# Cyber Company Profiles: Sonrai Security

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-09-12
Analyzed 2026-09-11
Canonical: https://cybercompanyprofiles.com/companies/sonrai-security
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Sonrai Security, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [sonraisecurity.com](https://sonraisecurity.com)
- Profile: https://cybercompanyprofiles.com/companies/sonrai-security
- Type: Cloud Security, Identity Access
- Also known as: Sonrai
- Market readiness: Established (27/40)
- Defensibility: Defensible (15/21)
- Founded: 2017
- Funding: $88.5M total
- Last updated: 2026-09-11

## Executive Summary

Sonrai Security, founded in 2017, sells cloud identity and permissions controls to companies on AWS, Azure and Google Cloud. Its Cloud Permissions Firewall finds the permissions an identity never uses and blocks them with the clouds' policy tools. By October 2021 it had raised $88.5 million, including a $50 million Series C led by ISTARI. Its 2025 customers include PG&E, Fiserv, Sandisk, ISO New England, BAL, Basis, Haemonetics, LiveView Technologies and PIB Group. Its published customer story covers Global Atlantic Financial Group. A cloud provider could ship blocking of unused permissions in its identity tooling, a risk to the control Sonrai sells. Microsoft retired its product for managing unused permissions in November 2025. Buyers who relied on it need another source for that work.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Sonrai Security secures cloud identities and permissions across AWS, Azure, and Google Cloud, enforcing least privilege through its Cloud Permissions Firewall and extending the same controls to human, machine, and AI agent identities. | [\[f1\]](#company-detail-sources) |
| Founded | 2017 | [\[f2\]](#company-detail-sources) |
| HQ | New York, New York, United States | [\[f2\]](#company-detail-sources) |
| Funding | $88.5M total | [\[f2\]](#company-detail-sources) |
| Latest funding | Series C, 50 million USD, October 2021, led by ISTARI | [\[f3\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Cloud Permissions Firewall | A least-privilege control that analyzes real permission usage and blocks unused privileges, services, regions, and third-party access using cloud-native org-level policies on AWS, Azure, and GCP. |
| WALLy Cloud PAM Agent | An AI agent for cloud privileged access management that ranks privilege risk and stages remediation policies in the Cloud Permissions Firewall for a person to review and approve before deployment. |
| Agentic AI Consulting | A two-week practitioner-led engagement on agentic AI, listed across Sonrai's site navigation. |

## Matrix Coverage

Mapped to the [Cyber Defense Matrix](https://cyberdefensematrix.com) [\[f4\]](#company-detail-sources):

| Asset | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|
| Users | ✓ | ✓ |  |  |  |
| Data |  | ✓ |  |  |  |
| Applications | ✓ | ✓ |  |  |  |

The Cloud Permissions Firewall discovers human and machine identities across AWS, Azure, and GCP and enforces least privilege on their permissions, blocking unused access to services and regions. This cloud identity and permissions security is mapped to the Cyber Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Established (27/40)**

Analyzed 2026-09-11. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | Sonrai names its buyer, the cloud security or platform team, and puts a number on the pain, with SiliconANGLE reporting Sonrai's argument that AWS, Azure and Google Cloud expose more than 42,000 possible permissions with new ones added daily. That article attributes the figure to Sonrai rather than corroborating it, and no non-vendor source in the reviewed record quantifies the problem, so a buyer has the company's own count and no second source for it. \[[s15](#profile-analysis-sources), [s2](#profile-analysis-sources), [s1](#profile-analysis-sources)\] |
| Capability Depth | 4/5 | Sonrai documents the mechanism in detail across its product, Azure and WALLy pages, covering usage analysis, org-level policy generation, quarantine of unused identities and just-in-time restoration, and a granted U.S. patent assigned to Sonrai describes its default-deny policy and permissions-on-demand path in a record Sonrai does not host. Software Secured, a pentest firm, ran 16 known AWS attack paths against the firewall in lab environments and reported all 16 blocked, and Sonrai published that account on its own blog, so the outside evaluation reaches a reader through the vendor. \[[s2](#profile-analysis-sources), [s6](#profile-analysis-sources), [s3](#profile-analysis-sources), [s21](#profile-analysis-sources), [s22](#profile-analysis-sources)\] |
| Market Timing | 3/5 | Cloud permission sprawl and the growth of machine and AI-agent identities are live buyer concerns, and Sonrai reframed its work as cloud privileged access management and announced the WALLy agent in October 2025, then said in January 2026 that WALLy was available across AWS and Google Cloud. The reviewed record carries one kind of buyer-side evidence, independent trade coverage of that launch, and it carries no analyst writeup of the category, no regulatory driver and no budget signal. \[[s16](#profile-analysis-sources), [s17](#profile-analysis-sources), [s5](#profile-analysis-sources)\] |
| Team Credibility | 5/5 | Brendan Hannigan was chief executive of Q1 Labs, where the team built the QRadar security analytics platform, IBM acquired Q1 Labs in 2011, and Hannigan then headed the IBM Security Systems Division while Sandy Bird was its chief technology officer. Wikipedia and contemporary trade press document that path independently, an in-domain exit followed by leadership of a major security business. \[[s20](#profile-analysis-sources), [s19](#profile-analysis-sources), [s9](#profile-analysis-sources)\] |
| GTM Proof | 3/5 | Sonrai names nine 2025 customers including PG&E and Fiserv and publishes a Global Atlantic Financial Group customer story quoting its security operations lead by name. Every name reaches a buyer through Sonrai's own pages, and so do the scale figures behind the roster, fourfold recurring-revenue growth and 220 percent customer growth. No outside outlet in the reviewed record identifies an organization as a Sonrai customer. The nearest is a January 2019 launch article whose Lincoln Center quote credits services such as Sonrai's without saying Lincoln Center uses the product. \[[s5](#profile-analysis-sources), [s7](#profile-analysis-sources), [s19](#profile-analysis-sources)\] |
| Funding Efficiency | 3/5 | Sonrai raised $88.5 million with a $50 million Series C in October 2021 and has since shipped the Cloud Permissions Firewall, just-in-time access, the WALLy agent and a published price list, which is visible output on that capital. No later round appears in the reviewed record and the growth behind that output is the company's own figure, so efficiency is present and unconfirmed. \[[s18](#profile-analysis-sources), [s16](#profile-analysis-sources), [s5](#profile-analysis-sources), [s4](#profile-analysis-sources)\] |
| Category Clarity | 3/5 | SiliconANGLE described Sonrai in October 2025 as a cloud privilege access management company, so an outlet places the company without using its coined label. Sonrai has moved from a cloud data and posture platform to the Cloud Permissions Firewall to cloud privileged access management, and its own product page still answers how the firewall differs from CIEM, so placement follows the vendor rather than settling. \[[s16](#profile-analysis-sources), [s18](#profile-analysis-sources), [s2](#profile-analysis-sources)\] |
| Incumbent Defensibility | 3/5 | Microsoft withdrew its own cross-cloud entitlement product, Entra Permissions Management, from sale in April 2025 and retired it that November, and Amazon's IAM Access Analyzer generates findings on unused access and policies built from recorded activity for a person to apply, without a blocking control of its own, so the absorption this category fears has not happened. Sonrai's enforcement still runs on policy mechanisms the providers own and the reviewed record shows no accumulated data asset, so the friction is workflow and engineering. \[[s13](#profile-analysis-sources), [s14](#profile-analysis-sources), [s1](#profile-analysis-sources), [s2](#profile-analysis-sources)\] |

