Is CSPM real, or is this just some BS that sounds good to middle management and ticks of some 'security'-checkboxes?
CSPM helps to apply sets of security rules across cloud resources, with the rules usually being based on external standards or custom rules per organization.
It suffers from the downsides of any rules based check system which is that it can be quite inflexible and noisy. Like many security systems it needs to be tuned to the specific environment its running in to be really useful.
What can complicate things is compliance requirements from external or internal bodies that require 100% pass rates or similar. That kind of inflexible approach often just causes needless work and people focusing on the wrong areas to achieve that externally imposed requirement.
I can now say "I know for a fact we have x number of AWS/GCP/Azure accounts that are either not using our IdP or 2A, here's a list" without having to script across multiple cloud APIs
Similarly, I can say "here's a list of people that accessed x resource in the last y days". It really makes my life easier when I want to access metrics about my company's cloud environments
Or is it that it lets you answer arbitrary questions of this sort without having to figure out how to get that data?
If you think about the number of services that AWS/GCP/Azure have, adding good compliance checks across even a portion of those is quite a lot of work :)
A small example from an area I know something about is maintaining the CIS Kubernetes benchmarks (which are used by a lot of CSPM products as a source of rules).
Here you've got the different Kubernetes distributions and then each of the cloud distributions has its own CIS benchmark as the checks are different depending on the cloud in use. Then you have changes over time as different clusters run different versions of Kubernetes, so have different checks. Then you add in that the benchmarks don't release with every new version of Kubernetes, and you can end up with quite a complex matrix of checks.
Consider an enterprise that wants to say "list all the cloud storage buckets we own that are not in the US and are publicly readable and have a name containing 'foo'" - and they have several of each of AWS, Azure and GCP organixations because of acquisitions that aren't fully integrated yet.
Wiz answers that in ~5 seconds, with a rich query language and a bunch of prebuilt rules and detections on top of it, including for tracking compliance with various frameworks.