Use Case — Multi-Cloud
Policy drift caught before your next compliance audit.
When the same workload runs in AWS, Azure, and GCP, maintaining consistent policy enforcement across all three control planes requires deliberate design — not hoping the clouds agree.
How Drift Detection Works
Same intent. Three control planes. One baseline.
The same control intent — "deny unencrypted storage" — is expressed differently across clouds: as an SCP condition in AWS, a Policy Initiative in Azure, and an Org Policy constraint in GCP. Native Security normalizes these into a unified policy baseline and detects when any cloud drifts from it.
- Scans run every 4 hours against all connected cloud orgs
- Drift alerts sent via Slack, PagerDuty, or email
- Baseline versioned — compare current state to any past snapshot
- Drill down to the specific account, subscription, or project
drift-report • 4h scan
2 drifts found
| Cloud | Control | Baseline | Current |
|---|---|---|---|
| AWS | DenyPublicS3 | ATTACHED | ATTACHED |
| Azure | DenyHTTPAccess | FULL | PARTIAL |
| Azure | RequireTLS | ASSIGNED | MISSING |
| GCP | storage.uniform | ENFORCED | ENFORCED |
Set a baseline. Know when it changes.
Connect AWS, Azure, and GCP. Native Security normalizes the control intent across all three and alerts you — not your auditor — when anything drifts.