### Business Risks

- A cloud provider could ship blocking of unused permissions inside its own identity tooling, which would remove the control Sonrai sells.
- The fourfold recurring-revenue and 220 percent customer-growth figures are Sonrai's own and could overstate traction until an outside party reports them.
- No funding round after the October 2021 Series C appears in the reviewed record, so a longer gap without new capital could constrain the pace of Sonrai's response to competitors.
- Enforcement scope differs across Sonrai's own pages, with the firewall claiming all three clouds while the WALLy agent is described on AWS and Google Cloud, so an Azure buyer could find less than the platform page implies.
- A wrong usage judgment could block legitimate cloud access and undercut the no-disruption promise the product is sold on.

### Problem & Market

Sonrai sells to the cloud security or platform team accountable for which identities can act across AWS, Azure and Google Cloud. The pain it names carries a number that Sonrai supplies. SiliconANGLE reported the company's argument that the three major clouds expose more than 42,000 possible permissions with new ones added daily, and that unused sensitive access accumulates into paths for data exposure and lateral movement.

The segment skews to the large regulated account while keeping a self-serve door open. Sonrai's January 2026 recap names 2025 customers including PG&E, Fiserv, ISO New England, Sandisk, Haemonetics, LiveView Technologies and PIB Group, a roster the company says spans a broad range of industries and company sizes. Its pricing page adds that a plurality of the top 10 banks in the United States and Canada use the product, which is the company's own account of its buyers.

The agent era extends that buyer rather than introducing a new one. Sonrai now describes the work as cloud privileged access management across human, machine and AI identities, and its WALLy page counts every AI agent with cloud access among the identities the product tracks. The person accountable for cloud permissions becomes the owner of agent permissions too. \[[s15](#profile-analysis-sources), [s5](#profile-analysis-sources), [s4](#profile-analysis-sources), [s1](#profile-analysis-sources), [s3](#profile-analysis-sources)\]

### Product Capabilities

The core capability is enforcement rather than reporting. The Cloud Permissions Firewall analyses real permission usage across all identities and blocks unused privileges through cloud-native, org-level policies such as AWS service control policies, restricting unused services, regions and third-party access without manual rule writing. Sonrai contrasts that action with visibility tools whose recommendations, in its words, become a backlog while the exposure stays standing.

The product extends the same enforcement to access requests, with a person in the loop. A just-in-time workflow routes a request through a chat tool, grants access for a chosen window, then revokes it with everything logged. Sonrai says policies are built from usage data, that anything in use is exempted before a policy is written, that the customer sees the exemption list first, and that nothing enforces until the customer deploys.

Cloud coverage reads differently across Sonrai's own pages, and the difference matters to a buyer. The Cloud Permissions Firewall page says the product natively supports AWS, Azure and GCP from a single platform, and a dedicated Azure page describes default-deny enforcement across Azure subscriptions. The WALLy page says every change operates inside the firewall across AWS and GCP, and the January 2026 announcement said Azure support was coming soon. \[[s2](#profile-analysis-sources), [s1](#profile-analysis-sources), [s6](#profile-analysis-sources), [s3](#profile-analysis-sources), [s5](#profile-analysis-sources)\]

### Competitive Positioning

Sonrai positions enforcement first against what it calls traditional CIEM tools, which its product page describes as focused on visibility and reporting. Its own comparison pages name Wiz and Palo Alto's Prisma as the platforms buyers weigh it against, describing Wiz as having grown out of workload vulnerability management while Sonrai started from identity and data. On Azure it pitches against Microsoft's own privileged identity management, arguing that service principals and managed identities cannot hold eligible assignments there.

