Identity and role inventory
Map user accounts, privileged roles, service accounts, and the sensitive resources they can reach.
Utilities Studio / Cybersecurity
Identity and access management
Find the access your people and services no longer need.
Review privileged access, service accounts, authentication, and permission boundaries. Get an IAM assessment and practical least-privilege recommendations.
You need to explain who can access sensitive systems.
If you own infrastructure or security, you need to know which privileged accounts are necessary and which permissions have outlived their purpose. We review human and service identities alongside the approval and removal process. Your team gets recommendations tied to the access each role needs.
The assessment
Identity and access management services
Identity and access management governs how people and services authenticate and what they can do. We review identities, roles, sign-in flows, and sensitive resources to identify access that exceeds the intended need. Recommendations address the permissions themselves and the process for granting, reviewing, and removing them.
Inside the scope
Authentication and sign-in flows
Review the authentication paths and controls included in the agreed environment.
Privilege boundaries
Assess excessive permissions and whether role assignments support the intended separation of responsibilities.
Access lifecycle
Review how access is approved, reviewed, changed, and removed as people or services change roles.
What your team receives
- Access and privilege review
- Identity risk findings
- Access lifecycle recommendations
Working with your team
From scope to remediation.
Agree the scope
Tell us what is driving the work and which systems matter. We agree access, exclusions, and operational limits, including who to contact if the assessment uncovers an urgent issue.
Investigate and document
Assess the systems in scope and document the evidence. Findings explain the affected assets and business impact, with the limits of the investigation made clear.
Review the next actions
Review the findings with the people responsible for fixing them. Work through priorities and questions about remediation. The proposal sets out any follow-up verification.
What are you paying for?
Application count, identity sources, role complexity, federation requirements and migration work.
Planning around your deadline
An assessment can precede implementation. Rollout timing depends on integrations, testing, recovery access and the risk of disrupting legitimate users.
The practitioner behind the work
Led by Sheeraz Ali.
Sheeraz Ali is our Head of Cybersecurity. His work spans application, cloud, network, and AI assessments. His personal track record includes leading pentests at Cobalt and building the internal pentest programme at SolarWinds.
Read Sheeraz's security backgroundSheeraz's personal track record
- Pentest engagements at Cobalt
- 245
- Vulnerabilities identified at Cobalt
- 1,592
- CVEs discovered
- 28+
- Machines and labs authored at Hack The Box
- 300+
His website lists OSCP, CRTP, CRTE, CREST CRT and CPSA, CBBH, and CKA.
At SolarWinds, he delivered 120+ internal pentests. As CTO at Pwned Labs, he built a platform serving 40,000+ practitioners. He co-developed Mobexler, selected for Black Hat Arsenal, and presented research at Nullcon and c0c0n.
Explore his career timelineFAQ
Questions before you book.
Will this include implementing a new identity provider?
It can. We first review your current setup and agree whether the engagement covers assessment, configuration changes or a wider identity integration.
Authentication vs. authorisation: what is the difference?
Authentication establishes who a user or service is. Authorisation determines what that identity may do. A secure login alone does not prevent someone from accessing another user’s records; permissions need their own design and testing.
Can you improve IAM without replacing our identity provider?
Often, yes. Our team starts with the current provider, roles and integration constraints. We recommend replacement only when the existing setup cannot meet the agreed requirements.
Explore related assessments
All cybersecurity servicesCloud security services
Review AWS, Azure, and Google Cloud security. Assess IAM permissions, exposed services, and workload boundaries, with a prioritized hardening plan.
Cloud penetration testing
Test attack paths across AWS, Azure, and Google Cloud permissions and workloads. Validate exploitable risk with evidence and remediation guidance.
What do you need to get moving?
Tell us what your team needs to resolve, which systems are involved, and any deadline. We will work through the scope and reporting needs with you.