Stream Security

Overview

Stream Security (legal entity StreamSec Ltd., formerly Lightlytics; lightlytics.com now redirects to stream.security) sells real-time cloud detection and response (CDR). Its core idea is a live model of production, branded CloudTwin, that tracks configuration, identity, and network state as it changes rather than in periodic scans. As of November 2026 the Stream site repositions the product as an "AI-First platform" with autonomous prevention, detection, threat hunting, and remediation, and renames the model "ProductionTwin." Identity and entitlement analysis is one input to that model, not a standalone CIEM suite.

What it is good at

Showing the effect of a change before or as it happens. Because the twin holds identity and network relationships together, Stream can answer "how far could this compromised role or workload reach?" at the moment a policy or security group changes. Its October 2025 post on identity and network segmentation describes blast-radius visibility for compromised identities and compares each identity or network change against the segmentation logic you define. Stream's published IAM rules flag the usual high-risk grants on IAM users (AdministratorAccess or PowerUserAccess, wildcards in actions or resources, iam:* or iam:PassRole) and recommend roles with temporary credentials over long-lived users.

The site lists AWS, Google Cloud, Azure, OCI, and Kubernetes, plus identity provider integrations with Okta, Microsoft Entra ID, PingOne from Ping Identity, and Auth0, so events can be tied back to the human who started them. For cloud operations teams that care most about drift and live exposure, that is a sharper tool than a nightly posture report.

Where it falls short

It is not an entitlement governance product. The site does not describe usage-based policy right-sizing, just-in-time access, or access reviews, so teams whose problem is standing privilege at scale will need something else. The rapid repositioning toward autonomous AI response also means feature names and packaging are moving; validate what is generally available in a proof of concept. Stream is a younger, smaller vendor than the large CNAPP platforms, and our confidence remains low because most capability detail is marketing material rather than public technical documentation.

Pricing

Quote-based. As of 2026-11-05 Stream publishes no price list (stream.security/pricing returns a 404) and directs buyers to a demo.

Best for, and who should look elsewhere

Choose Stream if your cloud team needs to see in real time how identity and network changes alter exposure, and wants detection and response tied to that context. For deep least-privilege remediation and JIT, look at Sonrai Security or Britive. For a broad, established CNAPP with a CIEM module, compare Wiz, Orca Security, or Sysdig. The CIEM primer and best CIEM for enterprises ranking frame the trade-offs.

Bottom line

Stream Security is a real-time cloud detection platform that treats identity change as live risk. It is worth a look for cloud operations teams; it does not replace an entitlement governance tool.