Three identity systems
The IdP, cloud IAM and Kubernetes service accounts each have their own view and none of them link.
Identity is an entity,
not a report.
Who can assume which role, which role can reach which data store, and which exposed workload authenticates as that identity — as edges you can walk, not as a quarterly access review.
9
Identity entity types
HumanIdentity · WorkloadIdentity · CloudPrincipal · IdentityGroup · IAMRole · AccessPolicy · AccessEntitlement · Credential · Secret.
5
Identity connectors
Okta, Entra ID, Google Workspace, CyberArk, SCIM.
3
Cloud IAM sources
AWS, Azure, GCP principals and policies.
MFA
Enforced for admins
Plus SSO and SCIM for the platform itself.
The problem
Identity sprawl breaks everything else.
01
02
Standing access
Roles granted for an incident in 2024 are still assumable.
03
Secrets in history
A credential committed and rotated is still a credential in git history.
04
Reviews without context
Access reviews show the grant, not what the grant can reach.
05
Workload identity ignored
The exposed service that authenticates as an over-privileged role is the path, and no identity tool sees the service.
06
Privileged accounts elsewhere
PAM context lives in a vault product that never meets the finding.
How SecurityVault does it
Edges from identity to data.
Ingest
Okta, Entra ID and Google Workspace supply humans and groups; cloud collectors supply principals, roles and policies; the cluster sensor supplies workload identities; CyberArk supplies privileged-account context.
Model
member_of, assumes, can_access, authenticates_as and stores edges connect identities to roles, roles to data stores, workloads to identities.Path
Attack paths traverse those edges from an exposure to a data asset; chokepoints identify the one role whose removal breaks the most paths.
Secrets
The native secrets kernel walks git history with provider fingerprints and entropy fallback; verification is off by default and reports truncate to the last four characters.
Govern
Exceptions with owners, expiry and dual control; findings on entitlements route to the owning team like any other finding.
Platform
The platform itself: OIDC/SAML SSO, SCIM provisioning, MFA, RS256 sessions of fifteen minutes, RBAC as the only access authority.
What it rests on
The platform underneath.
Ontology
Identity entities
Nine types, versioned vocabulary.
CIEM
Cloud entitlements
Principals, roles and policies across three clouds.
Secrets
Native kernel
Fingerprints, entropy, history walker.
Attack paths
Chokepoints
Which grant to remove first.
Connectors
IdP and PAM
Okta, Entra, Google, CyberArk, SCIM.
Audit
Signed and chained
Every governance action recorded.
See it on your stack
Bring one cloud account and your IdP.
We show the role that reaches the most data and the exposed workload that can assume it.