analyzing each of a plurality of permission usage maps, one for each cloud entity of a plurality of cloud entities included in the cloud computing platform to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by one of the plurality of cloud entities, wherein each of the permission usage maps represents the permissions granted to a respective one of the cloud entities and the permissions used by that respective at least one of the cloud entities;

for each discovered hardening gap, computing a risk score designating a potential risk reduction achieved by addressing the hardening gap;

generating at least one hardening recommendation for the at least one hardening gap and its respective computed risk score; and

applying the at least one hardening recommendation to a cloud security policy from a plurality of cloud security policies provisioned to protect the cloud entities, thereby hardening the cloud computing platform.