Identity security posture management (ISPM) for SaaS identities
Identity security posture management (ISPM) continuously checks the rights, configuration and activity of human and non-human identities to find risky access before it is abused. Cydenti ISPM reads Microsoft 365 / Entra ID, Google Workspace and Salesforce through read-only APIs, then scores each finding by risk and blast radius. ISPM definition.
Why identity security posture management matters in SaaS
SaaS risk rarely comes from a single bad decision. It comes from hundreds of reasonable ones — made over time, by different teams, under different pressures.
- A new role added to unblock work.
- An integration enabled to move faster.
- A permission kept 'just in case.'
- A service account provisioned for a migration — never decommissioned.
"None of these feel dangerous in isolation. Together, they quietly reshape your security posture."
Cydenti exists to make that drift visible.
This is what that drift looks like over time.
Access rarely becomes dangerous in a single moment.
It accumulates — quietly, reasonably, and over time.
Identity posture gaps that IAM and SSO leave open
Most organizations believe their SaaS environment is under control because access was approved, configurations were reviewed, and integrations were intentional.
The Static View
- Access was approved at some point
- Configurations were reviewed once
- Integrations were intentionally enabled
The Reality: Constant Change
- Roles evolve
- Vendors add features
- Apps connect to other apps
- People move teams
- Machine credentials and dormant service principals accumulate privileges with no owner reviewing them
- NIS2 and DORA require continuous evidence — not last quarter’s screenshots
The posture you approved is not the posture you’re running.
How Cydenti ISPM maps human and non-human identities
Cydenti approaches SaaS security differently. Instead of treating SaaS apps as isolated tools, Cydenti treats them as identity systems.
By anchoring SaaS security to identity — both human and non-human — Cydenti reveals how access actually behaves across your environment. The identities with the broadest access are the ones no one reviews: machine credentials, dormant service principals, and stale integrations. Most tools ignore them entirely.
"Not what was configured — but what is now possible."
Permission Models
Complex, app-specific access controls
Configuration Risks
Settings that drift from best practices
Integration Surfaces
Hidden connections between applications
What an ISPM assessment finds: excess rights, dormant accounts, risky OAuth apps
When SaaS posture is viewed through identity, hidden patterns appear.
Permission Accumulation
Users and service accounts quietly accumulate permissions across multiple apps. Non-human identities drift faster because no one reviews them.
Role Expansion
Some roles expand far beyond their original intent.
Integration Sprawl
Some integrations touch more systems than anyone realized.
Silent Drift
Some configurations drift away from security best practices — without triggering alerts.
Non-Human Identity Exposure
Dormant service principals, over-permissioned integrations, and stale machine credentials create hidden attack paths that most posture tools ignore entirely.
These aren’t missteps. They’re side effects of growth.
Cydenti brings them into focus.
What ISPM checks in Microsoft 365 / Entra ID, Google Workspace and Salesforce
Examples of checks. Coverage depends on the data each connected application exposes.
- Microsoft 365 / Entra ID: app registrations and service principals holding high-privilege Microsoft Graph permissions with no recent sign-in; long-lived or non-expiring client secrets; guest accounts with admin roles.
- Google Workspace: third-party OAuth apps with Gmail or Drive scopes; service accounts granted domain-wide delegation; more super admins than you need.
- Salesforce: integration users with "Modify All Data"; connected apps with broad OAuth scopes; inactive users who still hold privileged permission sets.
Each finding gets a risk score from the AI Risk Engine, and blast radius analysis shows what the identity could reach. AI agents that use service accounts or OAuth apps in these three apps appear in the same inventory, as those identities.
Continuous ISPM: catching identity posture drift
The most dangerous SaaS risks are rarely misconfigurations you just created. They are:
- Access that made sense six months ago
- Integrations no one owns anymore
- Permissions that survived team changes
- Service accounts with admin privileges that outlived the project they were created for
- Settings that were secure before the product evolved
Cydenti continuously tracks how SaaS posture moves over time, so risk is understood as a trend — not a snapshot.
