Topic starter
25/08/2026 6:10 pm
TL;DR: Identity context, least privilege, and access governance are moving into the center of AI-era security operations as ServiceNow’s acquisition of Veza signals, according to Veza; the market is now treating human, non-human, and agentic identities as one control problem, and static access models are no longer enough for modern enterprise risk.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “ServiceNow + Veza: A new chapter in identity security”.
Key questions
Q: Where do static access reviews fail in mixed human and non-human identity estates?
A: Static access reviews fail when they assume permissions stay stable long enough to be examined and certified.
Q: Why does identity context matter more than role assignment in modern enterprise access governance?
A: Role assignment tells you what was granted, but identity context tells you what can actually happen across systems and data.
Q: What breaks when agentic identities are reviewed like human users?
A: Human-style access reviews break because they assume the subject is observable on a schedule and can be certified in a stable state.
Practitioner guidance
- Map effective access across systems Build a cross-platform view of who can reach sensitive data, administrative functions and workflow actions across SaaS, cloud and custom apps.
- Measure identity blast radius Score identities by data reach, privileged scope, dormant access and lateral-movement potential so remediation is driven by operational exposure.
- Rework access reviews for non-human identities Stop assuming periodic certification alone can govern service accounts, API keys and agentic identities that change scope faster than review cycles.
Bottom line: The acquisition points to a market where identity governance is becoming a core control layer for humans, machine identities and agentic systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Identity context, not identity count, is now the governance problem. Enterprises are not dealing with a single access model anymore. They are trying to govern humans, service accounts, API keys and AI agents through the same operational fabric, which makes simple provisioning logic insufficient. The practical conclusion is that identity governance must be judged by how well it explains effective access across systems, not by how many identities it can list.
A question worth separating out:
Q: How should IAM teams respond when identity protection becomes a platform consolidation story?
A: They should re-check whether governance, lifecycle management, and enforcement are still split across different owners and tools. Consolidation changes the operating model, so the key question is not which vendor wins, but whether the programme can still prove coverage across human and non-human identities without duplicate control gaps.
👉 Read our full editorial: ServiceNow acquires Veza: implications for identity governance