For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

Cloud Security Posture Management (CSPM) evaluates your environment using standard rules and workload rules. Understanding how workloads are defined and billed helps you manage your plan and coverage.

What Is a Workload

In CSPM, a workload is a supported resource that runs applications, stores active data, or represents compute or database infrastructure. CSPM supports the following workloads:

• Droplets
• Managed Database instances

Workloads are evaluated using workload rules, which provide deeper, resource-specific security analysis.

Standard Resources vs. Workloads

CSPM evaluates two categories of resources. Standard resources include IAM configurations, Volumes, load balancers, firewalls, VPCs, and DigitalOcean Container Registry (DOCR) repositories. These are evaluated using standard rules and are included in all plans.

Workloads include Droplets and managed databases. These are evaluated using workload rules and are included only in paid plans.

How Billing Works

CSPM uses a workload-based pricing model. Each supported workload with coverage enabled is billed individually on a monthly basis. Each Droplet counts as one workload, and each managed database cluster counts as one workload. Standard resources are not billed.

You must explicitly enable coverage for each workload you want CSPM to evaluate. Only workloads with coverage enabled are evaluated and billed. Workloads without coverage are not evaluated and are not billed.

For current details about CSPM pricing and what is included in each plan, see CSPM Pricing.

Example

If your account contains 5 Droplets and 2 managed database clusters, and you enable coverage for 3 Droplets and 1 managed database, you are billed for 4 workloads. The remaining workloads are not evaluated and are not billed. Standard resources such as firewalls, VPCs, and IAM configurations are always included and are not counted toward workload billing.