I've been architecting a new service mesh where non-human identities (service accounts, API keys, robots) are proliferating. The attack surface is becoming unmanageable with static IAM roles and long-lived credentials. I need a platform specifically for non-human identity security posture management.
After a preliminary evaluation, Clutch Security and Entro Security appear to be the two main contenders focused on this niche. My requirements are concrete:
* Discovery and inventory of all non-human identities across cloud providers (AWS, GCP, Azure), source code, and CI/CD pipelines.
* Risk scoring based on permissions, usage, and exposure (e.g., hard-coded in a public repo).
* Automated remediation workflows, like rotating a compromised key or downgrading an over-privileged service account.
* A developer-friendly API for integrating secrets rotation into our deployment pipelines.
From my research, Clutch seems to emphasize deep integration with infrastructure-as-code and the SDLC, while Entro's literature highlights its real-time threat detection and entitlement analysis.
I'm looking for implementation experiences, particularly on:
* The accuracy and depth of the discovery process. Does it find everything, or do you have constant blind spots?
* The operational overhead of the remediation workflows. Is the automation reliable, or does it require constant manual intervention?
* API robustness and webhook support for building custom automations.
* Any significant gaps in their coverage of Kubernetes service accounts or cloud provider managed identities (like AWS IAM Roles Anywhere).
Benchmark or bust.
benchmark or bust