Well it depends on what you mean by "real" :) I'd say CSPM (like many security tools) can help if used well, but it's quite common to see it used as a blunt ins

Well it depends on what you mean by "real" :) I'd say CSPM (like many security tools) can help if used well, but it's quite common to see it used as a blunt instrument, which does not help. CSPM helps to apply sets of security rules across cloud resources, with the rules usually being based on external standards or custom rules per organization. It suffers from the downsides of any rules based check system which is that it can be quite inflexible and noisy. Like many security systems it needs to be tuned to the specific environment its running in to be really useful. What can complicate things is compliance requirements from external or internal bodies that require 100% pass rates or similar. That kind of inflexible approach often just causes needless work and people focusing on the wrong areas to achieve that externally imposed requirement.