January 2025 Summaries

The January product update for Veza Platform includes various enhancements and new features across different products, including Access Intelligence, Access Monitoring, Separation of Duties (SoD), Access Visibility, Access Reviews, Veza Integrations, Lifecycle Management, and Access Requests. Notable updates include the introduction of 1-Step Access Reviews, improved alert management, enhanced monitoring capabilities, streamlined workflows, and new integrations with Qualys and Microsoft Teams. Additionally, there are enhancements to the CSV Manager Role, event subscriptions, and email alerts within the Veza Platform. Individual releases may also include additional bug fixes and performance improvements.

Veza has introduced Access AI, a revolutionary technology that combines the power of Generative AI with its Access Graph and Access Intelligence products. This innovation simplifies how organizations uncover hidden access insights, making it intuitive and user-friendly. Access AI addresses complex identity relationships by leveraging context-driven techniques and domain intelligence to deliver accurate and actionable results. The system is designed to be flexible and scalable, allowing users to express their intent and desired insights using natural language. Veza has developed a unique query language, VQL, which abstracts the complexity of access queries and provides a lightweight, domain-specific approach for filtering and expressions. The execution engine is powered by LLMs, Retrieval Augmented Generation techniques, and LangGraph, enabling users to maximize performance and accuracy across the solution. Access AI's primary objective is to prioritize correctness, ensuring an optimal user experience and providing precise information aligned with the user's intended search parameters. The system has a rich dataset and an agentic framework that enables the development of future AI agents for Veza, providing deep risk insights, monitoring, and alerts, as well as simplifying assessments and interactions with natural language.

In a recent discussion on Veza's Identity Radicals Podcast, Mike Towers and Sam Curry explored the importance of identity security in today's threat landscape. They emphasized that identity is foundational to both security and business agility. The conversation covered various topics including zero trust evolution, where identity has become the core element, and its role as a business enabler beyond just security. Challenges such as managing machine identities and balancing security with user experience were also discussed. The future outlook for identity security was highlighted, mentioning the potential of AI to enhance access decisions and anomaly detection, but also emphasizing the need for foundational processes and education.

The discussion between Mike Towers and Sam Curry highlights the importance of identity security in today's threat landscape, where it is foundational to both security and business agility. Radical thinking is necessary for radical security, as identity governance accelerates digital transformation and SaaS adoption beyond just security considerations. However, managing machine identities, adapting legacy systems, and balancing security with user experience are significant challenges that must be addressed. The future outlook suggests that AI will enhance identity security through better access decisions and anomaly detection, but foundational processes and education remain critical for a secure environment.

Non-human identities (NHIs) are digital credentials that allow devices, applications, and automated systems to operate independently, but they also create new security challenges. Only 15% of organizations feel confident in preventing attacks targeting NHIs, while 69% express concerns about these risks. NHIs are made up of machine identities, service accounts, API models, and more, and managing them is critical for securing machine-to-machine communication and automated processes. NHIs can introduce challenges and risks, such as lack of visibility, monitoring, and governance, risk of compromised credentials, increased high-risk attack surfaces, high volume of non-human identities within organizations, potential for lateral movement within networks, over-permissiveness, inadequate lifecycle management, gaps in traditional security, and increasingly higher requirements for encryption. To secure NHIs, it's essential to find and label them, analyze permissions for least privilege, assign human owners, ensure key rotation, monitor and audit activity in real time, conduct regular access reviews, create new NHIs to fit application needs, and automate your non-human identity security.

The IBM X-Force Threat Intelligence Index 2024 reports a 71% year-over-year increase in attacks using valid credentials, with abusing valid accounts becoming the most common entry point for cybercriminals into victim environments. Privileged access management (PAM) software addresses this risk by restricting access to critical systems and sensitive data, monitoring and logging all privileged activities, and enabling organizations to detect and respond swiftly to unauthorized actions or suspicious behavior. PAM software provides robust features such as access control, privilege sessions monitoring, password management, auditing, and reporting, as well as integration capabilities with existing security tools and IT infrastructure. The best PAM solution for an organization depends on its specific needs, but Veza is a more intelligent access tool that goes beyond traditional PAM solutions, providing a comprehensive view of access across the entire organization, automating time-consuming compliance activities, and ensuring security policies are enforced. The cost of PAM software varies depending on the vendor and the organization's IT environment, security goals, and internal resources. Organizations must choose a PAM solution that meets their needs, integrates quickly with their cloud architecture, provides granular resource access control, and connects to any enterprise system.