Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Adopting Cloud Infrastructure Entitlement Management
Transcript
- Lucas: If you look at the average mid-size company running on three cloud providers, the number of active permissions is somewhere north of half a million. Not roles — individual permissions tied to users, services, and resources. And no single person knows what most of them actually do. Luna: Half a million permissions — that's a staggering surface area. And the problem is that over time, people just accumulate access like digital hoarders. Lucas: Exactly. And that's the problem Cloud Infrastructure Entitlement Management — CIEM for short — is designed to solve. It's a category that emerged maybe three or four years ago, but it's really hitting its stride now as cloud environments get more complex and regulators start asking harder questions about who has access to what. Luna: So CIEM — pronounce it 'see-em' — is essentially a tool that discovers all the permissions across your cloud accounts, maps them to identities, and then flags or even automatically removes excess privileges. Am I getting that right? Lucas: That's the core. It's identity and access management, but built for the scale and dynamism of cloud. Traditional IAM tools were designed for on-prem Active Directory — static users, static groups, static roles. In the cloud, you have ephemeral compute instances, serverless functions, service accounts that spin up and down. Permissions change by the minute. Luna: And the risk is plain — the 2025 breach at a large financial services firm, I think it was a top-ten bank, that started because a service account in AWS had full admin privileges for a project that was supposed to be read-only. Lucas: Right. That incident is a textbook CIEM case. The account was created for a proof of concept, the team forgot about it, and three years later it still had AdministratorAccess attached. The attacker found it through a leaked key in a public GitHub repo — classic — and then had unfettered access to the company's S3 buckets holding customer data. Luna: The breach cost them an estimated $80 million in fines, legal fees, and remediation. And a CIEM tool would have flagged that account within hours of provisioning because the policy attached was way outside its usage pattern. Lucas: It would have. And that's why the market is growing fast. Gartner projected that by the end of this year, 60 percent of enterprises with multi-cloud strategies will have adopted a dedicated CIEM tool, up from maybe 20 percent in 2023. Luna: Who are the key players here? I know Microsoft has Entra Permissions Management, and Palo Alto Networks acquired a CIEM startup a while back and folded it into Prisma Cloud. Lucas: Yeah, Microsoft's offering — formerly CloudKnox — is probably the most widely deployed because it sits on top of Azure, but it also covers AWS and Google Cloud. Palo Alto's Prisma Cloud has a CIEM module that integrates with their CSPM and CWPP, so for existing Palo customers, it's an easy add. Then there are pure-play startups like Ermetic, which was acquired by Tenable, and Sonrai Security, which focuses heavily on the identity graph approach. Luna: And there's an interesting tension here. Developers want broad permissions to move fast, and security teams want to lock things down. CIEM tools have to strike that balance or they get ignored. Lucas: That's the adoption challenge. If you automatically revoke a permission a developer was using in production, you break the build, and the tool gets uninstalled. So good CIEM tools use a 'monitor first, then suggest' approach. They start in read-only mode, generate a permission usage analysis, and then work with the team to create a least-privilege policy that still lets people do their jobs. Luna: And that's exactly the kind of nuanced work that we try to bring to this show every week — because it's not just about the technology, it's about how you actually get organizations to adopt it. If you find these conversations useful for what you're building or running, there's a way to support us that keeps the show ad-free and independent. Lucas: Yeah, listeners like you have asked how they can help, and the simplest way is buying us a coffee. It's at buy me a coffee dot com slash fexingo — all one word, lowercase. Even a one-time contribution helps us keep researching topics like CIEM and interviewing the people building these tools. Luna: So if you've gotten value from the show, that's the place. Now, back to CIEM — one of the interesting sub-concepts within it is something called 'zero standing privileges' or ZSP. Lucas, can you explain that? Lucas: Sure. Zero standing privileges means that no identity has permanent access to anything. Instead, users or services request permissions just-in-time — the CIEM tool grants them for a specific window, then automatically revokes them. It's like having a security guard who checks your badge every time you enter a room, even if you've been there a hundred times before. Luna: That's a huge shift from the traditional model where you get a role and keep it forever. And it maps well to compliance frameworks like SOC 2 and PCI DSS, which