Govern every identity and every privileged session
Ciyora Fortress joins identity governance and privileged access management. It knows who and what holds access, routes every request through policy and separation-of-duties checks, grants privilege only for as long as it is needed, and records what happens with it.
What Ciyora Fortress does
One identity record across every connected system
Fortress pulls people from your HR system and accounts from directories, cloud providers and applications, then matches accounts to people. Orphaned and duplicate accounts are surfaced for an owner to link or disable.
- Identity detail with accounts, entitlements, roles and groups, activity and an access graph
- Joiner, mover and leaver events from the HR source, with birthright rules for day-one access
- Risk score per identity, with filters for status, source and risk
Access requests with separation of duties built in
People request access from a self-service catalogue. Approvers see the request with its separation-of-duties result, and a conflicting request needs a written reason that is kept with the decision.
- Preventive SoD check before approval, detective scans and time-bound exceptions
- Approval centre for access, just-in-time and break-glass requests, with SLA warnings and bulk decisions
- Every decision, reason and approver written to the hash-chained audit log
Just-in-time privilege instead of standing admin rights
Privileged roles are requested for a set duration against a policy that can require approval and MFA to activate. Sessions are visible while they run and can be extended or revoked with a reason.
- Elevation for cloud consoles, Kubernetes clusters, databases and servers
- Standing-privilege and drift findings for accounts that keep access they no longer use
- Approve, deny, extend and revoke from the console or the approval centre
Break-glass with dual control
Emergency credentials are released only after the required number of different approvers agree. The requester can never approve their own request, each approver counts once, and every session is recorded.
A credential vault that keeps secrets out of sight
Privileged credentials are held encrypted in the vault. Checking one out injects it into the session; revealing it needs a reason and can require a hardware security key. Rotation runs on schedule and verifies the new secret before it is trusted.
- Findings for breached, reused, weak and overdue credentials
- Rotation for SSH, Windows, Active Directory, Entra ID app secrets, AWS IAM, Google Cloud service account keys, Kubernetes service account tokens and common databases
- SSH certificate authority with short-lived certificates and trust deployment
Identity threat detection and response
Fortress watches sign-in and access behaviour for signs of credential abuse, session theft and privilege escalation, and maps each detection to MITRE ATT&CK. Analysts can respond from the detection, for example by revoking sessions or suspending the identity, and every response is logged.
Everything in Ciyora Fortress
- Identity governance (IGA)
- Identities, accounts and entitlements from connected systems; account matching, orphan and duplicate detection; roles and groups; joiner, mover and leaver automation with birthright rules.
- Access reviews
- Manager and application review campaigns with bulk decisions, risk-ordered work queues, a written reason for revoking or certifying high-risk items, and evidence export as CSV or JSON.
- Separation of duties
- Policies across applications, preventive checks at request time, scheduled scans for existing violations and recorded exceptions.
- Privileged access (PAM)
- Credential vault with check-out and check-in, step-up with a security key, automated rotation, SSH certificate authority and privileged account discovery.
- Privileged sessions
- Recorded SSH sessions with replay and search, RDP and VNC session recordings, a live session view and access to databases, Kubernetes and cloud consoles.
- Non-human identities
- Service accounts, API tokens, keys, certificates and workload identities with owner, rotation and expiry hygiene, risk and review.
- Identity threats (ITDR)
- Detections from identity-provider sign-in events and behavioural baselines, mapped to MITRE ATT&CK, with response actions and an audit trail.
- Audit and reports
- Hash-chained audit log that you can verify in the browser, access certification evidence packs and governance reports.
How Ciyora Fortress works with the rest of the platform
Every module shares one tenant, one identity model, one audit chain and one console, so a finding in one place is context everywhere else.
Ciyora Fortress can be bought on its own or as part of a bundle. It is also available in the Ciyora Zero Trust bundle with Ciyora VPN. See Ciyora Fortress pricing.
See Ciyora Fortress in a demo
A demo walks through the module on a sample tenant and covers how it would connect to your identity provider, cloud accounts and sites.