IBM Cloud security posture, from VPC network rules to IAM
IBM Cloud security starts with the network: security groups, network ACLs, floating IPs and public gateways decide what the internet can reach. Onam checks those alongside IAM access groups and trusted profiles, Cloud Object Storage, Key Protect, IKS and OpenShift clusters — read-only, re-checked on every scan, and mapped to CIS IBM Cloud and NIST 800-53.
One platform on IBM Cloud
Connect IBM Cloud once. Onam Security is covered in detail below; the rest of the platform works from the same discovery.
Every IBM Cloud resource Onam discovers lands in one inventory, with provider, region, account, state and last-seen time, through the same read-only access. Every discovery run is recorded with its trigger and status. The per-account architecture view draws AWS accounts today, not IBM Cloud.
Posture, identity, attack paths, workloads and compliance for IBM Cloud. The detail is on the rest of this page.
Onam FinOps works on reconciled billing data: billed and effective cost, ownership, forecast, budgets, anomalies and savings. It holds read-only billing access and changes nothing in your accounts. Ask us which IBM Cloud billing data applies to your accounts.
Onam DRM works from the same inventory: it proposes applications from your tags, reads backup, snapshot and replication from cloud configuration, and predicts RTO and RPO against your targets. It plans and records — it does not run a failover or a DR test. Ask us about DRM coverage for IBM Cloud.
Onam AIOps
Early accessAI agents investigate your Onam Security inventory and findings and propose changes a person approves. Executing a change in a customer cloud is on the roadmap, with AWS first; nothing is executed in IBM Cloud today.
Services we monitor on IBM Cloud
Every service below is scanned continuously — no agents, no network changes, read-only.
Plus: Event Streams, Code Engine, Container Registry, App ID, Certificate Manager, and more.
Compliance frameworks
Onam maps every IBM Cloud finding to the frameworks your auditors care about.
Connect in 3 steps
From consent to your first findings, with no agents to install for posture scanning.
Create a trusted profile for Onam
Provision a trusted profile scoped to the enterprise or account, with Viewer and Reader access on all services. No API keys to manage — federated identity signs every call.
Grant enterprise-wide read access
One binding at the enterprise level covers every account group and child account. New accounts added by any team are onboarded automatically.
Findings from the first scan
Onam scans every region — classic and VPC — and returns findings mapped to CIS IBM Cloud and the other frameworks you track.
IBM Cloud in the Onam Security console.
A recreation of the Onam console with sample data: connect, inventory and posture in one view.
What makes Onam different on IBM Cloud
Enterprise & account-group traversal
Onboard once at the enterprise root. Onam discovers every account group, account, and resource group — respecting IAM inheritance and enterprise-managed policies.
Access-group & policy graph
IAM policies, access-group memberships, and trusted-profile claim rules are combined into one effective-access graph — so federated principals are audited end to end.
IBM Cloud network security checks
Security groups with unrestricted inbound SSH or RDP, default security groups that allow traffic, network ACLs without default deny, VPCs without flow logs, instances with public IPs, public load balancers and HTTP listeners — plus activity events when a security group or ACL rule changes.
Compliance for regulated workloads
Findings on IBM Cloud are mapped to CIS IBM Cloud, NIST 800-53, ISO 27001:2022, SOC 2 and GDPR, with evidence per control and PDF or CSV export.
Questions we get a lot
IBM Cloud security — related reading
How the engines behind IBM Cloud coverage work, and what the categories actually mean.
Db2 and Cloudant posture, plus CIS IBM Db2 benchmark coverage.
Cloud security posture management explained — what it catches, and what it cannot.
Why a list of findings is not a priority, and how chains reach crown jewels.
Attack paths and choke points computed across your whole estate.
Effective permissions after role chains, SCPs and permission boundaries.
CIS, NIST, ISO 27001, PCI-DSS and more, scored continuously.
Snapshot-based workload scanning that runs inside your own account.
See Onam on your IBM Cloud environment
Connect once with read-only access. Every Onam product you use works from the same discovery, so your accounts are connected once.