Cloud permissions grow faster than anyone can review them
A cloud estate accumulates permissions the way a codebase accumulates dependencies. Every deadline adds a few, and nobody removes any. A role gets full admin because the sprint ends on Friday. A service account keeps write access to a database it stopped using last year. Multiply that across three providers and thousands of human and machine identities, and the review spreadsheet stops being a control. It becomes a false sense of security.
The risk is rarely one permission. It is the unnoticed chain. A runtime account can act as a role, and that role can reach the data it was never meant to touch.
CIEM right-sizes every identity's permissions
Cloud infrastructure entitlement management (CIEM) is a cloud security discipline that discovers, analyses and right-sizes the permissions every human and machine identity holds across cloud environments. Classic identity and access management decides who may sign in. CIEM examines what each identity can reach once inside, and whether it should.
CIEM turns cloud IAM into a readable graph
one.O Guard builds up an IAM (Identity and Access Management) graph over the identities and IAM bindings from your cloud providers. The graph connects users, service accounts, roles and resources into one connected picture, and stays current with continuous background sync plus a daily reconciliation against actual cloud state. The same graph carries your data assets, which is where DSPM comes in.
DSPM watches where your data goes
one.O Guard's data security posture management (DSPM) works from the access graph. It ingests your data stores, analyses every access path to them, flags public exposure and out-of-region storage, and detects transfer jobs that move data outside your organisation. Priority follows the data-criticality labels you already maintain, so what counts as critical stays your call.
It never inspects the data itself, so nothing sensitive is read in order to protect it. Who holds a path to your critical data, and through which route?
A central platform with six domains
CIEM and DSPM are two of one.O Guard's six domains, alongside CSPM, CWPP, ASPM and AI-SPM. No agent for cloud, code or endpoint scanning.
The four IAM security risks the graph reveals
Foreign principals
Identities from outside your organisation that can access your resources. The graph flags each foreign principal, so you can confirm the access is intended, or revoke it.
Toxic permission combinations
Single findings can seem harmless. one.O Guard combines multiple low-risk pieces of information into a potential higher-risk issue using its policy database. A modest permission and a reachable service look minor on their own. When combined, they open a path, and that combination reaches your team as one prioritised issue instead of three alerts everyone learns to ignore.
Overprivileged principals
The analysis flags principals whose permissions reach far beyond what their workload needs, including inactive principals still holding high privileges.
Indirect and impersonated access
The graph also resolves indirect, transitive and impersonated IAM relationships, the chains where one identity acts as another and inherits its reach, the raw material of privilege escalation.
Access analysis states what each asset allows
Pick any asset and the access analysis answers in one generated plain-language sentence, counting its entitlements and highlighting those with privileged admin permissions. Every underlying relationship is listed in full, and the question works in both directions, from who can act on this asset to what the asset can act on elsewhere.
Reading an attack path before an attacker walks it
An identity finding rarely stands alone. one.O Guard joins identity issues with misconfigurations, exposed secrets and public access into a path an attacker could walk. A permission problem on a path to business-critical data outranks a hundred isolated findings.
Start at the entry point
A path begins at an exposed asset or identity, often an internet-facing endpoint or a leaked key.
Follow the permission edges
Each hop is a grant between an identity and a service, including routes to higher privilege or sideways movement.
Read the destination
The asset the chain endangers decides how much it matters, and what to fix first.
Cloud data security starts on the identity graph
Knowing which stores exist, and who has a route to them, is the half of cloud data security this page owns. Buckets, databases and datasets enter the shared asset inventory, and access analysis answers exactly that question. Publicly accessible data is flagged through the platform's data security controls, and code scanning catches secrets in your repositories and their commit history.
FAQs about CIEM & DSPM
CIEM manages cloud permissions; SIEM (Security Information and Event Management) collects and analyses security events. A SIEM tells you what happened across your systems. CIEM tells you what could happen because of who holds which access. Teams running both use the SIEM for detection and CIEM to shrink what an attacker could abuse.
Security Graph Policies evaluate permissions in combination rather than one at a time, correlating asset context and relationships across the graph. You feel it in triage. Your team reads a short list of combined issues, each carrying its route and severity, no more burning hours on low-severity findings that only add up together.
By pulling the identities and their permissions from your cloud providers into one analysis and flagging overprivileged principals wherever they sit, down to each IAM binding on GCP. Least privilege stops being a per-console project. The over-grants come back in one place, ready to fix, which is what makes the principle enforceable at cloud scale.
Foreign principals matter because nobody inside your review cycle owns them. They are identities from another organisation with access to your cloud resources: a vendor's service account, a partner integration, a leftover consultant role. Each one is listed with its exact reach.
Both frameworks expect you to demonstrate control over who can access systems and data, not just a policy document saying so. Entitlement evidence from the IAM graph lays out granted access, privileged rights and the approval trail, backed by dedicated Entitlements and IAM security control groups, and it stays under EU sovereignty. The policy set references ISO 27001, CIS, NIST and PCI DSS, and the platform's own compliance framework model names GDPR among the external standards it maps to.
IAM comes built into every cloud, so it is not something you pick. CIEM is the analysis that runs on top. one.O Guard looks at what IAM has already granted and points out where that creates risk, from quiet over-permissions to escalation routes. Your IAM setup stays as it is.
Yes, in two ways. Data exposure is covered today: every store enters the asset inventory, access analysis shows which identities can open them, and public exposure is flagged. Deeper discovery and classification is DSPM's job. If classification is your priority, raise it in the demo and we will scope it with you.
Ready to see what data and identity in your cloud can actually reach?
We're happy to help with your questions and requirements. Book your personal consultation now, or send us a message.
