Mondoo CSPM

Cloud Security Posture Management Software

Free planAPILinuxmacOSWebWindows

7.4#3 of 34Freefree plan

Overview

Mondoo CSPM is ranked #3 of 34 in cloud security posture management software on Specifiction. It runs on API, Linux, macOS, Web, Windows. There is a free plan.

Mondoo CSPM plans and pricing

All plans

Open Source Tools Free Free forever · Cloud, Kubernetes, OS, SaaS, and API scanning · Kubernetes operator · extensible provider system · asset inventory · open-source policies · base vulnerability management mondoo.com · 29 Sept 2026

Managed Service Not published Custom pricing · tailored to infrastructure size and needs · includes risk-based vulnerability management, security posture management, automated remediation, compliance and evidence collection, and expert support mondoo.com · 29 Sept 2026

Compared on cloud security posture management software

Free plan: Yesmondoo.com
Multi-cloud support: Yesmondoo.com
Cloud asset inventory: Yesmondoo.com
Compliance frameworks: SOC 2, PCI DSS, HIPAA, ISO 27001, GDPR, CIS Benchmarks, NIS2mondoo.com
IaC scanning: Yesmondoo.com
Identity risk analysis: Yesmondoo.com
Attack path analysis: Yesmondoo.com
Automated remediation: Yesmondoo.com

Facts

CSPM purpose: Mondoo CSPM continuously scans cloud environments, prioritizes misconfigurations by exploitability and business exposure, and delivers fixes as reviewable code changes and pull requests.mondoo.com · 29 Sept 2026
Cloud coverage: CSPM covers AWS, Azure, and Google Cloud in one posture and remediation workflow.mondoo.com · 29 Sept 2026
Verification: Mondoo rechecks fixes and records evidence to keep posture and compliance information current.mondoo.com · 29 Sept 2026
Human approval: The CSPM page says users review and approve every agent-generated fix.mondoo.com · 29 Sept 2026
Compliance: The CSPM page lists CIS Benchmarks, PCI DSS, HIPAA, GDPR, SOC 2, ISO 27001, and NIS2 posture mappings.mondoo.com · 29 Sept 2026
Policy as code: Security and compliance rules can be version controlled and audited as policy code, then enforced across accounts and clouds.mondoo.com · 29 Sept 2026
Integrations: Mondoo lists 106 integrations, including AWS, Azure, Google Cloud, Kubernetes, Terraform, and GitHub Actions.mondoo.com · 29 Sept 2026
Third-party findings: The integrations page says Mondoo can import vulnerability or security findings from tools including Qualys, CrowdStrike Falcon, and Snyk.mondoo.com · 29 Sept 2026
Security certifications: Mondoo identifies SOC 2 Type II and ISO 27001 among its security and compliance credentials.mondoo.com · 29 Sept 2026
Open-source tools: Mondoo says its core tools, cnquery and cnspec, are open source and used by thousands of organizations.mondoo.com · 29 Sept 2026
Support offering: The Managed Service plan includes an expert Mondoo Vulnerability Management Success Manager.mondoo.com · 29 Sept 2026
Company history: Mondoo says it was founded in 2020 by DevOps and security experts who previously created Chef InSpec and DevSec.io and contributed to OpenStack.mondoo.com · 29 Sept 2026