How can I evaluate the security posture of each cloud provider effectively?