Veza is an identity security company that shows organisations who can take what action on what data, across every system they run. Security and identity teams use it to find risky or unused access, run access reviews, automate provisioning and bring service accounts, keys, secrets and AI agents under the same governance as employees.
Everything runs on one data layer, the Veza Access Graph. Veza is now part of ServiceNow.
At A Glance
| Vendor | Veza (part of ServiceNow) |
|---|---|
| Category | Identity security posture management, identity governance, NHI and AI agent security |
| Identities covered | Human users, third parties, service accounts, keys, secrets, service principals, workloads, AI agents |
| Deployment | SaaS with agentless, read-only integrations |
| Agentic AI | AI Agent Security, Access AI, Access Agents (Early Access) |
| Customers | Genesys, Barracuda Networks, Blackstone, Workday, Snowflake |
| Certifications | SOC 2 Type II, ISO 27001 |
| Founded | 2020 |
| Market classification | Authorisation; also Identity Governance & Administration, NHI Platforms & Machine Identity |
What Veza Does
Permissions in a modern enterprise are scattered across identity providers, cloud accounts, data platforms and SaaS applications, each with its own model of roles and groups. Knowing that someone belongs to a group says little about what they can actually do to a given table or bucket. Veza resolves this by translating each system’s permissions into effective access, so a team can see the real path from an identity to a resource and the actions it allows.
Once effective access is visible, the same model drives posture fixes, governance workflows and enforcement, for people, machines and agents alike. The aim throughout is least privilege and end-to-end control over who can access what.
Products
Access Graph
The Access Graph is the data layer underneath every Veza product. It links all human and machine users, apps, systems and data sources to their effective permissions, using graph infrastructure built for the purpose rather than a relational database. Its core features are also available through a REST API.
Access Visibility
Access Visibility lets teams see and control who has access to data in every enterprise system, for human and machine identities alike. It is the starting point for answering an auditor’s or an incident responder’s question about a specific resource.
Access Intelligence
Access Intelligence finds privileged users, dormant permissions and policy violations using more than 500 pre-built queries, and can open remediation tickets for what it finds.
Access Monitoring
Holding access and using it are different things. Access Monitoring tracks who has actually touched key resources, giving teams evidence to remove entitlements nobody needs.
Access Reviews
Access Reviews automates certification campaigns and puts the riskiest access at the top of each reviewer’s list, which shortens review cycles for teams facing frequent audits.
Lifecycle Management
Lifecycle Management grants and revokes access automatically as people join, move or leave. Changes can be dry-run before they take effect, so administrators can check the outcome first.
Access Requests And Access Hub
Access Requests streamlines provisioning across the enterprise. Access Hub is the central place where managers and employees view, request and govern access without raising tickets with IT.
Access AuthZ
Access AuthZ takes Veza from finding problems to enforcing fixes, applying changes in connected systems to reach least privilege at scale.
Separation Of Duties
Separation of Duties detects toxic combinations of access within a single platform and across platforms, a common requirement for financial controls.
NHI Security
NHI Security is for organisations that have lost track of their machine identities. It builds an inventory of service accounts, keys and secrets, assigns each one an owner and ties that owner to the employment lifecycle, so a leaver’s accounts are flagged. It also highlights expired credentials, over-permissioned accounts, workload accounts disguised as human ones, and keys that are not being rotated, covering more than 90 types of NHI entity.
AI Agent Security
AI Agent Security extends the Access Graph to AI agents. It finds and removes excessive agent permissions and maps every agent to a human owner, with an alert when that owner leaves. Posture assessment runs continuously and is aligned with the NIST AI Risk Management Framework. It also discovers the individual tools an agent calls, such as Jira MCP server calls, and maps the path from the agent to the data and APIs it reaches.
How It Works
Veza connects to identity systems, cloud providers, data systems and on-premises applications through agentless, read-only integrations. Nothing is installed in the target systems.
| Component | What it does |
|---|---|
| Access Graph | Data from each integration is modelled in a graph that maps identities through roles and groups to resources and the actions they permit. |
| Open Authorization API | Veza OAA connects any custom or homegrown application, and generic connectors handle CSV upload, LDAP, SCIM and database backed apps. |
| Tenant isolation | Each customer runs in an isolated tenant with no external access by design. |
Identities And Systems Covered
| Human identities | Employees, contractors and other third parties |
|---|---|
| Non-human identities | Service accounts, keys and secrets, including deploy keys, Lambda functions and data platform service principals |
| AI agents | Agents built on AWS Bedrock, Azure AI Foundry, Copilot Studio, Google Vertex AI, Salesforce Agentforce and the OpenAI Agent Platform, as well as ServiceNow agents and Claude Code |
| MCP servers | Connections from agents to some 2,000 public MCP servers |
Agentic AI Capabilities
Access AI
Access AI adds generative AI to the whole platform, including natural language Access Search, AI-driven Access Intelligence dashboards and role recommendations for access requests. It is offered through early access.
Access Agents
Access Agents are AI agents that carry out identity governance tasks on the Access Graph, built on AWS Bedrock and available in Early Access to selected customers. The first three are:
| Veza Prompt Agent | A conversational interface for questions about risk tied to agents, machines and people |
|---|---|
| Veza Access Search Agent | Plain-language queries that visualise permission relationships for any identity |
| Veza Access Review Agent | Steers reviewers to high-risk items with AI-assisted reasoning |
Integrations
| Area | Integrations |
|---|---|
| Identity providers | Active Directory, Okta, Auth0, OneLogin, Ping Identity |
| Cloud platforms | AWS (including S3 and Lambda), GCP (including BigQuery), Azure (including Key Vault), Kubernetes, Oracle Cloud Infrastructure |
| Data systems | Databricks, Snowflake, MongoDB Atlas, ClickHouse, Elasticsearch |
| SaaS apps | Slack, Zoom, GitHub, Salesforce, Box.com |
| HR systems | Workday, BambooHR, HiBob, SAP SuccessFactors, UKGPro |
| Self managed systems | Jira Server, Confluence Server, Microsoft SQL Server, Oracle DB, Windows Server |
Company Background
| Founded | 2020 |
|---|---|
| Headquarters | Los Gatos, California, United States |
| Founders | Tarun Thakur (co-founder and CEO), Maohua Lu (co-founder and CTO) and Robert Whitcher (co-founder and CPO) |
| Leadership | Kane Lightowler, President and COO |
| Funding | A $108 million Series D led by New Enterprise Associates in April 2025 at an $808 million valuation, taking total equity raised to $235 million; other investors include Accel, Blackstone, Bain Capital, Ballistic Ventures, Google Ventures, Norwest, J.P. Morgan and True Ventures, with Atlassian Ventures, Workday Ventures and Snowflake Ventures joining in the Series D |
| Acquisition | ServiceNow announced its intent to acquire Veza on 2 December 2025 and closed the deal on 2 March 2026, when Veza had nearly 150 reported enterprise customers |
| Compliance | GDPR and CCPA |
| Recognition | Included in Frost & Sullivan’s 2025 Frost Radar for Non-Human Identity Solutions; included in the Fortune Cyber 60 for the third consecutive year (October 2025) |
Note: This overview is compiled from Veza’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.