CIEM
Cloud infrastructure entitlement management, or CIEM, is the analysis of who and what can do what in a cloud estate: resolving granted permissions into effective permissions, and comparing those with the permissions actually used. It is the identity side of cloud security posture, and in most estates it is where the exploitable risk sits.
The problem it solves is that nobody can read a cloud permission model by eye. Rights arrive from several layers at once, they are qualified by conditions, and they compose in ways that produce access nobody granted deliberately: an identity permitted to modify a policy or to assume a role effectively holds every permission reachable from there. Answering what an identity can do therefore requires evaluating the graph, not reading the policy attached to it.
The second half is usage. Comparing effective permissions against what an identity has actually invoked over a period turns least privilege from an instruction into a specific list of rights that can be removed with evidence, which is the only version of that conversation that survives contact with an engineering team.
Most of the value lands on identities that are not people. A pipeline credential or a workload role has a narrow, stable job, so the gap between granted and used is wide and safe to close, which makes non-human identity the natural first target. What we do on an engagement is the same enumeration from the attacker’s side: take the identity we have obtained and establish what it can reach, including through role assumption. That path is usually shorter than the client expects, and mapping it is part of the cloud testing where we enumerate what an identity can really reach.