June 2025 Summaries

SailPoint is a widely adopted identity governance tool in many large enterprises, known for managing access certifications, provisioning workflows, and policy enforcement, but it often faces challenges with visibility gaps, especially in systems not directly connected to its provisioning path. As cloud sprawl and shadow IT expand, traditional Identity Governance and Administration (IGA) systems like SailPoint struggle to keep up with the evolving landscape, leading to governance gaps. Veza steps in to augment SailPoint by providing real-time visibility into permissions across all applications, including those disconnected from the provisioning path, thereby addressing these blind spots. In practice, Veza has enabled organizations to uncover shadow IT access, enforce Segregation of Duties (SoD) controls, and gain a comprehensive, real-time view of access risk without replacing existing systems. This collaboration between SailPoint and Veza facilitates identity maturity by ensuring policies are effectively enforced across all environments, reducing audit fire drills, and giving leadership a clear view of governance effectiveness.

Identity Governance & Administration (IGA) is evolving, with modern demands pressing organizations to move beyond legacy systems that, while adequate for past needs, fall short in addressing today's complex requirements such as cloud-native applications and non-human identities. The shift towards advanced IGA platforms like Veza reflects the need for integrated, real-time capabilities, including identity lifecycle alignment, permission-level visibility, and agile integrations to enhance security and governance. These platforms offer UI-driven workflows, access profile intelligence, and democratized visibility, enabling organizations to automate processes, minimize standing privileges, and facilitate proactive risk-based certifications. The transition is not merely a reactionary upgrade but a strategic enhancement to meet the dynamic landscape of identity security, accommodating both human and non-human identities across various systems.

Modern businesses face the challenge of managing vast amounts of data, with many organizations handling hundreds of petabytes. Data governance tools play a crucial role in ensuring data quality, security, and compliance, helping organizations make informed, data-driven decisions. These tools manage data through policies, processes, and responsibilities, focusing on key pillars such as security, lifecycle management, quality, stewardship, metadata management, and regulatory compliance. Various platforms, like SAP Master Data Governance, Atlan, and Collibra, provide solutions for data governance, offering features like access control, metadata management, and automated workflows. However, data governance alone may not suffice, necessitating tools like Veza that offer comprehensive visibility and control over access permissions, thus reducing risks associated with over-permission roles and enhancing compliance. Veza integrates with existing systems, simplifying role-based access control and providing a unified view of permissions across cloud and on-premise systems, thereby improving security and compliance across various regulatory frameworks.

As identity-related cyber threats grow more sophisticated, securing both human and non-human identities (NHIs) becomes crucial for organizations, necessitating the use of comprehensive identity security software. These solutions manage and automate identity security policies, enforce the principle of least privilege, and include features like threat detection, access management, and continuous auditing. Identity security software encompasses on-premises solutions designed for local infrastructure management and cloud-based solutions that offer scalability and integration with cloud services. Key players in this field include Veza, Okta, Microsoft Entra ID, Oracle Identity Governance, Ping Identity, and others, each offering unique features such as single sign-on, lifecycle management, and identity threat protection. Veza, for instance, provides visibility and control over permissions across various enterprise systems, while Okta and Microsoft Entra ID focus on lifecycle management and role-based access control. Companies typically employ a combination of these tools to ensure robust identity security, streamline compliance, and maintain a strong security posture.

Privilege abuse by insiders remains a significant challenge for security teams, who often lack visibility into who can access sensitive data and what they can do with it. The integration of Veza and CrowdStrike Falcon aims to address this issue by combining real-time detection and access intelligence. CrowdStrike Falcon offers real-time detection of identity-based anomalies, such as logins from unexpected locations or privilege escalation attempts, while Veza provides context by mapping users' access footprints and identifying potential risks. This integration enables security teams to automate responses, such as revoking risky permissions and conducting access reviews, significantly reducing the time needed to detect, contain, and remediate threats. The streamlined workflow ensures that security teams can act swiftly, moving from detection to action in just minutes and preventing data breaches by insiders.