The provider-absorption risk is real, and the current record does not show it happening. Microsoft stopped selling Entra Permissions Management, its own cross-cloud entitlement product, on April 1 2025 and retired it on November 1 2025. Amazon's IAM Access Analyzer identifies unused access, generates findings a person reviews, and can build IAM policies from CloudTrail activity. The guide describes no blocking control. A provider could still build the blocking on the same policy mechanisms Sonrai drives, because those mechanisms are its own. \[[s10](#profile-analysis-sources), [s11](#profile-analysis-sources), [s6](#profile-analysis-sources), [s13](#profile-analysis-sources), [s14](#profile-analysis-sources), [s2](#profile-analysis-sources)\]

### Go-to-Market & Traction

Sonrai pairs named enterprise references with a free on-ramp. Its January 2026 recap names 2025 customers including PG&E, Fiserv, ISO New England, Sandisk, Haemonetics, LiveView Technologies and PIB Group, and a published customer story covers Global Atlantic Financial Group, a United States retirement and life insurance company whose security operations lead is quoted by name. A 14-day free trial and a published price let a smaller team evaluate the product without a sales call.

The 2025 roster and the Global Atlantic story reach a buyer through Sonrai's own pages. The January 2026 post claims fourfold year-over-year recurring-revenue growth, 220 percent customer growth and that 60 percent of customers expanded deployments in 2025, and no independent outlet in the reviewed record carries those figures. SiliconANGLE covered the WALLy launch in October 2025 and SC Media summarised SiliconANGLE's report, so the two accounts share one origin. No outside source in the reviewed record identifies an organization as a Sonrai customer. The nearest is a January 2019 launch article, where Lincoln Center's chief technology officer says services such as Sonrai's give his organization visibility and control rather than stating that Lincoln Center uses the product.

The one product test on the record came through the vendor. Sonrai says it partnered with Software Secured to run known AWS attack scenarios against the product and that the firewall blocked 16 of the 16 paths tested, and Sonrai published that result on its own blog. A buyer weighing efficacy has the vendor's account of that test and no independent one. \[[s5](#profile-analysis-sources), [s22](#profile-analysis-sources), [s7](#profile-analysis-sources), [s16](#profile-analysis-sources), [s17](#profile-analysis-sources), [s19](#profile-analysis-sources)\]

### Team & Credibility

Brendan Hannigan was chief executive of Q1 Labs, where the team built the QRadar security analytics platform, and after IBM's 2011 acquisition he headed the IBM Security Systems Division. Sandy Bird co-founded Q1 Labs and became IBM Security's chief technology officer. Both still hold the top two seats at Sonrai.

That record is documented beyond job titles. Wikipedia records Hannigan as a former head of the IBM Security Systems Division, chairman of Twistlock and chief executive of Q1 Labs, and trade press covering Sonrai's January 2019 launch describes the same path. Sonrai's leadership page lists three executives, the two founders and a vice president of customer success. \[[s20](#profile-analysis-sources), [s19](#profile-analysis-sources), [s9](#profile-analysis-sources)\]

### Trust Readiness

Sonrai claims SOC 2 Type 2 compliance on two of its own pages. Its pricing page describes the company as a SOC2 Type-2 compliant organization with internal security controls, training and monitoring, and its awards page lists SOC 2 Certification among its recognitions. Neither publishes an attestation or links an inspectable trust portal, so a buyer sees the claim rather than the evidence behind it.

The architecture question has a vendor answer and no independent one. Sonrai's pricing page says the company does not possess customer data and installs no agents in the customer's cloud, and that it gathers metadata from a role the customer provides. The reviewed pages do not describe where that metadata is held or how the control plane is operated.

No ISO 27001, no penetration test of Sonrai's own systems and no trust portal appear on the probed surfaces. Sonrai's own pricing page says regulatory demands on its security standards are high because of the banks and Fortune 100 customers it serves, so those are the buyers positioned to ask for the missing evidence. \[[s4](#profile-analysis-sources), [s8](#profile-analysis-sources), [s12](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Wiz | competes with | Sonrai publishes a comparison page setting its identity-centric approach against Wiz's workload-vulnerability one. |
| Palo Alto Networks | competes with | Sonrai publishes a comparison page against Palo Alto's Prisma code-to-cloud platform. |
| Microsoft | competes with | Sonrai's Azure page positions the firewall as an extension of or a replacement for Microsoft's privileged identity management. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Defensible (15/21)**

Band guidance: press the advantage. Analyzed 2026-08-28. Scope: whole company.

