The "Snapshot" Magic
Agentless scanning leverages a capability that every major cloud provider offers: disk snapshots. A snapshot is a point-in-time copy of a virtual disk, created at the storage layer — completely independent of the running operating system.
Here is the exact workflow:
- Connect: The CSPM tool is granted a read-only IAM role in your cloud account. It never needs SSH access or OS credentials.
- Discover: It calls the cloud API to enumerate every asset — VMs, containers, serverless functions, databases, storage buckets, IAM roles.
- Snapshot: For each VM, it requests a disk snapshot via the cloud API (e.g.,
aws ec2 create-snapshot). This operation happens entirely at the storage layer. The running VM does not pause, restart, or experience any performance impact. - Mount: The CSPM mounts this snapshot as a read-only disk on its own isolated scanning infrastructure — in the same cloud region to avoid data egress costs.
- Analyze: It scours the disk image looking for:
- Vulnerabilities (CVEs): Installed package versions compared against the National Vulnerability Database.
- Secrets: Hardcoded AWS keys, API tokens, or passwords in config files,
.envfiles, or source code. - Malware: Known malicious file hashes.
- Misconfigurations: Dangerous settings in
/etc/ssh/sshd_config, world-writable directories, etc. - Discard: The snapshot is deleted immediately after scanning. The CSPM never retains a copy of your data.
The result: 100% asset coverage with zero performance impact. Even if a VM is stopped, broken, or has a crashed OS, the scanner can still read its disk.