & Männistö, T. (2016). DevOps adoption benefits and challenges in practice: A case study. In Product-Focused Software Process Improvement: 17th International Conference, PROFES 2016, Trondheim, Norway, November 22-24, 2016, Proceedings 17 (pp. 590-597). Springer International Publishing. [8]. Tsai, W. T., & Shao, Q. (2011, March). Role-based access-control using reference ontology in clouds. In 2011 Tenth International Symposium on Autonomous Decentralized Systems (pp. 121-128). IEEE. Communications on Applied Nonlinear Analysis ISSN: 1074-133X Vol 32 No. 3 (2025) 362 https://internationalpubls.com [9]. Fernandes, D. A., Soares, L. F., Gomes, J. V., Freire, M. M., & Inácio, P. R. (2014). Security issues in cloud environments: a survey. International journal of information security, 13, 113-170. [10]. Mishra, S., Tripathy, N., Mishra, B. K., & Mahanty, C. (2019). Analysis of security issues in cloud environment. Security designs for the cloud, Iot, and social networking, 19-41. [11]. Alotaibi, A. F., AlZain, M. A., Masud, M., & Jhanjhi, N. Z. (2021). Performance Evaluation and Analysis of CSPM: a Secure cloud Computing Model. Turkish Online Journal of Qualitative Inquiry, 12(5). [12]. Korzilius, S. P., Schilders, W. H., & Anthonissen, M. J. (2016). An improved CSPM approach for accurate second- derivative approximations with SPH. Journal of Applied Mathematics and Physics, 5(1), 168-184. [13]. Diogenes, Y. (2017). Embracing Cloud Computing to Enhance Your Overall Security Posture. ISSA Journal, 15(5). [14]. Diogenes, Y. (2017). Embracing Cloud Computing to Enhance Your Overall Security Posture. ISSA Journal, 15(5). [15]. Wijenayake, D. S., Henna, S., & Farrelly, W. (2023, December). A Graph Neural Network-based Security Posture- aware Cloud Service Provider Selection for Multi-cloud. In 2023 31st Irish Conference on Artificial Intelligence and Cognitive Science (AICS) (pp. 1-6). IEEE. [16]. Bulut, M. F., & Hwang, J. (2021, September). Nl2vul: Natural language to standard vulnerability score for cloud security posture management. In 2021 IEEE 14th International Conference on Cloud Computing (CLOUD) (pp. 566- 571). IEEE. [17]. Coppola, G., Varde, A. S., & Shang, J. (2023, October). Enhancing Cloud Security Posture for Ubiquitous Data Access with a Cybersecurity Framework Based Management Tool. In 2023 IEEE 14th Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON) (pp. 0590-0594). IEEE. [18]. Williams, G. P. (2012). Cost effective assessment of the infrastructure security posture. [19]. Bar-Haim, R., Eden, L., Kantor, Y., Agarwal, V., Devereux, M., Gupta, N., ... & Zan, M. (2023, January). Towards Automated Assessment of Organizational Cybersecurity Posture in Cloud. In Proceedings of the 6th Joint International Conference on Data Science & Management of Data (10th ACM IKDD CODS and 28th COMAD) (pp. 167-175). [20]. An, S., Leung, A., Hong, J. B., Eom, T., & Park, J. S. (2022). Toward automated security analysis and enforcement for cloud computing using graphical models for security. IEEE Access, 10, 75117-75134.