Sonrai Security is a cloud identity security company. It helps cloud and security teams enforce least privilege across AWS, Azure and Google Cloud by removing the permissions, identities, services and regions nobody uses, without breaking the developers and workloads that depend on the rest.
It is built for organisations whose cloud accounts have grown faster than anyone could review them, where humans, machines, AI agents and third parties all hold access that was granted once and never taken back.
At A Glance
| Vendor | Sonrai Security |
|---|---|
| Category | Cloud permissions management and cloud privileged access |
| Identities covered | Humans, machines and workloads, AI agents, third parties |
| Deployment | Cloud-native, organisation-level policies on AWS, Azure and GCP |
| Agentic AI | WALLy cloud PAM agent; AI agent security |
| Customers | FINRA, Global Atlantic, PIB Group, NetDocuments, ISO New England |
| Market classification | Identity Security Posture Management; also Authorisation |
What Sonrai Security Does
Cloud estates accumulate unused privileges, dormant identities, services and regions that nobody needs, and third parties with more access than they should have. Cleaning this up by hand is slow, and removing the wrong permission breaks production. Sonrai’s approach is to enforce least privilege automatically using actual cloud activity: it analyses how each identity really uses its permissions, blocks what goes unused, and exempts identities that genuinely rely on a privilege. Anything removed can be requested back, so developers are not left stuck.
Products
Cloud Permissions Firewall
The Cloud Permissions Firewall is for teams that want to cut cloud permissions to what is used without auditing every role by hand. It works across all three major clouds.
| Unused permissions | Restricted based on observed usage. |
|---|---|
| Zombie identities | Dormant identities quarantined rather than deleted, and reactivated through approval. |
| Services and regions | Unused or unwanted ones blocked across the organisation. |
| Third-party access | Controlled with default-deny policies. |
| Privilege on demand | Temporary access granted through ChatOps approvals. |
WALLy
WALLy is a cloud privileged access management agent for teams that have more privilege risk than people to fix it. It gives real-time visibility into every human, machine, AI agent and third party with cloud access, then builds policies to quarantine zombie identities, block third-party access and enforce just-in-time access, including AI-driven just-in-time access for AWS. It ranks findings by impact, and a user reviews and approves every change before it is deployed. AI agents are treated as identities in their own right and sit in WALLy’s inventory alongside humans and machines. For organisations planning their own agent deployments in the cloud, Sonrai also runs Agentic AI Consulting, a practitioner-led service, and an AI Risk Assessment.
How It Works
The firewall continuously analyses permission usage across identities and applies its controls as cloud-native, organisation-level policies, such as AWS Service Control Policies, so a single central policy covers every account.
| Component | What it does |
|---|---|
| Approval workflows | Owners and approvers are notified through Slack, Microsoft Teams or email and can grant or restore access there, or through the Sonrai interface. |
| WALLy | WALLy prioritises findings and stages its remediation policies in the Cloud Permissions Firewall, where they wait for review. It can trigger controls from CNAPP or CIEM findings, act on SIEM detections and enforce remediation raised in tickets. |
Identities And Systems Covered
| Human identities | Human users with cloud access. |
|---|---|
| Machine identities | Machine identities and workloads. |
| AI agents | AI agents with cloud access. |
| Third parties | External access controlled by default-deny policies. |
| Dormant identities | Zombie identities quarantined until approved for reactivation. |
| Clouds | AWS, Azure and Google Cloud, supported natively. |
Company Background
| Founded | 2017 by Brendan Hannigan and Sandy Bird. |
|---|---|
| Offices | New York, United States, and New Brunswick, Canada. |
| Growth | Closed 2025 with a reported 4x growth in annual recurring revenue as adoption of the Cloud Permissions Firewall rose. |
Note: This overview is compiled from Sonrai Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.