The Cloud Permissions Firewall writes the policies that decide which identities can act inside a cloud account, and Sonrai names PG&E, Fiserv and Global Atlantic among its customers. Sonrai's pages name three granted U.S. patents covering the platform, and a patent database records one of them to Sonrai Security Inc. Customers onboard it at the cloud organization level and choose where its controls apply. Its SOC 2 Type 2 claim is a credential a funded rival can also obtain. The blocking runs on policy tools AWS, Azure and Google Cloud own, so a provider could build the same control. Microsoft tried, and retired its own cross-cloud permissions product in November 2025.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 1/3 | Customers buy software they onboard and run themselves, with a published per-account price, a 14-day trial and self-serve sign-up, and they choose where its controls apply. Automated policy generation, just-in-time approvals and the WALLy agent are software output, and the customer's team operates the product and owns the outcomes. \[[s4](#deep-dive-sources), [s2](#deep-dive-sources), [s3](#deep-dive-sources)\] |
| Switching Cost | 2/3 | A default-deny posture enforced across a cloud organization through service control policies, plus chat-based approval workflows a team comes to rely on, is meaningful friction to reverse, because the customer takes permission management back and re-tunes the provider guardrails. The cited record documents that mechanism and does not size the migration. \[[s2](#deep-dive-sources), [s1](#deep-dive-sources)\] |
| Compliance Moat | 1/3 | Sonrai claims SOC 2 Type 2 compliance on its pricing page and lists SOC 2 Certification among its awards, and a funded competitor can obtain the same through ordinary enterprise-market preparation. No regulatory mandate for this product class and no product-carried authorization appear in the reviewed record. \[[s4](#deep-dive-sources), [s11](#deep-dive-sources), [s12](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | Analysing real permission usage for every identity in a cloud organization and generating safe org-level policies through three providers' different mechanisms, with in-use permissions exempted before a policy is written, is real-time and optimization engineering. SiliconANGLE reported Sonrai's argument that the three major clouds expose more than 42,000 possible permissions, and the work spans AWS service control policies, Azure role-based access control and Google Cloud deny policies. \[[s2](#deep-dive-sources), [s6](#deep-dive-sources), [s16](#deep-dive-sources)\] |
| Buyer Profile | 3/3 | Named 2025 customers include PG&E, Fiserv, ISO New England and Haemonetics, and Sonrai's published customer story covers Global Atlantic Financial Group, a United States retirement and life insurance company. That is a regulated-enterprise buyer class, with a 14-day trial and a published entry price keeping a lower-end door open. \[[s5](#deep-dive-sources), [s7](#deep-dive-sources), [s4](#deep-dive-sources)\] |
| Layer | 3/3 | The Cloud Permissions Firewall writes the org-level policies that decide which identities can act in a cloud account, and other workloads run under those policies, so a misjudged enforcement blocks them until it is corrected. That places it at infrastructure rather than at an end-user application. \[[s2](#deep-dive-sources), [s1](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 2/3 | Sonrai's pages name three granted U.S. patents covering the platform, and a patent database records United States Patent 12218982, for a cloud security control platform that enforces scope-based security controls, to Sonrai Security Inc. That is an asset the company retains, and a funded rival could build around it with time and effort. The reviewed record shows no cross-customer dataset behind the product. \[[s21](#deep-dive-sources), [s1](#deep-dive-sources), [s8](#deep-dive-sources)\] |

### Strategic Market Segmentation

Sonrai sells to the cloud security or platform team accountable for which identities can act across AWS, Azure and Google Cloud. The pain it names carries a number that Sonrai supplies. SiliconANGLE reported the company's argument that the three major clouds expose more than 42,000 possible permissions with new ones added daily, and that unused sensitive access accumulates into openings for data exposure and lateral movement.

The segment skews to the large regulated account while keeping a self-serve door open. Sonrai's January 2026 recap names 2025 customers including PG&E, Fiserv, ISO New England, Sandisk, Haemonetics, LiveView Technologies and PIB Group, a roster the company says spans a broad range of industries and company sizes. Its pricing page adds that a plurality of the top 10 banks in the United States and Canada use the product, which is the company's own account of its buyers. Alongside those accounts, a 14-day free trial and a published price let a smaller team evaluate the firewall without a sales call.

The agent era extends that buyer rather than introducing a new one. Sonrai now describes the work as cloud privileged access management across human, machine and AI identities, and its AI-agent page treats an autonomous agent as one more identity that assumes roles and inherits permissions. The person accountable for cloud permissions becomes the owner of agent permissions too. \[[s16](#deep-dive-sources), [s5](#deep-dive-sources), [s4](#deep-dive-sources), [s9](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

The core capability is enforcement rather than reporting. The Cloud Permissions Firewall analyses real permission usage across all identities and blocks unused privileges through cloud-native, org-level policies such as AWS service control policies, restricting unused permissions, services, regions and third-party access without manual rule writing. Sonrai contrasts that action with visibility tools whose recommendations, in its words, become a backlog while the exposure stays standing.

The product extends the same enforcement to access requests and to AI agents, with a person in the loop. A just-in-time workflow routes a request through a chat tool, grants access for a chosen window, then revokes it with everything logged. The WALLy agent scans for identities carrying privilege risk, ranks the findings by impact, then writes remediation policies and stages them in the Cloud Permissions Firewall, and Sonrai's page says a human reviews and approves before anything deploys in the customer's cloud.

The advantage Sonrai presses is consistent control across clouds, and the reach differs by product and has moved. The reviewed firewall page and a dedicated Azure page describe the Cloud Permissions Firewall as covering AWS, Azure and GCP, with default-deny enforcement across Azure subscriptions. Sonrai's January 2026 announcement had put Azure support as coming soon, and the WALLy page still scopes the agent's own changes to AWS and GCP. The engineering that spans the clouds is policy automation over each provider's own mechanism rather than a model Sonrai owns.

