Sonrai Security
Sonrai Security is a cloud identity security company selling a Cloud Permissions Firewall that enforces least privilege across AWS, Azure, and GCP using native cloud controls, serving enterprise CloudOps, DevOps, and security teams.
- Company typePrivate
- Founded2017
- HeadquartersNew York, United States
- Headcount51–100
- GTM typeB2B
- OfferingSoftware
What Sonrai Security does
Sonrai Security is a New York-based cloud identity security company founded in 2017 that sells a SaaS platform called the Cloud Permissions Firewall. The platform enforces least privilege across AWS, Azure, and Google Cloud using each cloud's native org-level controls (AWS SCPs and RCPs, GCP org policies, Azure policies) rather than agents or inline proxies, allowing one-click deployment that blocks unused permissions, services, and regions for all identity types—humans, machines, and AI agents—without disrupting DevOps workflows. Adjacent capabilities include Permissions on Demand (just-in-time access routed through Slack and Teams), Zombie Identity Quarantine for dormant identities, and the WALLy Cloud PAM AI Agent that accepts natural language queries and stages remediations for human approval. The company is led by co-founder and CEO Brendan Hannigan, formerly General Manager of IBM Security and CEO of Q1 Labs, alongside co-founder and CTO Sandy Bird, and holds three granted US patents protecting its core enforcement methodology.
Sonrai operates a hybrid go-to-market combining a self-service 14-day free trial with enterprise field sales and listings on the AWS, Azure, and GCP marketplaces. Pricing is not publicly disclosed. The company has raised approximately $88.5 million across three funding rounds (2019, 2020, 2021), with the most recent being an approximately $50 million round in October 2021 led by ISTARI alongside Menlo Ventures, Polaris Partners, Ten Eleven Ventures, and the New Brunswick Innovation Foundation. Named enterprise customers span financial services (Global Atlantic), energy and utilities (Pacific Gas & Electric, ISO New England), and legal technology (NetDocuments).
Sonrai's most recent strategic emphasis is AI agent security. WALLy entered beta in October 2025 with general availability targeted for Q4 2025, and the company followed with Agentic AI Consulting in April 2026—a two-week practitioner-led services engagement—and Cloud Permissions Firewall AI Agent Security features including an "Accepted State" framework that blocks permissions outside an agent's defined workload scope. The platform also exposes a GraphQL API and a Remote MCP Server enabling Claude Desktop, Claude Code, and VSCode clients to interact with CPF deployments. The company is SOC 2 certified and has accumulated industry recognition including Gartner Cool Vendor (2021), SINET 16 Innovator (2019), and multiple Stevie, CSO, and TMC awards.
Sonrai Security firmographics
Firmographics- Name
- Sonrai Security
- Legal name
- Sonrai Security, Inc.
- Website
- https://sonraisecurity.com
- Company type
- Private
- Founded year
- 2017
- Operating status
- Operating
- Headcount range
- 51–100 employees
- Short description
- Sonrai Security is a cloud identity security company selling a Cloud Permissions Firewall that enforces least privilege across AWS, Azure, and GCP using native cloud controls, serving enterprise CloudOps, DevOps, and security teams.
- Ownership category
- akta.pro rank
Sonrai Security industry classification
Industry- Product category
- Cloud Identity Security
- akta.pro primary industry
- Cloud Network Security (Microsegmentation, Cloud Firewall) (HDADADAH)
- akta.pro secondary industry
- Data Security & Privacy for Cloud (DLP, DSPM, Tokenization) (HDABAHAK)
Keywords
Where Sonrai Security is headquartered
LocationHeadquarters
- HQ city
- New York
- HQ country
- United States
- HQ region
- North America
Offices2 records
Markets served
Sonrai Security business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations
Revenue model
- Cloud Permissions Firewall Subscription: SaaS subscription-based revenue model for the Cloud Permissions Firewall platform. Customers pay for access to the platform which includes identity visibility, permission enforcement, and ChatOps workflows. Annual and multi-year contracts implied by billing cadences.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Pay-as-you-go | 14-day free trial available for all customers |
Go-to-market motion2 records
Distribution channels3 records
Marketing channels7 records
Sonrai Security product offering
Product offeringCore offering
Sonrai Security delivers enterprise cloud identity security through its Cloud Permissions Firewall, which enforces least privilege across AWS, Azure, and Google Cloud using native cloud controls (AWS SCPs, GCP org policies, Azure policies). The platform is complemented by WALLy, an AI-powered Cloud PAM agent that maps every identity, blocks unused privileged permissions via a default-deny state, and exposes conversational ChatOps workflows through Slack and Microsoft Teams.
Product overview
Sonrai Security offers a cloud security platform centered on identity and access management. The core product is the Cloud Permissions Firewall, which provides one-click least privilege enforcement across AWS, GCP, and Azure using cloud-native controls. WALLy is the company's Cloud PAM AI Agent that autonomously manages identity security through natural language interfaces and automated remediation. Agentic AI Consulting is an add-on engagement service. The platform supports integrations with Slack and Microsoft Teams for ChatOps workflows, a GraphQL API for programmatic access, and a Remote MCP Server for AI agent integration. All products work together to secure cloud identities including AI agents, humans, and machines.
Differentiator
Problem solved
Functional benefit
Brands
- Cloud Permissions Firewall: One-click solution to least privilege cloud security without disrupting DevOps.
- WALLy
- Agentic AI Consulting
Products and services
- Cloud Permissions Firewall
Quantifiable outcome
- Days vs months to achieve least privilege - customers accomplish in days what would take months manually
- +3 more outcomes
Companies that use Sonrai Security
Customer profileNamed customers4 records
Segments1 record
Ideal customer profiles1 record
Sonrai Security technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration6 records
AI capability6 records
Feature8 records
Sonrai Security partnerships and signals
Strategic signalPartnerships
Five partnerships are on record, tiered core.