Veza is a solution that addresses the issue of "disconnected apps" in enterprises, which are applications that manage their own access and operate with little to no oversight. These apps often pose a compliance risk because they can't be governed by traditional Identity Governance and Administration (IGA) tools. Veza brings next-generation access governance to disconnected apps using Open Authorization API (OAA), providing visibility and control over users, entitlements, resources, and permissions. It helps teams onboard dozens of disconnected apps in weeks, without requiring connectors or custom integration work, and enables automation of user access reviews, real-time permission monitoring, effective permissions mapping, segregation of duties violations detection, and more. Veza is designed to shift left on governance by bringing engineering to IGA, making it a proactive and pervasive approach to consistent governance across applications.

Veza Role Engineering is a modern approach to role governance that helps security teams transform bloated, manual, and brittle RBAC models into streamlined, scalable access controls built for least privilege. It's designed to address common failure patterns in traditional RBAC, such as role creep, stale entitlements, convoluted hierarchies, and redundant or overlapping roles. Veza's Role Engineering capabilities use automated insights, data-driven recommendations, and a unified access graph across cloud, on-prem, and SaaS environments to provide features like role analytics, role mining, and role engineering, which help identify inefficiencies, optimize role structures, automate smart access decisions, and empower business teams to review and manage access. By adopting Veza's Role Engineering approach, organizations can enforce least privilege at scale, boost audit readiness, modernize role modeling, go hybrid with confidence, reduce operational overhead, and achieve real-world results with fewer tickets and faster decision-making.

Microsoft Defender for Identity (MDI) detects suspicious activities in service accounts, while Veza provides access governance capabilities to ensure these accounts follow the principle of least privilege. Together, they offer a comprehensive approach to service account security, combining detection and prevention into one unified system. MDI flags abnormal activity, while Veza ensures visibility into where service accounts have access across systems, apps, and cloud environments. This integration enables proactive management of service account risks, preventing privilege escalation and lateral movement. By leveraging MDI's behavioural analytics with Veza's access governance, organizations can secure their service accounts and stay ahead of emerging threats.

Veza Actions is an operational muscle that automates identity decisions at scale. It powers critical access use cases, including privileged access monitoring and service account governance. Veza Actions transforms identity security from a passive control mechanism into an active operational engine, enabling real-time remediation for access risks, automated orchestration of identity workflows, and end-to-end visibility, analysis, and enforcement. With platform capabilities like Access Graph, Access Monitoring, Access AI, and Veza Actions, organizations gain continuous visibility, intelligent detection, and real-time remediation—all from a single platform. The solution is purpose-built to operationalize identity security at scale, empowering teams to secure their environments continuously.

Zero Trust is a cybersecurity framework that treats every access request as untrusted until proven otherwise, flipping the traditional implicit trust model on its head. At its core, it means never trusting any connection between a person or device and always verifying connections. This requires organizations to rethink access, verify users and systems every time they request access, regardless of their location. Identity is the cornerstone of Zero Trust, built on multiple pillars but playing a vital role in each of NIST's seven core tenets. Every access decision hinges on knowing who (or what) is trying to gain access and should be allowed. In a Zero Trust model, every data source, system, or service is considered a resource, and identity determines whether it should be accessed at all. Identity includes human identities like work login credentials but also non-human identities such as service accounts, cloud workloads, and API keys. Zero Trust access control goes beyond static permissions and hardcoded roles, using dynamic policy that evaluates not only the identity but also the observable state of the client, requesting asset, and environment around the request. Identity attributes provide real-time context and are key to making smart, conditional access decisions. A strong identity strategy is what turns Zero Trust from theory into action, preventing security incidents, reducing risk, and enabling secure access without slowing down the business. Continuous monitoring and assessment are critical tools that help organizations answer questions about their identities' behavior over time. Secure communication and session management are also essential components of Zero Trust, requiring all communication to be secured regardless of network location and access decisions to be made dynamically based on real-time context. Ultimately, Zero Trust starts with identity and ends with how well you manage, secure, and monitor those identities.

The current digital landscape is characterized by an explosion of machine identities, with ratios as high as 17:1 in some organizations, outpacing human identities. This has created a critical need for transparency throughout the enterprise to ensure security teams can protect what they can see and understand. Achieving visibility isn't just a technical challenge, but also a leadership mandate, requiring CISOs to evolve from security enforcers to business enablers who protect digital operations holistically. The lack of visibility into machine identities poses significant risks, with Roland Cloutier stating that without it, "you're not doing your business any service." Machine identity management is crucial to aligning security with the organization's value creation and adopting a "business operations protection" approach.