You’re correct on both points (🤦‍♂️ indeed).

I’ve now edited this post to link to their advisory text file instead of their advertising-heavy blog post about it which I had initially linked when the above comment was posted. Thanks.

I thought it may be CAM but nope, they really went for it https://www.qualys.com/fundamentals/cyber-security-asset-management

It’s not unique to them either, I heard that term before but never spelled out

2. They have a product called Cybersecurity Asset Management that these absolute geniuses named CSAM.

I noticed that, too. Like, maybe they named it before that particular acronym became infamous, but rebranding is a thing companies do all the time. They are making the choice to keep that one.