CIEM vs IAM Security: what's actually the difference?

Two acronyms, one confused market

Vendors — us included — throw "IAM Security" and "CIEM" around interchangeably. In practice they answer different questions, and mature security programs run both.

IAM Security answers: is this identity configured safely?

IAM Security is about the static shape of your identity plane:

• Are there IAM users with console access and no MFA?
• Are access keys older than 90 days?
• Are there inline policies with Action: "*" and Resource: "*"?
• Are service accounts stored in plaintext anywhere in your repos?

It's essentially a posture check against identity best practices. Every CSPM does some of this. Good ones do a lot of it.

CIEM answers: what could this identity actually do?

CIEM starts where IAM Security stops. It reconciles who has which entitlements, what those entitlements evaluate to given every trust policy, permission boundary, and SCP in the chain, and — most importantly — what was actually used in the last 90 days.

The output isn't "this user has AdministratorAccess." Every scanner will tell you that. The output is:

• user@example.com has effective s3:PutObject on 412 buckets across 3 accounts, but has only ever written to 4 of them.
• OnamReadOnly in account ****4821 is assumable by 17 principals in 6 other accounts through a chain of two roles.
• The service account acme-corp-ci has never used 91% of its granted permissions since it was created.

That third bullet is where CIEM stops being interesting and starts being urgent. Unused entitlements are the single largest source of over-privilege in most environments.

Where the two overlap

• Detecting IAM users without MFA — IAM Security.
• Detecting an IAM user without MFA whose permissions include iam:PassRole on an admin role — that's CIEM. IAM Security tells you the user is unsafe. CIEM tells you what it will cost when the user is compromised.

The rule we use internally

If the finding can be answered by looking at one resource in isolation, it's IAM Security. If it requires stitching together identity, trust, and behavior across accounts, it's CIEM.

You need both. IAM Security keeps the door from being obviously open. CIEM makes sure that if it opens, the blast radius is bounded.