CIEM
Cloud Infrastructure Entitlement Management. Tools that discover and right-size identities and permissions across AWS, Azure, and GCP, reducing excessive and unused entitlements. Focuses on effective permissions, the access an identity can actually use.
CIEM exists because cloud IAM policies are effectively unreadable at scale: permissions come from identity policies, resource policies, permission boundaries, service control policies, and role chains, and the effective answer is a computation rather than a lookup. The value is showing what an identity can actually do versus what it has used, which is what makes right-sizing possible. Most findings are unused permissions on service principals rather than over-privileged humans.
See also: what is CIEM, least privilege, entitlement, CIEM vendors
Related on Start with Identity
- GlossaryRole Mining
Analyzing existing access to discover sensible roles, reducing role explosion and cleaning up entitlements. A common step in rolling out or fixing RBAC. Role mi
- GlossaryAccess Certification
Periodic review of who has access to what, with managers or resource owners attesting that access is still appropriate. A regulatory requirement in many industr
- GlossaryIAM
Identity and Access Management. Workforce identity for employees, contractors, and partners. Covers authentication, authorization, lifecycle, and audit. Distinc
- BlogServiceNow closes its Veza acquisition at about 1.2 billion dollars
Announced in December 2025 and closed on 2 March 2026, substantially in cash. Veza, valued at 808 million dollars in its Series D, now supplies the permission g
- RankingBest CIEM for Enterprises: Top 4 Cloud Entitlement Platforms
The best enterprise CIEM platforms in 2026: Wiz, Sonrai Security, Britive, and Microsoft Entra Permissions Management. Ranked for multi-cloud discovery, least p
- RankingBest CIEM for Multi-Cloud: Top 5 Entitlement Platforms
The best multi-cloud CIEM platforms in 2026: Wiz, Tenable Cloud Security, Prisma Cloud, Orca Security, and Sonrai Security. Ranked for cross-cloud discovery, le