“We needed full automation with zero click-ops. Manual identity and permission management across hundreds of accounts was a non-starter.”
Energy & Utilities
United States
AWS
Cloud Permissions Firewall
One of the largest energy and utility companies in the United States, this organization serves millions of electricity and natural gas customers. Operating under strict regulatory oversight as a critical infrastructure provider, the company runs a large-scale AWS environment spanning hundreds of accounts with thousands of cloud users.
The cloud security team had a clear mandate: enforce least privilege and maintain continuous audit readiness across the entire estate, with absolutely no manual console operations.
As the organization’s cloud footprint expanded, the security team faced a set of challenges that manual processes and existing tooling could not address:
The team recognized that adding more detection tools would only generate more alerts. What they needed was a solution that would fix the underlying identity and permission issues driving those alerts.
The organization deployed Sonrai Security’s Cloud Permissions Firewall powered by its embedded AI agent, WALLy, across all AWS accounts. The solution was designed to meet the team’s core requirements: full automation, zero manual operations, and audit readiness by the deadline.
Sonrai’s Cloud Permissions Firewall uses AWS Service Control Policies (SCPs) as the primary enforcement mechanism, implementing an approved-services allowlist model that blocks all non-approved services at the organization level.
WALLy analyzed the full privilege landscape to identify which services were unused, distinguish critical risk from expected use, and plan a phased remediation approach. A 30/60/90-day rollout plan was designed to disable unused services, starting with the lowest-risk services and progressing to production and QA environments, ensuring zero disruption to running workloads.
The Cloud Permissions Firewall enforces a 90-day inactivity threshold for identity quarantine. Dormant identities are automatically staged for quarantine and eventual deletion, eliminating potential attacker entry points without manual intervention.
Standing privileges were replaced with time-boxed, approval-based access. The solution integrates with ChatOps tools for approval notifications, delivering zero end-user friction. When engineers need elevated access, they request it in real time, receive rapid approval, and access is automatically revoked when the session expires.
All policy and control changes are performed through integration with existing Infrastructure-as-Code (IaC) tools, with no manual console operation required at any stage of deployment, management, or enforcement.
Audit logs feed directly into the organization’s enterprise SIEM/SOAR platform, providing full traceability of every access request, approval, denial, and abandonment. This immutable audit trail directly satisfied the hard audit deadline, giving the security team verifiable evidence that non-approved services were blocked and all access activity was logged.
WALLy continuously analyzes the privilege landscape and proactively surfaces anomalies, eliminating the blind spots the team previously experienced. By fixing the underlying identity and permission issues, the Cloud Permissions Firewall directly reduced alert noise from overlapping security tooling.
“We went from thousands of alerts with no context to actually fixing the root causes. The alert noise dropped because the problems driving those alerts were resolved.”
— Cloud Security Engineer, Major U.S. Energy Provider
The deployment delivered real impact across security posture, operational efficiency, and audit readiness:
The team recognized that adding more detection tools would only generate more alerts. What they needed was a solution that would fix the underlying identity and permission issues driving those alerts.
“The Cloud Permissions Firewall gave us exactly what we needed: automated enforcement, full audit trails, and zero disruption to production. We hit our audit deadline with confidence.”
— Head of Cloud Security, Major U.S. Energy Provider