Integration risk: OAuth apps and service accounts that connect your SaaS
SaaS rarely stands alone.
Applications Connect
Applications connect to each other.
Permissions Propagate
Access is delegated across systems.
Risk Amplifies
Safe configs become dangerous when connected.
Cydenti maps these relationships so posture is evaluated in context, not in isolation.
Highlight Drift
Where posture no longer matches intent
Prioritize Access
Show which access matters and which does not
Empower Teams
Give teams confidence to remove what's unnecessary
Agentless ISPM with policy-driven remediation
Cydenti is not built to lock down SaaS environments or slow teams. It’s built to provide clarity.
Security improves not because teams are blocked — but because they finally understand what to change.
Fixes for excessive or unused rights run automatically, following the policies you set.
Where ISPM fits in the Cydenti platform
Credential Risk Scoring
So SaaS access is prioritized correctly.
ISPM
Feeds context to the entire platform.
Threat Detection
Where risky posture magnifies behavior.
This ensures SaaS security is not a checklist — it's part of a living identity model.
ISPM findings give you evidence of who holds which access. That evidence supports your NIS2, ReCyF, DORA and ISO 27001 reviews. Cydenti does not certify compliance.
ISPM alongside PAM, IAM and IGA
Cydenti discovers SaaS and NHI exposure — accumulated permissions, dormant credentials, unreviewed integrations — then explains and prioritises what matters.
Policy-driven automatic remediation then removes excessive or unused rights, following the policies you set. Cydenti complements your PAM and IAM tools; it does not replace them.
Go further
ISPM vs ITDR vs SSPM vs CIEM
| Question it answers | Approach | |
|---|---|---|
| ISPM | Who has what access, and is it too much? | Preventive posture checks and risk scoring |
| ITDR | Is someone abusing an identity right now? | Behavioural baselines and MITRE ATT&CK-aligned detections (Cydenti ITDR) |
| SSPM | Are the SaaS app settings safe? | Configuration checks; overlaps with ISPM on identity settings |
| CIEM | Who holds which cloud entitlements? | Entitlement analysis (Cydenti CIEM: Start in 5 minutes, quarantine risky tokens, real-time detection) |
ISPM finds posture risk first; ITDR catches active abuse. Cydenti runs ISPM and ITDR on one Identity Graph, alongside your IAM, IGA, PAM and SIEM. It does not replace them, and it is not a vault.
Independent, Paris-based. Hosted in Europe: Hetzner Germany by default, OVHcloud or Scaleway on request. Selected CYBIAH provider (Campus Cyber with Hub France IA). 10+ clients.
FAQ
What does an ISPM platform check?
Excessive or unused rights, dormant accounts, risky OAuth grants, admin role sprawl and posture drift over time, for human and non-human identities. Each finding gets a risk score and a blast radius.
Which apps does Cydenti ISPM connect to?
Microsoft 365 / Entra ID, Google Workspace and Salesforce, through read-only APIs with no agent.
Does Cydenti change anything in my tenant?
Discovery is read-only. Fixes for excessive or unused rights run automatically, but only following the policies you set.
How is ISPM different from IGA or IAM?
IAM and IGA govern lifecycle and approved access. ISPM shows what is possible now: accumulated permissions, expanded roles and over-permissioned integrations, including non-human identities that IAM rarely reviews.
How does ISPM connect to ITDR?
ISPM finds risky access before it is used. When that access is abused, ITDR raises the detection. Cydenti runs both on one Identity Graph.
Which European ISPM vendors exist?
Cydenti is an independent ISPM vendor based in Paris, hosted in Europe (Hetzner Germany by default, OVHcloud or Scaleway on request). Start with a free Audit Flash: up to 3 SaaS apps, read-only, no credit card.
Discover the machine identities you didn't know you had
— the first inventory usually lands within a week.
The Audit Flash connects up to three SaaS applications through read-only APIs. Review the service accounts, credential metadata and OAuth grants visible in that scope, then agree which risks your teams should address. Coverage and timing depend on the connected applications and available data. No commitment.
No commitment • No credit card • Data hosted in Europe • Response within 24h