SAN FRANCISCO, March 4, 2026, 02:29 PST
ServiceNow (NOW.N) wrapped up its purchase of identity security specialist Veza, with the deal closing on March 2. The company plans to integrate Veza’s access controls into its Security and Risk suite, aiming to support customers deploying autonomous “agentic AI” systems. “In the era of agentic AI, every identity — human, AI agent, or machine — is a force for enterprise impact,” said President and COO Amit Zavery in the announcement. Veza, launched in 2020 out of Los Gatos, California, counts nearly 150 enterprise clients and employs 230 people, according to ServiceNow. ServiceNow Newsroom
The timing stands out. ServiceNow has flagged that as companies rush into the cloud and accelerate AI rollouts, identities and permissions are ballooning beyond what most can monitor—leaving a growing disconnect between what security teams detect and what they can actually address. In a blog post about the acquisition, ServiceNow pointed out that machine identities now outpace human ones by a factor of more than 80 to 1, calling access sprawl the new normal inside big organizations.
Veza CEO Tarun Thakur called the deal “Day 1,” and said the new group aims to create an “enterprise agent identity control plane” to link up with ServiceNow’s AI Control Tower. Agentic AI, in this context, means software that moves beyond just writing text—it can open tickets, approve tasks, shift data. Both sides argue these agents need stricter, traceable permissions. Veza
ServiceNow registered 854,359 shares on March 2, according to a Form S-8 filing, tied to employee stock options and restricted stock units picked up in the Veza deal. The registration includes Veza’s 2020 and 2025 stock plans, along with a 2025 restricted stock unit plan.
ServiceNow hasn’t released new financial details on the closing, but the company had already spelled out its expectations. Back in January’s annual report, ServiceNow put the Veza acquisition price at roughly $1.25 billion in cash, pending typical adjustments. The deal was set to close during the first half of 2026.
Veza’s main business is identity governance and administration—essentially keeping tabs on who gets access to which systems, managing change approvals, and later satisfying auditors, plus software for flagging users with excessive permissions. ServiceNow thinks dropping those controls directly into its workflow engine could speed up the gap between identifying risky access and cutting it off.
ServiceNow is stepping deeper into the identity space, already packed with players like Okta and CyberArk offering access and privilege controls, while major security suites throw in their own identity tools. What sets ServiceNow apart: it wants identity data to flow straight into workflows—tickets, approvals, remediation—skipping the usual siloed dashboards.
Still, cleaning up identity data isn’t straightforward. Mapping permissions for hundreds of applications gets complicated fast, and automated cleanups sometimes go sideways—lockouts, outages, or conflicts with internal controls if the data or rules miss the mark. Those risks, along with clients’ hesitance to ditch established identity systems, might drag on the cross-sell pitch the deal is supposed to accelerate.
ServiceNow now faces an execution challenge—holding on to Veza’s customer base, keeping its key technical staff on board, and converting identity signals into real actions that security teams actually trust at scale. The company’s bigger wager: identity could end up being the main pressure point for future attackers, as well as for the coming generation of autonomous software.
