CIEM: Cloud Infrastructure Entitlement Management
What CIEM detects
| Class | Example findings |
|---|---|
| Over-privileged users | A user with AdministratorAccess who only ever called s3:GetObject |
| Dormant identities | Service account that hasn't been used in 90 days but holds write permissions |
| Wildcard actions | A custom policy with Action: "*" |
| Wildcard resources | A policy with Resource: "*" on sensitive services |
| MFA gaps | Console-enabled users with MFA disabled |
| Cross-cloud escalation | The same email is admin in AWS and GCP, pivot path |
| Trust path expansion | A role trusted by another role trusted by an external account |
| Permission drift | Granted permission set differs from the one in IaC |
What CIEM measures
The signature CIEM metric is unused permissions. For every identity, Ctadel:
- Lists every action the identity could take (effective permissions, computed across all attached policies).
- Lists every action the identity did take in the last 90 days (from audit logs).
- Reports the difference: actions granted but never used = candidates for removal.
This is what makes least-privilege actionable instead of aspirational. The gap between "granted" and "used" is usually 80–95% in real environments.
Cross-cloud correlation
The Identity tab has a Cross-Cloud sub-page that surfaces identities that exist in multiple clouds. Common matches:
- Same email across AWS IAM, GCP IAM, Azure AD.
- Same SSO subject linked to native cloud accounts in two providers.
- Service accounts with the same key fingerprint.
This is how a single compromised email escalates from one cloud to another. Ctadel finds those bridges so you can break them or harden them with conditional access.
Identities in the security graph
Every user, service account, role, and group is a node. Edges represent:
MEMBER_OF→ user → groupASSUMES→ role → roleCAN_PERFORM→ identity → action classOWNS→ identity → resource
That graph is what makes toxic combinations like "App user → assumes prod-deploy role → can write to billing bucket" detectable.
What's next
- The Identity module
- CDR, runtime sibling
- Toxic combinations