# Identity Security

> CIEM and identity security posture management on one graph: every person, service account and key that can reach prod. Connect Okta and AWS in minutes.

Canonical HTML page: https://www.subimage.io/product/ciem

---

Who can change this service?

Cloud infrastructure entitlement management (CIEM) and identity security posture management (ISPM) on one live graph. Subimage resolves effective access for every person and non-human identity, from Okta, Entra or Google Workspace through AWS, GCP and Azure IAM, and shows the path behind every answer.

Demo video: The users list shows one person tied to every account they hold, instead of a separate row for each login. You add that person to the graph explorer, where their access is drawn as a graph, and talk to the agent about whether someone who is only a reader in one system can still become an admin through another path.

## One person. Every account.

Subimage ties one person to their Okta login, Entra account, GitHub handle, IAM user, Slack member and Jamf laptop, with title and manager from Workday. Ask what a contractor can reach and get one answer for the person, not six for the accounts.

## Every hop, from IdP to resource

CIEM tools tell you what a role can do. Subimage shows who can become that role and what they reach next.

- Okta group → AWS Identity Center permission set → IAM role → prod S3 bucket
- Entra group → AWS Identity Center → AdministratorAccess in the payments account
- GitHub repo → Actions OIDC trust → IAM role that deploys to prod

## Non-human identities don't get a pass

Non-human identity management on the same graph as your people. IAM roles, GCP service accounts, Entra service principals, Kubernetes service accounts and API keys get the same effective-access math, plus the workload that runs as each one and the team that owns it.

- Lambda functions and EC2 instances whose roles can create IAM users or rewrite policies, ranked higher when they face the internet
- API keys with their last use and expiry, Databricks tokens that never expire and AWS keys not rotated in 90 days

## Who can make themselves admin

- AWS, GCP, Azure and Scaleway principals that can create identities, write policies or hand out roles
- Principals that can rewrite a role's trust policy to let another account in
- GCP principals that can impersonate any service account or mint long-lived keys for one

## The access nobody took back

- Accounts that don't map to any person
- AWS access keys unused for 45 days or more

## Works with the identity stack you run, whatever it is

Okta, Entra, Google Workspace, JumpCloud, Duo, Keycloak, WorkOS and LastPass on the identity side. AWS, GCP, Azure and Scaleway IAM, GitHub, GitLab, Kubernetes, Snowflake and Databricks on the resource side. Workday and Jamf fill in the person and the laptop.

- Running something we don't cover yet? We add new integrations fast.
- Bring your own data with Declarative Schema: an in-house IdP, an HR export or a homegrown permissions table maps into the same graph as everything else.

## Bring the access review you dread.

Connect your identity provider and cloud accounts read-only. The first sync maps every person, every service account and every path to prod.

[Book a demo](https://cal.com/team/subimage/chat-with-subimage)