Mondoo CSPM

Spec sheet

What it does

Mondoo CSPM continuously scans AWS, Azure, Google Cloud, Kubernetes and infrastructure-as-code for misconfigurations, exposed data, weak identity controls and compliance gaps.Read 14 Oct 2026 · mondoo.com

API

Mondoo exposes a GraphQL API authenticated with scoped bearer API tokens, service accounts or workload identity federation.Read 14 Oct 2026 · mondoo.com

Integrations

Mondoo lists 118 integrations, including AWS, Azure, Google Cloud, Kubernetes, Terraform, GitHub Actions, Qualys, CrowdStrike, Snyk, Jira and ServiceNow.Read 14 Oct 2026 · mondoo.com

Compliance

The CSPM page lists CIS Benchmarks, PCI DSS, HIPAA, GDPR, SOC 2, ISO 27001, and NIS2 posture mappings.Read 29 Sep 2026 · mondoo.com

License

The cnspec GitHub repository identifies its license as Business Source License 1.1 (BUSL 1.1).Read 14 Oct 2026 · github.com

Headquarters

Berlin, GermanyRead 23 Sep 2026 · mondoo.com

Founded

2020Read 23 Sep 2026 · mondoo.com

AI prioritization

Mondoo scores findings by exploitability and business exposure instead of relying only on raw severity.Read 14 Oct 2026 · mondoo.com

Closed-loop remediation

The CSPM workflow detects findings, scores them, generates reviewable code changes or pull requests, and rechecks fixes as evidence.Read 14 Oct 2026 · mondoo.com

Cloud coverage

CSPM covers AWS, Azure, and Google Cloud in one posture and remediation workflow.Read 29 Sep 2026 · mondoo.com

Company founding

Mondoo says it was founded in 2020 by DevOps and security experts formerly associated with Chef InSpec, DevSec.io and OpenStack.Read 14 Oct 2026 · mondoo.com

Company history

Mondoo says it was founded in 2020 by DevOps and security experts who previously created Chef InSpec and DevSec.io and contributed to OpenStack.Read 29 Sep 2026 · mondoo.com

Company legal name

Crunchbase identifies the legal name as Mondoo, Inc.Read 14 Oct 2026 · crunchbase.com

Continuous compliance

The CSPM maps posture to CIS Benchmarks, PCI DSS, HIPAA, GDPR, SOC 2, ISO 27001 and NIS2.Read 14 Oct 2026 · mondoo.com

CSPM purpose

Mondoo CSPM continuously scans cloud environments, prioritizes misconfigurations by exploitability and business exposure, and delivers fixes as reviewable code changes and pull requests.Read 29 Sep 2026 · mondoo.com

Deployment options

cnspec can be installed with scripts, package managers, MSI or standalone binaries and can scan remote targets without installing software on the target.Read 14 Oct 2026 · mondoo.com

Developer tooling

Mondoo provides the cnspec CLI, cnquery, MQL and an xgrep code scanner, plus a Visual Studio Code security extension.Read 14 Oct 2026 · mondoo.com

Documentation depth

Documentation includes platform quickstarts, installation, provider management, MQL resource references, compliance, reporting, access control, API tokens and audit logs.Read 14 Oct 2026 · mondoo.com

Funding

Mondoo announced $15 million raised from Atomico, First Minute Capital and System.One in October 2021.Read 14 Oct 2026 · mondoo.com

Headquarters and size

LinkedIn lists San Francisco, California headquarters and 51–200 employees.Read 14 Oct 2026 · linkedin.com

Human approval

The CSPM page says users review and approve every agent-generated fix.Read 29 Sep 2026 · mondoo.com

Identity and data exposure

Policies identify over-permissive IAM, public data stores, missing encryption and internet-exposed services.Read 14 Oct 2026 · mondoo.com

Independent certification

CIS lists Mondoo products certified against numerous CIS benchmarks for AWS, Azure, Google Cloud, Kubernetes, operating systems and other technologies.Read 14 Oct 2026 · cisecurity.org