What Sonrai has not turned into an advantage is the permission-usage observation it performs across many customer estates. Its own blog says the firewall's controls draw on research Sonrai gathered to decide which permissions are risky enough to require approval, a curated judgment the company keeps. The reviewed record does not show that judgment accumulating across customers into a shared baseline. \[[s2](#deep-dive-sources), [s3](#deep-dive-sources), [s6](#deep-dive-sources), [s8](#deep-dive-sources), [s1](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Go-to-market pairs named enterprise references with a free on-ramp. Sonrai's January 2026 recap names 2025 customers including PG&E, Fiserv, ISO New England, Sandisk, Haemonetics, LiveView Technologies and PIB Group, and a published customer story covers Global Atlantic Financial Group, a United States retirement and life insurance company whose security operations lead is quoted by name. A 14-day free trial and a published price let a smaller team evaluate the firewall without a sales call.

The 2025 roster and the Global Atlantic story reach a buyer through Sonrai's own pages. The January 2026 post claims fourfold year-over-year recurring-revenue growth, 220 percent customer growth and that 60 percent of customers expanded deployments in 2025, and no independent outlet in the reviewed record carries those figures. Sonrai also says it partnered with Software Secured to run known AWS attack scenarios and that the firewall blocked 16 of the 16 paths tested, a result Sonrai published on its own blog.

Independent corroboration in the reviewed record covers the announcements and stops there. SiliconANGLE reported the April 2024 firewall debut and, in October 2025, that WALLy had entered beta with general availability expected in the fourth quarter. That is outside coverage of what Sonrai announced. No outside source in the reviewed record identifies an organization as a customer of any Sonrai product, so the roster, the efficacy result and the revenue figures stay the company's own account. The nearest a non-vendor source comes is a January 2019 launch article, where Lincoln Center's chief technology officer says services such as Sonrai's give his organization visibility and control rather than stating that Lincoln Center uses the product. \[[s5](#deep-dive-sources), [s7](#deep-dive-sources), [s8](#deep-dive-sources), [s17](#deep-dive-sources), [s16](#deep-dive-sources), [s19](#deep-dive-sources)\]

### Pricing Model

Sonrai publishes a price. Its pricing page lists a startup tier at a $15k a year minimum for small cloud footprints, $150 per account per month for 10 to 50 accounts across AWS, Azure and GCP, and enterprise and custom pricing for 50 or more accounts. Sonrai offers a 14-day free trial before any of them, and the page says a customer begins to see results in two hours.

The meter is the cloud account rather than the seat. Sonrai requires onboarding at the AWS, Azure or GCP organization level, which enrolls every account, subscription or project, so the bill tracks the size of the customer's cloud footprint. A team that knows its account count can forecast the number.

What the published tiers do not settle is the top of the market. At 50 or more accounts the page names enterprise and custom pricing and asks the buyer to make contact, and the reviewed pages do not state what that agreement adds beyond the listed inclusions, which cover just-in-time access, third-party lockdown, unused service and region disabling, identity quarantine, enterprise single sign-on and chat integration. \[[s4](#deep-dive-sources), [s2](#deep-dive-sources)\]

### Product Delivery & Operations

Sonrai delivers a control layer that enforces on each provider's own policy machinery rather than an inline proxy. The firewall applies org-level policies such as AWS service control policies, and Sonrai's homepage says the design uses the cloud's own controls with no proxy, no broker and no bastion host to route around. The customer keeps using provider tooling.

The operational promise is that blocking unused access does not break production. Sonrai says policies are built from the customer's usage data, that anything in use is exempted before a policy is written, that the customer sees the exemption list first and that nothing enforces until the customer deploys. A blocked attempt opens a request in a chat tool that updates the policy.

The heavier operational question is what a wrong judgment costs. A control that writes deny policies across a cloud organization can block legitimate access if its usage analysis is wrong, and the reviewed pages describe the approval and restore path without publishing the rollback, exception-handling or service-level detail that would let a buyer judge the failure modes. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s3](#deep-dive-sources)\]

### Earning Customers' Trust

Sonrai claims SOC 2 Type 2 compliance on two of its own pages. Its pricing page describes the company as a SOC2 Type-2 compliant organization with internal security controls, training and monitoring, and its awards page lists SOC 2 Certification among its recognitions. Neither publishes an attestation or links an inspectable trust portal, so a buyer sees the claim rather than the evidence behind it.

The architecture question has a vendor answer and no independent one. Sonrai's pricing page says the company does not possess customer data and installs no agents in the customer's cloud, and that it gathers metadata from a role the customer provides. The reviewed pages do not describe where that metadata is held or how the control plane is operated, which is what a security review of a control that can block production will open with.

No ISO 27001, no penetration test of Sonrai's own systems and no trust portal appear on the probed surfaces. The reputational signal comes from the founders and the customer roster instead, which is assurance of a different kind from an attestation a buyer can read. \[[s4](#deep-dive-sources), [s11](#deep-dive-sources), [s12](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

Sonrai positions the firewall as a control layer spanning the major clouds rather than a feature inside one provider's identity service. Its product page says the firewall natively supports AWS, Azure and GCP from a single platform, and a dedicated Azure page describes default-deny enforcement across subscriptions with one audit trail across the estate.

The integration surface the reviewed pages show is chat, ticketing and security tooling. Just-in-time approvals run through chat tools, and Sonrai says WALLy can be triggered from CNAPP or CIEM tools, from tickets, and from detections in a SIEM. Microsoft's security blog carries a guest post from its partner association describing a Sonrai integration with Microsoft Sentinel and Defender for Cloud. That post is from June 2023 and does not mention the Cloud Permissions Firewall.

