Three identity systems
The IdP, cloud IAM and Kubernetes service accounts each have their own view. Reviewing them separately can hide relationships between people, workloads and resources.
See who can access what.
Then see the risk.
Connect cloud identities, permissions and resources with cloud infrastructure entitlement management (CIEM). Investigate excessive privilege in the context of your environment.
Entities
Identity types
Human and workload identities, cloud principals, groups, roles, policies, entitlements, credentials and secrets.
IdP · PAM
Identity connectors
Okta, Entra ID, Google Workspace, CyberArk, outbound SCIM.
AWS · Azure · GCP
Cloud IAM sources
Principals, roles and policies.
Paths
Identity to data
Chokepoints show which grant to remove first.
The problem
Why does identity sprawl undermine cloud security?
Identity decides what an attacker can reach after the first foothold. Yet it is usually reviewed as a list of grants, in a separate tool, a quarter at a time.
01
02
Standing access
Roles granted for one incident are still assumable a year later.
03
Secrets in history
Removing a credential from the latest commit leaves its old value in git history. Rotation or revocation is needed to invalidate that exposed value.
04
Reviews without context
Access reviews show the grant, not what the grant can reach.
05
Workload identity overlooked
The exposed service that authenticates as an over-privileged role is the path, and no identity tool sees the service.
06
Privileged accounts elsewhere
Privileged-access context lives in a vault product that never meets the finding.
How SecurityVault does it
How does SecurityVault connect identity to data?
Identities, roles and data stores become entities on one graph that already runs from code to image to cloud workload, so an over-broad role is ranked by what it exposes.
Ingest
Okta, Entra ID and Google Workspace supply people and groups; cloud collectors supply principals, roles and policies; the cluster sensor supplies workload identities; CyberArk supplies privileged-account context.
Model
Edges for membership, role assumption, access, authentication and storage connect identities to roles, roles to data stores and workloads to identities.
Path
Attack paths traverse those edges from an exposure to a data asset. A vulnerable image and the workload identity it authenticates as share the same graph, so a code finding and an over-broad role are one path, not two dashboards. Chokepoints identify the role whose removal breaks the most paths.
Secrets
Secrets detection walks git history with provider fingerprints and entropy checks, and reports show only a masked suffix of each credential.
Govern
Exceptions carry an owner, an expiry and optional dual control; findings on entitlements route to the owning team like any other finding.
Platform
The platform itself uses OIDC and SAML single sign-on, MFA, short-lived signed sessions and role-based access control as the only access authority.
Outcomes
What changes for identity and cloud teams?
01
Least privilege by impact
Remove the grant that breaks the most paths to sensitive data first.
02
Reviews with reach
Review grants with the resource and workload context available from connected sources.
03
One path, one owner
Code, image, workload and role findings on the same path route to one team.
04
Secrets closed out
A leaked credential is tracked from discovery to rotation.
05
Exceptions that expire
Accepted access risk has an owner and an end date.
06
A record for auditors
Review governance actions in a hash-chained audit log and verify signed control decisions.
FAQ
CIEM questions
- What is CIEM?
- Cloud infrastructure entitlement management (CIEM) inventories the human and machine identities in your clouds, the roles they can assume and the permissions those roles grant, then flags excess or risky access. SecurityVault models every grant as a graph edge, so access is judged by what it can reach. See what is CIEM.
- Which identity sources does SecurityVault connect to?
- Okta, Microsoft Entra ID and Google Workspace for people and groups; AWS, Azure and GCP for cloud principals, roles and policies; the cluster sensor for Kubernetes workload identities; and CyberArk for privileged-account context.
- How is this different from an access review?
- An access review shows a grant. SecurityVault shows what the grant reaches: which data stores a role can access, which exposed workloads authenticate as it and which code findings sit on those workloads. Reviewers decide with the path in front of them.
- Does SecurityVault cover workload and service-account identities?
- Yes. Workload identities from your clusters sit on the same graph as cloud roles, so an exposed service that authenticates as an over-privileged role appears as one attack path, not two unrelated findings.
- How do our people sign in to SecurityVault?
- Through OIDC or SAML single sign-on with your identity provider, with MFA and short-lived signed sessions. Role-based access control is the only access authority, and outbound SCIM sync pushes identity data to downstream SCIM consumers.
Related: cloud security posture management (CSPM) · secrets detection · Kubernetes security (KSPM) · identity attack paths from assumable role to data store · SecurityVault for security engineering · SecurityVault for CISOs.
From the blog
Further reading on CIEM
- Cloud permission changes: prove access was reducedVerify cloud permission reductions with scoped access tests, session checks and fresh evidence, so an approved change becomes a defensible closure.
- Cloud access review: verify unused permissionsReview unused cloud permissions using ownership, observation scope and tests, without confusing missing activity with proof of unnecessary access.
- What is CIEM? Cloud infrastructure entitlement managementWhat is CIEM? How cloud infrastructure entitlement management finds excess permissions across human and machine identities, and how it differs from IAM.
- Excess privilege in the cloud: model it as graph edgesFind excess cloud privilege by modelling identities, roles and trust policies as graph edges you can walk, rank and cut, not rows in an access review.
See it on your stack
Bring one cloud account and your IdP.
We show the role that reaches the most data and the exposed workload that can assume it.