Limit: custom pricing

Toolradar and Mondoo list enterprise or managed-service pricing as custom, so buyers cannot calculate a public price from the site.Read 14 Oct 2026 · toolradar.com

Limit: Splunk dependency

The Splunk app supplies dashboards only and cannot collect Mondoo data without the separate Technology Add-on.Read 14 Oct 2026 · splunkbase.splunk.com

Network requirement

Installation and reporting require outbound HTTPS access on port 443 to Mondoo install, release, API and registry endpoints and synchronized time.Read 14 Oct 2026 · mondoo.com

Notable 2026 release

Mondoo announced its new app reached general availability in July 2026, replacing the legacy console, alongside a new MCP server and hundreds of security checks.Read 14 Oct 2026 · mondoo.com

Open-source tools

Mondoo says its core tools, cnquery and cnspec, are open source and used by thousands of organizations.Read 29 Sep 2026 · mondoo.com

Policy as code

Security and compliance rules are version-controlled policies that can be enforced across accounts and clouds.Read 14 Oct 2026 · mondoo.com

Praise: automation and breadth

Toolradar credits Mondoo with unified coverage across cloud, on-premises, SaaS, endpoints, network devices and the SDLC, plus automated fixes and compliance evidence.Read 14 Oct 2026 · toolradar.com

Praise: remediation guidance

FeaturedCustomers testimonials say Mondoo saves research and Ansible coding time per vulnerability and helps meet PCI DSS requirements.Read 14 Oct 2026 · featuredcustomers.com

Praise: unified visibility

FeaturedCustomers customer comments praise seeing vulnerability data and queries in one platform for faster decisions.Read 14 Oct 2026 · featuredcustomers.com

Rating on FeaturedCustomers

4.8 out of 5.0 from 268 reference ratings.Read 14 Oct 2026 · featuredcustomers.com

Rating on Indeed

5.0 out of 5 from 1 review.Read 14 Oct 2026 · indeed.com

Rating on Splunkbase

0 out of 5 from 0 ratings.Read 14 Oct 2026 · splunkbase.splunk.com

Risk model

Findings receive a 0–100 score adjusted for attack surface, blast radius, business priority, exploitability and news signals.Read 14 Oct 2026 · mondoo.com

SDK and extensibility

The cnspec provider system loads plugins for different platforms, and custom policies can be authored in MQL YAML.Read 14 Oct 2026 · github.com

Security benchmarks

Mondoo advertises more than 400 policies, over 10,000 individual checks and support for more than 70 platforms.Read 14 Oct 2026 · mondoo.com

Security certifications

The company site lists SOC 2 Type II, ISO 27001, CIS SecureSuite and GDPR credentials.Read 14 Oct 2026 · mondoo.com

Splunk integration

Splunkbase lists a Mondoo app with six dashboards, saved searches and macros; it requires the Mondoo Technology Add-on for data collection and is Apache-2.0 licensed.Read 14 Oct 2026 · splunkbase.splunk.com

Support offering

The Managed Service plan includes an expert Mondoo Vulnerability Management Success Manager.Read 29 Sep 2026 · mondoo.com

System requirements

cnspec is a static binary supporting Windows 10/11 and Server 2016–2025, Linux and macOS on documented CPU architectures; Windows needs PowerShell 5.1 or later.Read 14 Oct 2026 · mondoo.com

Third-party findings

The integrations page says Mondoo can import vulnerability or security findings from tools including Qualys, CrowdStrike Falcon, and Snyk.Read 29 Sep 2026 · mondoo.com

Verification

Mondoo rechecks fixes and records evidence to keep posture and compliance information current.Read 29 Sep 2026 · mondoo.com

Plans and prices

Every Mondoo CSPM plan and price →

Where Specifiction places it

• Cloud Security Posture Management Software#2 of 418.6
• Exposure Management Software#2 of 208.8
• Container Image Scanning Tools#3 of 298.6
• Security Configuration Management Software#5 of 298.6
• Cloud Vulnerability Scanners#5 of 288.6