30-Second Explanation
Veza is an identity-security company acquired by ServiceNow in a transaction that closed on March 2, 2026. [S36][S45]
Its core value is permission intelligence: understanding who or what can access which resource, through what permission path.
That becomes increasingly important as enterprises add machine identities and AI agents alongside human users.
The Identity Problem
Traditional identity systems can tell an organization that an account exists.
Security teams also need to know:
- what the identity can actually access;
- how that access was granted;
- whether permissions are excessive;
- whether privilege changed;
- whether the identity is human, service account, machine or AI agent.
Veza built an access graph around those relationships.
Why ServiceNow Needed Identity Context
ServiceNow can orchestrate actions, but safe automation depends on permissions.
For autonomous AI:
If the enterprise cannot understand the permission chain, autonomous action creates risk.
Veza + AI Passport
Veza and AI Passport solve related but different problems.
Together they can help answer:
- what an agent currently can access;
- what it should be authorized to do;
- whether runtime behavior remains within scope.
Veza + Armis
Combining both with ServiceNow's business-service context can improve risk prioritization.
An exposed asset with broad privileged access is more urgent than an isolated low-value system.
Strategic Importance
Veza shows that ServiceNow's security expansion is not only about incident response.
Identity is a pre-breach control layer.
As AI agents multiply, identity governance becomes part of the AI platform itself.
Deal Timeline
Permission Intelligence Is Not Just a Directory
An identity directory can tell an organization who an account belongs to. The harder question is what that account can reach through roles, groups, service credentials and application-specific permissions. The answer can be indirect, changing and distributed across systems.
Veza's capability addresses that relationship problem. A useful access graph can make a broad privilege visible where reviewing one application in isolation would miss it. It does not follow that every visible access path is inappropriate. The organization still needs to know which work the identity should perform and which privileges are necessary for it. [S36]
Why AI Makes the Capability More Important
A machine or agent identity can perform work without a human opening an application for each action. That makes scope and continuing authorization important. The identity may need some access to complete its task while being prohibited from unrelated records or actions.
The resulting control problem is not solved by adding an AI label to an existing user account. The deployment needs to understand the available permissions, the tool being invoked and the business context of the requested action. Veza contributes access intelligence; the runtime-control layer has a different job at the moment of execution. [S24][S59]
Integration Tests
Coverage must be explicit
The organization needs to know which systems and identity types the graph represents. An absent relationship may be a true absence of access or a gap in connected information. Those two cases should not be confused.
Recommendation and revocation are different events
Identifying excessive access can support a decision. Actually removing it may require approval and a change in another authoritative system. The workflow should retain the result of that action rather than treat a recommendation as completed remediation.
Asset context remains complementary
Knowing who can reach a resource and knowing the resource's exposure are different kinds of evidence. Connecting them can improve prioritization, but neither makes the other unnecessary. That is the strategic relationship to Armis, not a reason to merge the two capabilities into one undifferentiated security product.
Commercial Meaning
The acquisition expands the kinds of context ServiceNow can connect to workflow and AI governance. Its value depends on reducing uncertainty around a consequential access decision and enabling an appropriate response. A larger graph without an accountable decision process may provide visibility without changing the underlying risk.
The corporate transaction establishes ownership. It does not create a separate publicly disclosed Veza revenue line or prove that every intended identity integration has been delivered. [S1][S4]
Common Questions
Does an access graph automatically enforce least privilege?
No. Intelligence can support the decision, but an authorized change must still be made and verified in the relevant system.
Why This Business Role Matters
Veza gives ServiceNow visibility into the permission structure behind enterprise work.
That capability is strategically important because an autonomous workflow is only trustworthy if the platform understands both the action and the identity authorized to perform it.
Evidence
- The announcement and completion update establish the company relationship. [S36]
- Quarterly reporting corroborates completion. [S45]
- The dated identity-control publication explains the access-intelligence role. [S59]
- AI Passport materials establish the related but distinct runtime-control direction. [S24]