- Amazon Web Services (AWS)coreCore platform integration using AWS-native controls (SCPs, RCPs, IAM conditions) for permission enforcement. AWS logo displayed prominently on website. Joint customer success stories.
- Google Cloud Platform (GCP)corePlatform support using GCP-native org policies for permission enforcement. Full integration with GCP environments.
- Microsoft AzurecorePlatform support using Azure-native controls for permission enforcement. Azure logo displayed on website.
- SlackcoreChatOps integration partner for Permissions on Demand and Just-in-Time workflows. Sonrai Slack app enables approval/denial of cloud access requests directly from Slack channels.
- Microsoft TeamscoreChatOps integration partner for Permissions on Demand and Just-in-Time workflows. Sonrai Teams app enables approval/denial of cloud access requests directly from Teams.
Scale indicators5 records
Recent moves5 records
Expansion highlights6 records
Sonrai Security competitors and assessment
Company assessmentDirect peers
- Wiz: Cloud security platform with strong CNAPP and cloud identity/entitlement management (CIEM) capabilities. Directly competes with Sonrai in cloud permissions, posture management, and least-privilege enforcement across AWS, Azure, and GCP.
- Ermetic (now Tenable Cloud Security): Was a direct CIEM competitor offering cloud infrastructure entitlement management and least-privilege enforcement; acquired by Tenable in 2023. Most direct functional peer to Sonrai's Cloud Permissions Firewall.
- Orca Security: Agentless cloud security platform with CIEM, CSPM, and cloud workload protection capabilities. Directly competes in cloud identity and entitlement risk prioritization across multi-cloud environments.
- Lacework: Cloud security platform offering CSPM, workload protection, and identity/ entitlement analysis across AWS, Azure, and GCP. Direct competitor in cloud posture and permissions risk.
- Aqua Security: Cloud-native application protection platform (CNAPP) with cloud workload protection and posture management. Competes with Sonrai in cloud security for cloud-native enterprise environments.
Broad incumbents
- Palo Alto Networks (Prisma Cloud): Prisma Cloud is a broad CNAPP that includes CIEM, CSPM, and cloud workload protection. Directly competes with Sonrai across cloud permissions but as part of a much larger security portfolio.
- CrowdStrike (Falcon Cloud Security): Falcon Cloud Security offers CNAPP capabilities including identity threat detection and entitlement management. Competes with Sonrai as part of a broader endpoint-and-cloud platform from a much larger public company.
- Microsoft Defender for Cloud / Entra Permissions Management: Microsoft's cloud security suite includes Defender for Cloud (CNAPP) and Entra Permissions Management (CIEM, formerly CloudKnox). Directly competes with Sonrai, particularly for Azure-centric enterprises, and benefits from native Azure integration.
- Check Point CloudGuard: Cloud security suite offering CSPM, workload protection, and identity security. Competes with Sonrai as part of a broader network-security portfolio from a large incumbent.
Others
- Auth0 (Okta): Workforce and customer identity platform that addresses IAM but is more oriented toward application-level identity rather than cloud infrastructure permissions. Adjacent competitor for cloud identity security spend.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
Sonrai Security social profiles
Digital presenceSonrai Security compliance and trust
Trust signalCompliance1 record
Sonrai Security financial estimates
Financial estimateRevenue estimate
Valuation estimate
Sonrai Security leadership team
Management profileNumber of profiles
Profiles5 records
Sonrai Security funding detail
Funding detailFunding overview
Funding rounds3 records
Investors5 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Sonrai Security M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Sonrai Security
What does Sonrai Security do?
Sonrai Security delivers enterprise cloud identity security through its Cloud Permissions Firewall, which enforces least privilege across AWS, Azure, and Google Cloud using native cloud controls (AWS SCPs, GCP org policies, Azure policies). The platform is complemented by WALLy, an AI-powered Cloud PAM agent that maps every identity, blocks unused privileged permissions via a default-deny state, and exposes conversational ChatOps workflows through Slack and Microsoft Teams.
Is Sonrai Security a public or private company?
Sonrai Security is a private company. It is classified as venture growth investor backed and is currently operating.
When was Sonrai Security founded?
Sonrai Security was founded in 2017. It employs 51 to 100 people.
Where is Sonrai Security based?
Sonrai Security is headquartered in New York, United States, in the North America region.
How does Sonrai Security make money?
One revenue line is on record: cloud Permissions Firewall Subscription.
Who are Sonrai Security's main competitors?
Direct peers on record are Wiz, Ermetic (now Tenable Cloud Security), Orca Security, Lacework and Aqua Security. Broad incumbents are Palo Alto Networks (Prisma Cloud), CrowdStrike (Falcon Cloud Security), Microsoft Defender for Cloud / Entra Permissions Management and Check Point CloudGuard. Auth0 (Okta) is listed as an others.
Does Sonrai Security have an API?
Yes. Sonrai GraphQL API provides programmatic access to cloud identity, entitlement, and permission data. Supports both read queries and configuration mutations. Token-based authentication. Also supports webhooks for real-time event notifications to external tools and services (SIEM, ticketing systems, audit repositories). Available via the Sonrai Explorer interface within the application, as well as external tools like Postman and Insomnia. A Python client (sonrai-public-assets) is available on GitHub. Developer documentation is at docs.sonraisecurity.com/cpf/api/sonrai-graphql-api.
What industry is Sonrai Security in?
Sonrai Security's product category is Cloud Identity Security. Its primary akta.pro industry code is HDADADAH, Cloud Network Security (Microsegmentation, Cloud Firewall), with a secondary code of HDABAHAK, Data Security & Privacy for Cloud (DLP, DSPM, Tokenization).