Introducing Google Cloud support in Saner Cloud with CIEM visibility

Cloud adoption rarely happens in a neat straight line. Teams add projects, hand off ownership, build new services, and revisit access later. Over time, permissions tend to spread across people, groups, and service accounts, and it becomes harder to answer basic questions about access with confidence.

Google Cloud Identity and Access Management is built around roles and policies that control who can access resources and what actions they can take across scopes such as organization, folder, project, or resource. With policy inheritance across the hierarchy, small gaps can carry further than expected, especially when access patterns change faster than reviews.

Saner Cloud now supports Google Cloud with a CIEM capability focused on visibility into identity and permission risks, plus a path to act on what the platform surfaces.  The aim is to help teams see who has access, how access was granted, and what that access could impact, without turning the launch story into a deep technical walkthrough.

GCP CIEM in Saner Cloud is designed to make access visibility easier to understand when IAM grows across teams, projects, and services. The focus is on identity and permission risk visibility across GCP environments, with a single place to review what access exists, how it was granted, and what it could impact.

CIEM brings together the core signals teams typically chase during access reviews. Excessive permission visibility helps flag access that goes beyond what is commonly needed for a role or workload. Critical Activity monitoring adds awareness of high-risk events, organized by scope, with evidence details to support investigation and follow-through. Recommended Remediation supports the move from findings to action by presenting prioritized identity and resource-related issues, so teams can start with items that demand attention first.

Together, these parts help security and platform teams shift from periodic access reviews to a more continuous view of entitlement risk, while keeping the launch experience approachable and not overloaded with setup detail.

The CIEM view is organized around the identity types teams manage every day in Google Cloud, including users, groups, and service accounts. That structure supports practical questions teams ask during audits and incident follow-ups, such as which identities have broad access, where access is concentrated, and which accounts may need a closer look.

Alongside identity visibility, roles and IAM policies are part of the entitlement story because they explain how access was granted in the first place. Framing identities together with roles and policies helps connect the dots between who has access and the mechanisms that allow that access, which is often where cleanup and governance work starts.

Permissions tend to expand over time in any active Google Cloud environment. New projects come online, teams shift ownership, temporary access becomes permanent, and service accounts multiply as automation grows. As that happens, basic access questions start taking longer to answer, and reviews become reactive rather than routine.

Entitlement visibility brings those access questions back to something teams can handle quickly. A single view across identities and permissions supports faster access reviews, because teams can spot where privileges have drifted beyond what is needed, and focus attention where risk is concentrated. Fewer blind spots also means fewer surprises during audits, incident follow-ups, or onboarding and offboarding cycles.

The outcome is practical. Over-privilege exposure drops when excessive permissions are easier to spot early. Ownership and accountability improve when it is clearer how access was granted, and which identities and access paths need attention across teams, projects, and workloads.

1. Faster detection of excessive permissionsVisibility into excessive permissions helps teams surface access that goes beyond what is commonly required, so cleanup work can start with the highest-impact areas.
2. Quick visibility into highly privileged identities for triageA privileged identity view helps teams prioritize review and response, especially when time is limited and focus matters.
3. Recommended remediation that turns findings into actionA prioritized remediation view helps teams work through common IAM hygiene gaps such as inactive identities, empty groups, projects without owners, and misconfigured roles.
4. Critical Activity awareness for high-impact access eventsCritical Activity alerts support awareness of risky sign-ins, role assignments, privilege escalations, sensitive resource changes, identity configuration changes, and access policy updates.
5. Evidence context that supports investigationEvidence details such as initiator, impacted resources, IP address, and timestamps help teams validate what happened and coordinate follow-up.
6. Workflow handoff into CSRM for follow-throughA CSRM handoff supports task-based execution, so remediation steps are tracked and completed rather than left as notes from a review.

See the full release notes here.