Cloud posture and cloud permissions in one view
Ciyora Armor connects to your cloud accounts, checks their configuration against industry benchmarks and keeps a posture score over time. It shows which users, roles and service accounts hold more permission than they use, how an attacker could chain weaknesses together, and where your sensitive data is exposed.
What Ciyora Armor does
Cloud posture findings that lead to a fix
Armor checks the configuration of your cloud accounts continuously. Each finding explains the risk, gives remediation steps and lists the controls it maps to. Teams can acknowledge it or mark it a false positive with a note, and reopen it later.
- Checks for AWS, Azure, Google Cloud and Kubernetes
- Controls mapped to CIS benchmarks, PCI DSS, SOC 2, NIST SP 800-53, ISO/IEC 27001 and HIPAA
- Pass rate and coverage per framework; controls that cannot be checked with the current permissions count as not covered, never as passed
- Configuration drift from cloud change events, and a 30-day posture trend
- Remediation with an approval step, and exceptions that can be approved and revoked
Cloud entitlements (CIEM)
Armor ranks cloud users, roles and service accounts by privilege and flags full administrators, paths to privilege escalation, missing MFA and permissions unused for 90 days or more. For each grant it says why it matters. Right-sizing recommendations can be accepted, or dismissed with a reason.
- Unused-permission analysis, including last-access data from AWS IAM Access Advisor
- Right-sizing recommendations with an unused-permission dashboard
- Cloud identities linked to their Ciyora Fortress identity
Attack paths
Misconfigurations and credentials rarely matter one at a time. Armor shows how an attacker could chain them from an exposed resource to something valuable, and what a stolen credential would put within reach.
- Attack paths across cloud resources
- Credential attack paths and blast radius
Infrastructure as code
Terraform is checked for misconfigurations before it is applied, and findings are linked to the running resources the code created, so a fix lands in the source instead of drifting back.
- Rules for storage encryption and public access, security groups, instance metadata, IAM wildcards and hard-coded secrets
- Findings linked from code to the deployed resource
Workloads, containers and Kubernetes
Container images are scanned with a software bill of materials, workloads are scanned without installing an agent, and a Kubernetes admission controller keeps non-compliant workloads from starting.
- Image scanning with an SBOM per image
- Agentless workload scanning for AWS
- Kubernetes admission policies with a record of every decision
Data security posture (DSPM)
Armor finds the data stores in your cloud accounts, samples their contents to classify sensitive data, and ranks them by sensitivity and exposure, so a public bucket full of personal data rises to the top.
Cloud threat detection
Detection rules run on cloud activity. When a threat is found, Armor proposes containment, such as isolating an instance by swapping its security groups, and sends it to the approval queue instead of acting alone.
AI in your cloud
An inventory of AI services and models running in your cloud accounts, with flags for shadow AI, publicly reachable endpoints and missing guardrails.
Capabilities
- Cloud accounts
- Connect AWS, Azure and Google Cloud accounts, test the connection, sync on demand and see regions and resources. Credentials are never shown back.
- Posture management (CSPM)
- Score, critical findings, non-compliant resources and trend; findings with remediation, mapped controls, workflow status, drift and exceptions.
- Controls and frameworks
- CIS, PCI DSS, SOC 2, NIST SP 800-53, ISO/IEC 27001 and HIPAA, with custom controls and compliance reports per framework.
- Cloud entitlements (CIEM)
- Privilege scores, excessive-permission flags, unused-permission analysis and right-sizing recommendations for users, roles and service accounts.
- Attack paths
- Chains of misconfigurations and credentials from exposure to impact, with blast radius.
- Infrastructure as code
- Terraform misconfiguration scanning, linked to deployed resources.
- Workload protection
- Container image scanning with SBOMs, agentless workload scanning for AWS and Kubernetes admission control.
- Data security (DSPM)
- Data store discovery, sampled classification and ranking by sensitivity and exposure.
- Cloud detection and response
- Detections on cloud activity with containment proposed through the approval queue.
How Ciyora Armor works with the rest of the platform
Every module shares one tenant, one identity model, one audit chain and one console, so a finding in one place is context everywhere else.
Ciyora Armor can be bought on its own or as part of a bundle. See Ciyora Armor pricing.
See Ciyora Armor in a demo
A demo walks through the module on a sample tenant and covers how it would connect to your identity provider, cloud accounts and sites.