What Is CIEM (Cloud Infrastructure Entitlement Management)?

CIEM (Cloud Infrastructure Entitlement Management) is the practice and tooling that discovers every identity in AWS, Azure and Google Cloud, computes what each one can actually do, and removes the permissions it does not use. In the cloud, permissions sprawl fast, and most identities, human and machine, end up with far more access than they use. CIEM is how you find that gap and close it.

The problem CIEM solves

Cloud IAM systems are powerful and complex. Roles, policies and inherited permissions combine into effective permissions that are hard to see. CIEM computes what an identity can actually do, then flags excessive, unused and risky access. See the CIEM glossary entry for the short definition.

Core capabilities

• Discovery of every human and non-human identity and its permissions, including federated users arriving from your identity provider.
• Effective-permission analysis across tangled policies and roles.
• Right-sizing toward least privilege, usually by generating a smaller policy from observed usage.
• Risk detection for cross-account access, privilege escalation paths and toxic combinations.
• Just-in-time access in some products, so elevated rights exist only for an approved window (JIT access, zero standing privileges).

Why cloud permissions are unreadable

The reason CIEM exists as a category is that a cloud permission is a computation rather than a lookup. In AWS alone the policy evaluation logic combines identity policies, resource policies, permission boundaries, service control policies, session policies and role chaining. Ask a competent engineer what a specific service principal can actually do across your accounts and, without tooling, they cannot tell you.

That is the test for whether you need CIEM. If nobody can answer that question, and nobody has removed an unused permission this quarter, the problem is real.

CIEM vs CSPM vs IGA vs PAM

IGA governs access broadly. PAM controls privileged sessions. CSPM finds resource misconfigurations. CIEM is specifically about cloud identities and entitlements, and it increasingly ships inside cloud security platforms (CNAPP) rather than as a standalone product.

Most findings are not humans

The instinct is to look for over-privileged administrators. In practice the bulk of findings are non-human: service principals created for a project that ended, roles with wildcard actions granted during a deadline, and CI identities with permissions far beyond the one deploy they perform.

Failure modes CIEM is meant to catch

• Over-privileged service principals. In June 2026 the operator Microsoft tracks as JadePuffer used two compromised service principals in one Azure tenant to request storage account keys and delete most targeted storage accounts within seven minutes. The blast radius was set by what those principals were allowed to do.
• Application secrets that sign in as apps. In November 2026 Todyl reported an actor signing in to Entra ID as applications with stolen client secrets, reaching 27 organizations and requesting Key Vault and Storage tokens. Unused app permissions are exactly what CIEM is built to remove (static API key abuse).
• Over-scoped storage tokens. A Microsoft AI research repository exposed an Azure SAS token that granted full control of a storage account, not just the models it was meant to share (secrets in repositories).
• Insiders with standing cloud admin. In the Ubiquiti case a developer used his own AWS and GitHub admin access to steal data. Standing privilege with no time bound is the root problem; JIT is the fix.

Turning findings into an outcome

A raw findings list from a large tenant is unusable, so the programme matters more than the scan:

1. Start with unused permissions on non-human identities, which are the safest to remove and the largest in number.
2. Use usage data as the evidence. "This role has not used these 40 actions in 90 days" is an argument an owner will accept; "this role is over-privileged" is not. (The 90-day window is a common practitioner convention, not a standard; pick one and apply it consistently.)
3. Right-size with a rollback path, because the fear of breaking production is what stops removal.
4. Move the reducible remainder to just-in-time access rather than trying to perfect standing permissions.

Measure the count of identities holding unused high-risk permissions over time. If that number is not falling, the tool is producing reports rather than outcomes.

Native tools first

Before buying, check what your cloud already gives you. AWS IAM Access Analyzer has unused access analyzers that flag unused roles, access keys and passwords, and unused services and actions on active roles; it can also generate a policy from CloudTrail activity. AWS bills unused access analysis per IAM role and user analyzed per month. In Microsoft's case, the dedicated product is gone: Entra Permissions Management reached end of support on 1 November 2025, with permissions discovery and the Permission Creep Index carried into Defender for Cloud's Defender CSPM plan and Delinea named as migration partner.

The CIEM market in 2026

Ownership moved this year, and it matters for roadmaps and renewals:

• Wiz became part of Google Cloud when Google completed its 32 billion dollar acquisition on 11 March 2026. Wiz says its products continue to work across AWS, Azure, Google Cloud and Oracle Cloud.
• Palo Alto Networks renamed Prisma Cloud as Cortex Cloud, with CIEM as one module beside posture and runtime security.
• Tenable sells its Ermetic-based CIEM as Tenable One Cloud Exposure, including a documented just-in-time access workflow.
• Veza, an effective-permissions graph often evaluated against CIEM, was acquired by ServiceNow (closed 2 March 2026).

Pricing is mostly hidden. In SWI's Identity Pricing Transparency Index 2026, CIEM scores 28 out of 100 and six of nine vendors are quote-only. The exceptions, checked on 5 November 2026: Sonrai Security lists a 15,000 dollar a year Startup tier and 150 dollars per cloud account per month for 10 to 50 accounts; Uptycs starts at 3 dollars per workload per month with a 12,000 dollar yearly minimum; and Britive shows 12-month packages from 70,000 dollars only on AWS Marketplace.

CIEM shortlist by situation

For the ranked view, see best CIEM for enterprises and best CIEM for multi-cloud, the top CIEM platforms and open-source CIEM tools. Compare Wiz vs Sonrai, Wiz vs Orca and Britive vs Sonrai, or browse all CIEM vendors.