Veza

Overview

Veza builds an access graph that maps identities to the data and systems they can actually reach, framing identity governance (IGA) around effective permissions rather than the roles nominally assigned. Founded in 2020, it targets the question security teams most struggle to answer across a sprawling estate: who can truly access what, and how.

ServiceNow announced the acquisition on 2 December 2025 and closed it on 2 March 2026 for approximately 1.2 billion dollars, substantially in cash. The access graph now backs ServiceNow AI Control Tower, governing what AI agents can reach. Veza sold well as a neutral visibility layer over an incumbent such as SailPoint or Saviynt, and that neutrality is harder to hold inside a platform with its own governance ambitions. Check licensing at renewal: see the news item.

What it is good at

The authorization graph is the standout. Veza resolves the real, effective permissions an identity holds across cloud, SaaS, and data stores, cutting through nested roles, groups, and policies to show actual access. That precision is excellent for access intelligence, least-privilege cleanup, and evidence-grade certifications, and it covers non-human and service identities that traditional IGA often misses.

Where it falls short

Veza is more an intelligence and governance layer than a full provisioning engine, so teams wanting joiner-mover-leaver provisioning and a complete lifecycle in one product usually pair it with a provisioning IGA rather than replace one. It is an enterprise tool with quote-based pricing, not a lightweight or low-cost option, and authentication and MFA are outside its scope by design.

Pricing

Enterprise subscription, quote-based. Model it against full-lifecycle IGA suites with the TCO calculator.

Best for, and who should look elsewhere

Choose Veza when deep, cross-system access visibility is the priority. For the full lifecycle, compare Veza vs SailPoint and SailPoint vs Saviynt; for modern access reviews and JIT, see ConductorOne.

Bottom line

A leading choice when precise visibility into effective access is the priority, typically complementing rather than replacing a provisioning IGA.