7 Common requirements in this category

Technical buyers typically look for: 1. Coverage and integrations Connectors into major cloud providers, SaaS applications, identity providers, directories, HR systems, and ticketing tools. 2. Entitlement discovery and modelling Normalisation of IAM policies, groups, and roles into a consistent model; detection of excessive and unused permissions; visibility into machine identities and service accounts. 3. Access reviews and certifications Campaigns scoped by application, team, or manager, with bulk decisions, recommendations for approve or remove, and strong evidence trails. 4. Policy and segregation of duties (SoD) management Definition and detection of SoD conflicts, toxic role combinations, and policy violations across applications and clouds. 5. Lifecycle and workflow automation Integration with HR and identity providers for joiner, mover, and leaver flows; automated provisioning, deprovisioning, and role changes via APIs or orchestration. 6. Risk scoring and prioritisation Contextual risk models that combine entitlement criticality, data sensitivity, usage, and identity risk to highlight what to fix first. 7. Auditability and reporting Clear reports for internal audit, regulators, and customers showing who approved which access, when, and on what basis. With Cybermatch, Cloud Identity Governance tools are compared against these criteria so security teams can see which platforms map cleanly to their identity stack, risk model, and compliance obligations before committing to a PoC.

All categories

CIG

Cloud Identity Governance (CIG)

Cloud Identity Governance platforms provide security and identity teams with a unified, continuous view of who has access to what across cloud providers, SaaS applications, and identity stores, and whether that access is appropriate. Instead of spreadsheet-driven access reviews and one-off IAM audits, CIG tools continuously ingest entitlements, groups, and roles to surface toxic combinations, privilege creep, and access that no longer matches a user’s role. Traditional IGA was built around on-prem directories and a small set of core apps. Cloud Identity Governance extends that model to multi-cloud and SaaS environments where access is spread across IAM roles, SaaS tenants, and ephemeral resources. Legacy IGA platforms remain strong at workflow (joiner/mover/leaver, approvals, attestations) but often struggle with cloud entitlements such as thousands of granular permissions, Kubernetes roles, and SaaS-specific privilege models. CIG platforms specialise in discovering and normalising these entitlements, analysing risk, and feeding decisions back into IGA or ITSM for approvals and lifecycle.

List your CIG product Read research

Vendor shortlist

11 listed

Apono
Apono provides cloud identity governance with automated provisioning, access reviews, and JIT access. It discovers human and machine identities, right‑sizes privileges, enforces least privilege, and produces audit‑ready evidence across cloud and SaaS.
Not provided
Automated provisioning and deprovisioningAccess reviews and certification workflowsJust-in-time and just-enough accessZero standing privilege enforcementSegregation of duties and policy rules+4 more
View details →
Visit
Britive
Britive provides cloud identity governance with automated provisioning, access reviews, and JIT access. It discovers human and machine identities, right‑sizes privileges, enforces least privilege, and produces audit‑ready evidence across cloud and SaaS.
Not provided
Automated provisioning and deprovisioningAccess reviews and certification workflowsJust-in-time and just-enough accessZero standing privilege enforcementSegregation of duties and policy rules+4 more
ComplianceSOC 2 Type IIISO 27001HIPAAPCI DSSGDPR
View details →
Visit
Clutch Security
NHI‑centric identity governance. Discovers service accounts, tokens, and AI agents; automates lifecycle and reviews; detects stale or over‑privileged NHIs; and enforces least privilege and compliance from creation to decommissioning.
Not provided
Discovery and ownership correlation for NHIsLifecycle management with policy engineDetection of stale/orphaned/over‑privileged NHIsAccess reviews and compliance supportPosture and risk management for machine access+3 more
View details →
Visit
ConductorOne
ConductorOne provides cloud identity governance with automated provisioning, access reviews, and JIT access. It discovers human and machine identities, right‑sizes privileges, enforces least privilege, and produces audit‑ready evidence across cloud and SaaS.
Not provided
Automated provisioning and deprovisioningAccess reviews and certification workflowsJust-in-time and just-enough accessZero standing privilege enforcementSegregation of duties and policy rules+4 more
ComplianceSOC 2 Type II
View details →
Visit
Opal
Opal provides cloud identity governance with automated provisioning, access reviews, and JIT access. It discovers human and machine identities, right‑sizes privileges, enforces least privilege, and produces audit‑ready evidence across cloud and SaaS.
Not provided
Automated provisioning and deprovisioningAccess reviews and certification workflowsJust-in-time and just-enough accessZero standing privilege enforcementSegregation of duties and policy rules+4 more
ComplianceSOC 2
View details →
Visit
Saviynt
Converged cloud IGA with strong machine identity governance. Provides unified visibility of keys, certs, bots, and service accounts; automates lifecycle, reviews, and revocation; and applies risk‑based controls and SoD to enforce least privilege across cloud and SaaS.
Not provided
Unified visibility of machine identitiesLifecycle automation (issue, renew, revoke)Risk‑based access and certificationsSoD enforcement and audit reportingOwner assignment and succession policies+3 more
ComplianceSOC 2 Type IIISO 27001ISO 27017FedRAMPPCI DSS
View details →
Visit
SecurEnds
SecurEnds provides cloud identity governance with automated provisioning, access reviews, and JIT access. It discovers human and machine identities, right‑sizes privileges, enforces least privilege, and produces audit‑ready evidence across cloud and SaaS.
Not provided
Automated provisioning and deprovisioningAccess reviews and certification workflowsJust-in-time and just-enough accessZero standing privilege enforcementSegregation of duties and policy rules+4 more
View details →
Visit
StrongDM
StrongDM provides cloud identity governance with automated provisioning, access reviews, and JIT access. It discovers human and machine identities, right‑sizes privileges, enforces least privilege, and produces audit‑ready evidence across cloud and SaaS.
Not provided
Automated provisioning and deprovisioningAccess reviews and certification workflowsJust-in-time and just-enough accessZero standing privilege enforcementSegregation of duties and policy rules+4 more
ComplianceSOC 2
View details →
Visit
Teleport
Teleport provides cloud identity governance with automated provisioning, access reviews, and JIT access. It discovers human and machine identities, right‑sizes privileges, enforces least privilege, and produces audit‑ready evidence across cloud and SaaS.
Not provided
Automated provisioning and deprovisioningAccess reviews and certification workflowsJust-in-time and just-enough accessZero standing privilege enforcementSegregation of duties and policy rules+4 more
ComplianceSOC 2 Type IIISO 27001HIPAA
View details →
Visit
Veza
Veza provides cloud identity governance with automated provisioning, access reviews, and JIT access. It discovers human and machine identities, right‑sizes privileges, enforces least privilege, and produces audit‑ready evidence across cloud and SaaS.
Not provided
Automated provisioning and deprovisioningAccess reviews and certification workflowsJust-in-time and just-enough accessZero standing privilege enforcementSegregation of duties and policy rules+4 more
ComplianceSOC 2 Type II
View details →
Visit
Zluri
Zluri provides cloud identity governance with automated provisioning, access reviews, and JIT access. It discovers human and machine identities, right‑sizes privileges, enforces least privilege, and produces audit‑ready evidence across cloud and SaaS.
Not provided
Automated provisioning and deprovisioningAccess reviews and certification workflowsJust-in-time and just-enough accessZero standing privilege enforcementSegregation of duties and policy rules+4 more
View details →
Visit