No third-party developer network or partner-built integration catalog appears in the reviewed pages. Sonrai supplies that breadth itself, through consistent enforcement across providers and the policy mechanisms it drives, rather than through an outside community extending the product. \[[s2](#deep-dive-sources), [s6](#deep-dive-sources), [s3](#deep-dive-sources), [s13](#deep-dive-sources)\]

### Team & Execution Capability

Brendan Hannigan was chief executive of Q1 Labs, where the team built the QRadar security analytics platform, and after IBM's 2011 acquisition he headed the IBM Security Systems Division. Sandy Bird co-founded Q1 Labs and became IBM Security's chief technology officer. Both still hold the top two seats at Sonrai.

That record is documented beyond job titles. Wikipedia records Hannigan as a former head of the IBM Security Systems Division, chairman of Twistlock and chief executive of Q1 Labs, and trade press covering the January 2019 launch describes the same path. Sonrai's leadership page lists three executives, the two founders and a vice president of customer success.

The same history frames the company's risk. Hannigan and Bird founded Sonrai in 2017 and launched it formally in January 2019 with $18.5 million in Series A funding, on a cloud data control product, then narrowed the public message to the Cloud Permissions Firewall in 2024 and to cloud privileged access management in 2025. The bench is proven at building and selling security products, and the company has repositioned twice. \[[s20](#deep-dive-sources), [s19](#deep-dive-sources), [s10](#deep-dive-sources), [s18](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [Sonrai Story and Leadership](https://sonraisecurity.com/about/story-leadership/) | official | 2026-08-28 |
| f2 | [SecurityWeek: Cloud Security Company Sonrai Raises 50 Million](https://www.securityweek.com/cloud-security-company-sonrai-raises-50-million/) | press | 2026-08-28 |
| f3 | [The SaaS News: Sonrai Security Raises 50 Million in Series C](https://www.thesaasnews.com/news/sonrai-security-raises-50-million-in-series-c) | press | 2026-08-28 |
| f4 | [Cloud Permissions Firewall](https://sonraisecurity.com/cloud-security-platform/cloud-permissions-firewall/) | official | 2026-08-28 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Sonrai homepage: cloud identity and access platform](https://sonraisecurity.com) “Protect AWS, Azure, and GCP with simple, action-based guardrails.” | official | 2026-08-28 |
| s2 | [Sonrai: Cloud Permissions Firewall product page](https://sonraisecurity.com/cloud-security-platform/cloud-permissions-firewall/) “The Cloud Permissions Firewall continuously analyzes real permission usage across all identities and automatically blocks unused privileges using cloud-native, org-level policies.” | official | 2026-08-28 |
| s3 | [Sonrai: WALLy Cloud PAM agent product page](https://sonraisecurity.com/wally/) “From there, WALLy writes the remediation policies and stages them in the Cloud Permissions Firewall. A human reviews and approves before anything is deployed in your cloud.” | official | 2026-08-28 |
| s4 | [Sonrai: Cloud Permissions Firewall pricing page and FAQ](https://sonraisecurity.com/pricing/) “Startup Pricing For small cloud footprints $15k / year minimum 10-50 Accounts Across AWS, Azure, GCP $150 / account / month 50+ Accounts Enterprise and Custom Pricing Contact us” | official | 2026-08-28 |
| s5 | [Sonrai newsroom: 2025 year-end growth announcement, January 6 2026](https://sonraisecurity.com/newsroom/sonrai-closes-2025-with-4x-arr-growth/) “NEW YORK, January 6, 2026 — Sonrai closed the year with strong customer, expansion, and ARR momentum, reflecting broad enterprise adoption of Cloud PAM.” | official | 2026-08-28 |
| s6 | [Sonrai: Cloud Permissions Firewall for Azure page](https://sonraisecurity.com/cloud-permissions-firewall-for-azure/) “Sonrai continuously monitors which privileged permissions every identity in your Azure estate actually uses — human users, service principals, agents, and managed identities alike.” | official | 2026-08-28 |
| s7 | [Sonrai customer story: Global Atlantic Financial Group](https://sonraisecurity.com/customer-success/global-atlantic/) “How Global Atlantic Slashed the Time To Fix Identity and Permissions Problems From 6 Months to 6 Days” | official | 2026-08-28 |
| s8 | [Sonrai: awards and recognition page](https://sonraisecurity.com/about/awards-recognition/) “Gartner 2021 Cool Vendor Award” | official | 2026-08-28 |
| s9 | [Sonrai: story and leadership page](https://sonraisecurity.com/about/story-leadership/) “Sonrai Security delivers identity, access, and permissions security for companies running on AWS, Azure, and Google Cloud platforms.” | official | 2026-08-28 |
| s10 | [Sonrai: comparison page against Wiz](https://sonraisecurity.com/comparisons/wiz/) “Sonrai and Wiz both offer cloud security solutions to enterprises globally. Both claim to be CNAPP, CSPM, CWPP, CIEM, and other acronyms.” | official | 2026-08-28 |
| s11 | [Sonrai: comparison page against Palo Alto Prisma](https://sonraisecurity.com/comparisons/prisma/) “Prisma is Palo Alto Network’s broad code-to-cloud platform designed for securing workloads from their creation in the development pipeline onwards.” | official | 2026-08-28 |
| s12 | [Probe of Sonrai trust surfaces: /trust/, /compliance/, /security/, trust and security subdomains, site footer and page sitemap, direct fetch, 2026-08-28](https://sonraisecurity.com/trust/) “Error 404 This page cannot be found” | official | 2026-08-28 |