increasingly require periodic access reviews. Lucas: Absolutely. But implementing ZSP at scale requires a mature CIEM deployment. You need to understand every permission's usage pattern, and you need a way for developers to request elevated privileges without friction. That's where integrations with ticketing systems like Jira or ServiceNow come in. Luna: So CIEM isn't just a tool — it's a process change. And that's often the harder part. Lucas: The technology is the easy part. The hard part is convincing the VP of Engineering that this isn't going to slow down releases. The best way is to show data from the pilot — for example, 'We identified and removed 15,000 unused permissions, and zero incidents were caused by the removals.' Once you have that story, adoption becomes smoother. Luna: I've also seen that some CIEM tools now use machine learning to model normal behavior and detect anomalous permission usage. That seems to add a layer of predictive security. Lucas: It does. For instance, if a service account that usually only reads data from one S3 bucket suddenly gets an IAM policy to write to DynamoDB, the CIEM can flag that in real time. That's the kind of alert that could stop a breach before data exfiltration happens. Luna: So it's moving from 'show me what's wrong' to 'prevent what could go wrong.' Lucas: Exactly. And that's where CIEM overlaps with other categories. It's not a standalone product for most enterprises — it integrates with Cloud Security Posture Management, or CSPM, which looks at misconfigurations, and Cloud Workload Protection Platforms, or CWPP, which protects instances. Together, they form what some call a 'cloud-native application protection platform' — CNAPP. Luna: And I imagine the consolidation is already happening. Vendors want to sell the whole stack. Lucas: That's the trend. Microsoft, Palo Alto, and even upstarts like Wiz are all building CIEM capabilities into their broader platforms. The question for buyers is whether they want best of breed CIEM or a bundled solution. For large enterprises, bundled often wins because of fewer vendors to manage. But smaller teams might go with a dedicated tool that's simpler. Luna: Any notable open-source options? Lucas: There's a project called CloudTracker from the security team at Netflix, but it's more of a permission visualization tool than a full CIEM. It doesn't enforce policies. For actual enforcement, commercial tools still dominate. Luna: Let's talk about the regulatory angle. We're seeing more mandates around access control, like the latest guidance from the SEC on cyber risk management. Does CIEM help with compliance? Lucas: Absolutely. The SEC's 2024 rules require companies to document their risk management processes, including access controls. A CIEM tool can automatically generate reports showing who has access to what, which permissions are active, and which ones were removed. That's exactly what auditors want to see. It turns a manual quarterly review into an automated, continuous process. Luna: And with the rise of AI and machine learning workloads in the cloud — those often require huge amounts of data access. Are we seeing permissions issues there specifically? Lucas: Yes. AI pipelines often need broad read access to training data lakes, and sometimes the data scientists inadvertently grant write access. I've seen cases where a data scientist created a SageMaker notebook with full S3 access to the company's entire data lake, not just the training set. CIEM can detect that and flag it as an entitlement creep. Luna: Entitlement creep — that's the slow accumulation of permissions as people change roles or add new services. It's like the cloud version of 'scope creep' in project management. Lucas: Exactly. And the only way to manage it is continuous monitoring. One of the metrics I track is the 'permission to user ratio' — if it's growing faster than headcount, something's wrong. CIEM tools make that metric visible. Luna: So for a CISO listening, what's the first step in getting started with CIEM? Lucas: First, get an inventory of all your cloud accounts and the permissions currently in use. Many companies are surprised to find they have dozens of 'orphan' accounts — no one on the team even knows they exist. Second, run a pilot on one cloud provider with a small set of identities. Use the CIEM in read-only mode for a month to understand usage patterns. Then, based on that data, create a least-privilege policy and enable enforcement gradually. And third, involve the engineering team from day one. Make them part of the process, not the target. Luna: That echoes what we've heard about any successful security tool adoption — it's as much about culture as it is about technology. Lucas: It really is. CIEM done well gives developers guardrails, not handcuffs. They can get the access they need, but only when they need it, and only for as long as necessary. That's a win for both speed and security. Luna: And a win for the bottom line, too — fewer breaches, less audit pain, and a cleaner cloud environment. Lucas: Exactly. And with cloud spending only going up, getting permissions right is one of the highest-leverage security investments you can make.