ServiceNow is in talks to buy identity security firm Veza for over $1 billion: report

ServiceNow is reportedly in advanced talks to acquire Veza, an identity security startup, for more than $1 billion.

For ServiceNow customers deploying AI agents across their organizations, the acquisition would address a critical gap: controlling what those agents can access and do. Veza’s technology maps permissions across enterprise systems, showing exactly which users, applications, and AI agents have access to what data.

The deal could be announced next week, The Information reported.

The deal would follow ServiceNow’s $2.85 billion acquisition of Moveworks, announced in March. That purchase brought AI assistants and enterprise search capabilities to ServiceNow’s platform. Adding Veza would provide the identity security layer needed to govern those AI systems as they access data across cloud services, SaaS applications, and internal systems.

ServiceNow and Veza did not immediately respond to requests for comment.

Managing machine identities

ServiceNow said in March that it deployed thousands of AI agents for customers across IT, HR, customer service, and security operations. As these agents take on more autonomous tasks, enterprises face mounting pressure to understand what they can access and whether those permissions align with security policies.

“ServiceNow is trying to build an enterprise platform where AI agents don’t just chat, but actually take meaningful actions inside the business,” said Akshat Tyagi, associate practice leader at HFS Research. “Moveworks gave them a strong automation layer, but trust and governance were the missing pieces. Handing over real-time authority to agents unless identity, permissions, and access rules are rock solid is a bluff no enterprise wants to play.”

Veza addresses what security experts call the non-human identity problem. Every AI agent, API integration, and automated workflow creates service accounts and tokens that need management, according to the company. In most enterprises, these machine identities far outnumber human users.

Veza’s Authorization Graph technology maps permissions across systems to show not just who has access, but what they can effectively do with that access. According to its website, the company manages more than 20 billion permissions for customers, including Blackstone, Expedia, and Workday. Veza has raised $235 million since its inception in 2020 and employed more than 190 people as of April 2025.

Tyagi said existing identity and access management tools were designed for human accounts but struggle with machine identities, API keys, and autonomous agents making real-time decisions. “This creates blind spots around privilege sprawl and cross-system access paths,” he said.

The two companies already work together. ServiceNow Ventures invested in Veza in August 2023 alongside Capital One Ventures. The companies have more than 250 joint customers, the report added.

Customer integration questions

For those joint customers, the acquisition would mean significant changes in how the two systems work together. Enterprises using both ServiceNow and Veza today run them as separate systems. Integration would allow ServiceNow’s AI agents to natively query and enforce access policies based on Veza’s permission intelligence, without customers building custom connections.

That integration will take time, according to Tyagi. “ServiceNow is already a big and complex system, and adding a full identity security engine won’t be instant plug-and-play,” he said. Customers should expect changes to licensing and the introduction of new modules as the two platforms merge.

Organizations using Veza without ServiceNow will want clarity on whether the product remains available as a standalone offering. Those using ServiceNow with other identity vendors will need to know if their existing tools remain supported or if ServiceNow will push customers toward its own integrated stack.

ServiceNow unveiled AI agents for security and risk management at its Knowledge 2025 conference in May, positioning them as tools for autonomous enterprise defense. Veza would provide the authorization controls those security agents need to safely investigate and remediate threats across systems.

Veza treats access as a relationship problem, connecting identities, permissions, and data to show effective access rather than just theoretical permissions, according to Tyagi.

Market implications

The acquisition would give ServiceNow a more complete offering against rivals building AI-powered enterprise platforms. Salesforce, Microsoft, and Oracle all offer AI agents, but none had combined front-end automation with identity security in the way ServiceNow was attempting with Moveworks and Veza, according to Tyagi.

“This deal can shake up the identity security landscape because it pulls deep authorization intelligence into a major enterprise platform instead of keeping it as a standalone specialty,” Tyagi said. Standalone identity vendors like CyberArk, SailPoint, and Okta may face pressure to find their own platform partnerships or acquisition targets, he said.