| s13 | [Microsoft Learn: Microsoft Entra Permissions Management overview](https://learn.microsoft.com/en-us/entra/permissions-management/overview) “Effective April 1, 2025, Microsoft Entra Permissions Management will no longer be available for purchase, and on November 1, 2025, we'll retire and discontinue support of this product.” | official | 2026-08-28 |
| s14 | [AWS documentation: IAM Access Analyzer user guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html) “IAM Access Analyzer helps you identify and review unused access in your AWS organization and accounts. IAM Access Analyzer continuously monitors all IAM roles and users in your AWS organization and accounts and generates findings for unused access.” | official | 2026-08-28 |
| s15 | [SiliconANGLE: Sonrai Security simplifies cloud access and permissions with new firewall service](https://siliconangle.com/2024/04/02/sonrai-security-simplifies-cloud-access-permissions-new-firewall-service/) “Sonrai argues that between AWS, Azure and Google Cloud, there are more than 42,000 possible permissions and new ones added daily, with thousands of permissions that can be leveraged to do damage such as exposing data, nefarious entry, privilege escalation and lateral movement.” | press | 2026-08-28 |
| s16 | [SiliconANGLE: Sonrai Security introduces WALLy AI agent to fix cloud privilege risks automatically](https://siliconangle.com/2025/10/07/sonrai-security-introduces-wally-ai-agent-fix-cloud-privilege-risks-automatically/) “Cloud privilege access management company Sonrai Security Inc. today announced the launch of WALLy, an artificial intelligence security agent designed to solve one of the most persistent problems in the cloud: excessive privileged access.” | press | 2026-08-28 |
| s17 | [SC Media: Sonrai launches WALLy for cloud access control](https://www.scworld.com/brief/sonrai-launches-wally-for-cloud-access-control) “Sonrai Security has introduced WALLy, an artificial intelligence-powered agent designed to automatically detect and fix excessive cloud privileges, a leading cause of security breaches in enterprise environments, reports SiliconANGLE .” | press | 2026-08-28 |
| s18 | [SecurityWeek: Cloud Security Company Sonrai Raises 50 Million](https://www.securityweek.com/cloud-security-company-sonrai-raises-50-million/) “Public cloud security provider Sonrai Security today announced that it has raised $50 million in Series C funding, which brings the total raised by the company to $88.5 million.” | press | 2026-08-28 |
| s19 | [Tech Startups: Former IBM execs launch Sonrai Security with more than 18 million funding](https://techstartups.com/2019/01/15/former-ibm-execs-launch-sonrai-security-address-multi-cloud-complexity-18-million-funding/) “Nickie Louise Posted On January 15, 2019” | press | 2026-08-28 |
| s20 | [Wikipedia: Brendan Hannigan](https://en.wikipedia.org/wiki/Brendan_Hannigan) “He is a former head of International Business Machines (IBM) Security Systems Division, chairman of Twistlock [ 2 ] and CEO of Q1 Labs.” | research | 2026-08-28 |
| s21 | [FreePatentsOnline: United States Patent 12218982 record](https://www.freepatentsonline.com/12218982.html) “Title: Cloud security control platform that enforces scope-based security controls United States Patent 12218982” | research | 2026-08-28 |
| s22 | [Sonrai blog: Software Secured attack-path testing of the Cloud Permissions Firewall](https://sonraisecurity.com/blog/sonrais-firewall-blocks-real-aws-attack-paths/) “Sonrai Security partnered with Software Secured to exploit a number of known AWS attack vectors documented in a variety of open source capture-the-flag (CTF) style projects.” | official | 2026-08-28 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Sonrai homepage: cloud identity and access platform](https://sonraisecurity.com) “Protect AWS, Azure, and GCP with simple, action-based guardrails.” | official | 2026-08-28 |
| s2 | [Sonrai: Cloud Permissions Firewall product page](https://sonraisecurity.com/cloud-security-platform/cloud-permissions-firewall/) “The Cloud Permissions Firewall continuously analyzes real permission usage across all identities and automatically blocks unused privileges using cloud-native, org-level policies.” | official | 2026-08-28 |
| s3 | [Sonrai: WALLy Cloud PAM agent product page](https://sonraisecurity.com/wally/) “From there, WALLy writes the remediation policies and stages them in the Cloud Permissions Firewall. A human reviews and approves before anything is deployed in your cloud.” | official | 2026-08-28 |
| s4 | [Sonrai: Cloud Permissions Firewall pricing page and FAQ](https://sonraisecurity.com/pricing/) “Startup Pricing For small cloud footprints $15k / year minimum 10-50 Accounts Across AWS, Azure, GCP $150 / account / month 50+ Accounts Enterprise and Custom Pricing Contact us” | official | 2026-08-28 |
| s5 | [Sonrai newsroom: 2025 year-end growth announcement, January 6 2026](https://sonraisecurity.com/newsroom/sonrai-closes-2025-with-4x-arr-growth/) “NEW YORK, January 6, 2026 — Sonrai closed the year with strong customer, expansion, and ARR momentum, reflecting broad enterprise adoption of Cloud PAM.” | official | 2026-08-28 |
| s6 | [Sonrai: Cloud Permissions Firewall for Azure page](https://sonraisecurity.com/cloud-permissions-firewall-for-azure/) “Sonrai continuously monitors which privileged permissions every identity in your Azure estate actually uses — human users, service principals, agents, and managed identities alike.” | official | 2026-08-28 |
