1. Discover

You can't expand what you can't see. Before adding new preventive controls, you need comprehensive visibility into what prevention already exists across your cloud estate. Most organizations have more prevention than expected—just scattered and invisible across repositories, accounts, and tools.

Discovery creates a unified view of preventive controls across all four layers (Build, Access, Config, Runtime), revealing where coverage exists, where gaps create risk, and what opportunities exist for systematic expansion.

Start here: Build visibility

1. Inventory your prevention tools List every tool that provides preventive controls: IaC scanners, organizat

2. Analyze

Not all prevention opportunities are created equal. Some controls eliminate thousands of findings with minimal effort. Others require months of coordination for limited impact. Analysis transforms discovery data into actionable prevention priorities by identifying which gaps create the most risk and which opportunities deliver maximum value.

Effective analysis connects preventive controls (from Discovery) with detection findings (from your CNAPP or CSPM), revealing which issues appear repeatedly despite being preventable, where prevention coverage gaps create persistent risk, and which new controls would reduce findings most dramatically.

Start here: Prioritize b

3. Simulate

Hope is not a deployment strategy. Simulation tests preventive controls against real cloud activity before enforcement, answering critical questions: What would this control block? Which teams would be affected? What legitimate workflows would break? What exceptions are needed?

Simulation transforms prevention from guesswork into data-driven deployment. The core concept: analyze cloud audit logs to identify actions that would have been blocked if the preventive control existed, revealing impact without risk.

Start here: Test before enforcing

1. Define testable controls Start with specific, measurable control definitions that translate to observable clo

4. Deploy

Deployment done poorly breaks production and creates resistance. Deployment done well is gradual, monitored, and reversible. This is where prevention becomes real: policies block risky actions, secure defaults protect resources automatically, and guardrails prevent misconfigurations at scale.

Effective deployment balances two objectives: moving fast enough to reduce risk, while moving carefully enough to avoid disruption. Start with monitoring that observes without blocking, deploy to test environments before production, roll out to accounts and teams in phases, and track exceptions systematically with approval workflows and expiration.

Start here: Deploy graduall

5. Measure

Without measurement, prevention remains an article of faith. Measurement quantifies prevention effectiveness, answering critical questions: Is prevention reducing risk? How much alert volume has been eliminated? What's the ROI of prevention investments? Where should we expand coverage next?

With measurement, prevention becomes demonstrable and improvable. Security teams prove risk reduction through metrics. Executives see ROI justifying continued investment. Organizations optimize prevention strategies based on what works.

Start here: Establish baselines and instrument controls

1. Capture baseline metrics Before prevention expansion, document the starti

Key Takeaways

• The five practices define how we systematically expand prevention coverage: Discover existing controls, Analyze gaps and opportunities, Simulate impact before enforcement, Deploy gradually and safely, and Measure effectiveness to guide iteration.
• Prevention succeeds through systematic execution rather than ad-hoc controls. Organizations that follow these practices build comprehensive coverage that dramatically reduces risk, eliminates alert overload, and frees capacity for strategic work.
• The practices work iteratively. Organizations cycle through Discover-Analyze-Simulate-Deploy-Measure repeatedly, expanding prevention coverage systematical

What's Next

These five practices form the how behind prevention-first security: the systematic methods for expanding prevention coverage safely and effectively across your cloud estate.

For a complete overview of the prevention-first framework, see Prevention 101.

To understand the other components:

• The Prevention-First Manifesto: Core values and principles
• Why We Prevent: The six benefits of prevention
• What We Prevent: The four layers of preventive controls
• **[What is PSPM?](/pr