ServiceNow is reportedly in advanced negotiations to acquire Veza, an identity security startup, for over $1 billion. The potential acquisition aims to address a critical need for unified control over AI agents and the data they access within enterprise environments. Veza’s technology specializes in mapping permissions across various enterprise systems, providing visibility into which users, applications, and AI agents have access to specific data, thereby strengthening governance and security for non-human identities.
This move follows ServiceNow’s earlier $2.85 billion acquisition of Moveworks, which added AI assistants and enterprise search capabilities to its platform. By integrating Veza, ServiceNow seeks to provide a robust identity security layer to govern the expanding use of AI agents across IT, HR, customer service, and security operations. The acquisition is expected to help enterprises ensure that AI agents’ permissions align with security policies, mitigating risks associated with autonomous machine actions in business processes.

Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
By late November 2025, ServiceNow was reported to be in advanced or final-stage negotiations to acquire identity security startup Veza for more than $1 billion. The proposed deal is intended to add Veza's authorization and permission-mapping technology to help govern AI agents, APIs, and other non-human identities across enterprise systems.
In March 2025, ServiceNow acquired Moveworks for $2.85 billion, adding AI assistant and enterprise search capabilities to its platform. Later reporting framed the Veza deal as a follow-on move to strengthen governance around those AI capabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cio.com
Open sourcecsoonline.com
Open sourcecio.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.