| s7 | [Sonrai customer story: Global Atlantic Financial Group](https://sonraisecurity.com/customer-success/global-atlantic/) “How Global Atlantic Slashed the Time To Fix Identity and Permissions Problems From 6 Months to 6 Days” | official | 2026-08-28 |
| s8 | [Sonrai blog: Software Secured attack-path testing of the Cloud Permissions Firewall](https://sonraisecurity.com/blog/sonrais-firewall-blocks-real-aws-attack-paths/) “Sonrai Security partnered with Software Secured to exploit a number of known AWS attack vectors documented in a variety of open source capture-the-flag (CTF) style projects.” | official | 2026-08-28 |
| s9 | [Sonrai: AI agent security use-case page](https://sonraisecurity.com/use-cases/ai-agent-security/) “AI agents are identities, so treat them like it. They assume roles and inherit permissions just like any human user.” | official | 2026-08-28 |
| s10 | [Sonrai: story and leadership page](https://sonraisecurity.com/about/story-leadership/) “Sonrai Security delivers identity, access, and permissions security for companies running on AWS, Azure, and Google Cloud platforms.” | official | 2026-08-28 |
| s11 | [Sonrai: awards and recognition page](https://sonraisecurity.com/about/awards-recognition/) “Gartner 2021 Cool Vendor Award” | official | 2026-08-28 |
| s12 | [Probe of Sonrai trust surfaces: /trust/, /compliance/, /security/, trust and security subdomains, site footer and page sitemap, direct fetch, 2026-08-28](https://sonraisecurity.com/trust/) “Error 404 This page cannot be found” | official | 2026-08-28 |
| s13 | [Microsoft Security Blog: Microsoft Intelligent Security Association guest post on the Sonrai integration](https://www.microsoft.com/en-us/security/blog/2023/06/13/how-microsoft-and-sonrai-integrate-to-eliminate-attack-paths/) “This blog post is part of the Microsoft Intelligent Security Association guest blog series .” | official | 2026-08-28 |
| s14 | [Microsoft Learn: Microsoft Entra Permissions Management overview](https://learn.microsoft.com/en-us/entra/permissions-management/overview) “Effective April 1, 2025, Microsoft Entra Permissions Management will no longer be available for purchase, and on November 1, 2025, we'll retire and discontinue support of this product.” | official | 2026-08-28 |
| s15 | [AWS documentation: IAM Access Analyzer user guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html) “IAM Access Analyzer helps you identify and review unused access in your AWS organization and accounts. IAM Access Analyzer continuously monitors all IAM roles and users in your AWS organization and accounts and generates findings for unused access.” | official | 2026-08-28 |
| s16 | [SiliconANGLE: Sonrai Security simplifies cloud access and permissions with new firewall service](https://siliconangle.com/2024/04/02/sonrai-security-simplifies-cloud-access-permissions-new-firewall-service/) “Sonrai argues that between AWS, Azure and Google Cloud, there are more than 42,000 possible permissions and new ones added daily, with thousands of permissions that can be leveraged to do damage such as exposing data, nefarious entry, privilege escalation and lateral movement.” | press | 2026-08-28 |
| s17 | [SiliconANGLE: Sonrai Security introduces WALLy AI agent to fix cloud privilege risks automatically](https://siliconangle.com/2025/10/07/sonrai-security-introduces-wally-ai-agent-fix-cloud-privilege-risks-automatically/) “Cloud privilege access management company Sonrai Security Inc. today announced the launch of WALLy, an artificial intelligence security agent designed to solve one of the most persistent problems in the cloud: excessive privileged access.” | press | 2026-08-28 |
| s18 | [SecurityWeek: Cloud Security Company Sonrai Raises 50 Million](https://www.securityweek.com/cloud-security-company-sonrai-raises-50-million/) “Public cloud security provider Sonrai Security today announced that it has raised $50 million in Series C funding, which brings the total raised by the company to $88.5 million.” | press | 2026-08-28 |
| s19 | [Tech Startups: Former IBM execs launch Sonrai Security with more than 18 million funding](https://techstartups.com/2019/01/15/former-ibm-execs-launch-sonrai-security-address-multi-cloud-complexity-18-million-funding/) “Nickie Louise Posted On January 15, 2019” | press | 2026-08-28 |
| s20 | [Wikipedia: Brendan Hannigan](https://en.wikipedia.org/wiki/Brendan_Hannigan) “He is a former head of International Business Machines (IBM) Security Systems Division, chairman of Twistlock [ 2 ] and CEO of Q1 Labs.” | research | 2026-08-28 |
| s21 | [FreePatentsOnline: United States Patent 12218982 record](https://www.freepatentsonline.com/12218982.html) “Title: Cloud security control platform that enforces scope-based security controls United States Patent 12218982” | research | 2026-08-28 |
| s22 | [The SaaS News: Sonrai Security Raises 50 Million in Series C](https://www.thesaasnews.com/news/sonrai-security-raises-50-million-in-series-c) “The round was led by ISTARI, a global cybersecurity platform dedicated to helping clients build cyber resilience, with participation from existing investors Polaris Partners, Menlo Ventures, TenEleven Ventures, and New Brunswick Innovation Fund.” | press | 2026-08-28 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.