October 2025 Summaries

Veza's notification framework for Access Reviews is designed to streamline and enhance the user access review process at an enterprise level by employing intelligent, multi-channel notifications. This system aims to keep reviewers informed, ensure managers are accountable, and maintain operator oversight, all while minimizing notification fatigue. Notifications are categorized as event-driven, activity-based, or time-based, and can be customized for delivery through multiple channels like email, Slack, or webhooks. The framework includes features such as digest notifications to prevent information overload and alerts for immediate action in high-priority scenarios. Additionally, Veza supports in-application pop-ups for providing guidance and confirmations during review processes. The system offers extensive customization options, allowing operators to tailor communication strategies to organizational standards and compliance needs, ensuring that user access reviews are completed efficiently and on time without manual intervention.

The document discusses the challenges enterprises face in managing user access across numerous applications and the limitations of traditional Identity Governance and Administration (IGA) and IT Service Management (ITSM) systems, which often require costly, custom integrations. It introduces Veza Access AuthZ, a solution designed to automate provisioning and deprovisioning operations across a wide array of SaaS, cloud, and on-premise applications, including legacy and custom systems. By providing a standardized API, Veza Access AuthZ facilitates seamless integration, reduces the total cost of ownership, and enhances security by minimizing manual errors and unauthorized access risks. The tool supports SCIMv2 protocol and offers comprehensive application coverage, allowing enterprises to maintain compliance and improve operational efficiency while achieving true least privilege access. This capability enables organizations to balance productivity and security, ensuring that access is provisioned and revoked efficiently and securely.

The rapid deployment of autonomous AI systems within enterprises introduces complex security challenges that traditional tools are ill-equipped to handle, as these systems can access corporate data, interact with external tools, and execute complex tasks autonomously. The new AI threat landscape includes risks such as training data poisoning, model inversion, and compromised supply chains, where attackers can manipulate or extract sensitive data and infiltrate AI systems via malicious Model Context Protocol (MCP) servers. Existing security frameworks, which are designed for human identities and deterministic workloads, fail to address the unique risks posed by the dynamic and automated lifecycle of AI agents. The concept of least privilege is critical for AI systems to prevent unauthorized access and data breaches, necessitating the development of AI Security Posture Management (AI SPM) tools that can map data pipelines and compute effective permissions using an Access Graph. This graph database approach is essential to map the complex web of permissions across both human and non-human identities, providing a comprehensive understanding of who can access what data within an enterprise.

Insider threats in the cloud era, whether arising from negligence, malicious intent, or compromised identities, present significant challenges that hinge on identity misuse. To address these threats, organizations should implement an Insider Threat Program that emphasizes identity-centric security measures, such as identity inventory and mapping, least privilege access governance, and anomaly detection. By integrating identity security principles with proactive monitoring and governance, organizations can reduce risks and respond rapidly to potential threats. Key strategies include employing tools like Veza Access Graph for identity mapping, implementing Role-Based Access Control (RBAC), using User and Entity Behavior Analytics (UEBA) for anomaly detection, and fostering a security-aware culture through training and cross-functional collaboration. By focusing on identity lifecycle management and data protection tied to identity context, businesses can better safeguard their environments against insider threats.

Veza’s multi-level review capabilities within its Advanced Access Reviews offer a structured approach to user access recertification that enhances security and compliance by requiring sequential approval from different reviewers with distinct perspectives. Unlike simply assigning multiple reviewers to the same item, which can lead to a “first decision wins” scenario, the multi-level review mandates that each reviewer independently verifies access appropriateness, beginning with a Level One (L1) reviewer and followed by a Level Two (L2) reviewer assessing only items that pass the initial review. This process provides a more thorough and defensible evaluation, reducing the risk of rubber-stamping and ensuring that decisions are well-documented and traceable for audits. The approach is particularly beneficial in scenarios involving high-risk, privileged, or sensitive applications, allowing organizations to tailor decision models to their specific risk appetites and operational needs. Through automation and clear notification protocols, Veza streamlines the review process, ensuring that reviewers focus on relevant access items, thereby reducing their workload and enhancing overall accountability.

Non-human identities (NHIs) are critical yet often overlooked components in digital operations, performing tasks such as assuming roles, signing tokens, and interfacing with APIs at high speeds. These identities can lead to security incidents if not properly managed, as their activities might appear as normal operations until a breach occurs. The NHI 2×2 program offers a structured approach to managing these identities, emphasizing four key motions: Visibility, Intelligence, Management, and Remediation, across service accounts, service principals, certificates, and API tokens. This program aims to maintain a current understanding of who can take what actions on what data, ensuring effective control across cloud, SaaS, data, and on-prem environments. By providing tools like Access Intelligence and Access Search, the program facilitates prioritization and resolution of security issues, while Management and Remediation work to enforce least privilege, automate retirement of dormant accounts, and ensure continuous verification to prevent security risks from recurring. The program underscores the importance of a comprehensive strategy for non-human identity management, integrating visibility, control, and remediation into a seamless operation loop that reduces risk and enhances security posture without disrupting workflows.

Veza's risk-based access reviews revolutionize the traditional, static process of access recertification by introducing a dynamic, risk-driven approach, aimed at enhancing security and compliance for identity, security, and audit teams. This system emphasizes continuous, adaptive reviews based on access risk and the principle of least privilege, addressing issues like entitlement creep and unnecessary access while ensuring regulatory compliance. By enabling event-driven on-demand reviews, Veza allows organizations to respond promptly to risky access events, preventing potential security breaches before they escalate. Furthermore, the platform provides reviewers with comprehensive risk context through its Risk Score 2.0 algorithm, empowering them to make informed decisions quickly by highlighting the severity of risks for each access item. This includes detailed insights into privilege levels, potential violations, and user-specific activity data. As a result, Veza Access Reviews offer more than just compliance automation; they serve as a strategic tool for proactive risk management, ensuring real-time enforcement of access hygiene and reducing the attack surface, thereby maintaining continuous protection of critical systems and applications.

Many modern companies manage more machine identities, or non-human identities (NHIs), than human employees, which necessitates effective governance to ensure secure access and prevent breaches. The process begins with creating an access graph that categorizes over 90 types of NHIs to understand their permissions and ownership across various platforms like cloud services, SaaS, and CI/CD pipelines. Effective management includes classifying identities, assigning ownership, and establishing a framework for consistent permission and access review, which helps cut down standing privileges and address security incidents promptly. Machine identities often operate on secrets such as keys and credentials, which require regular oversight to prevent breaches, as seen in incidents like the Dropbox Sign event. Implementing Identity Visibility and Intelligence Platforms (IVIP) helps organizations maintain robust security by providing clear visibility, actionable intelligence, and automation to manage machine identities efficiently. A practical approach involves reviewing credentials, normalizing integration users, and managing incidents with a consistent protocol, ensuring risk reduction without compromising operational speed, as highlighted by case studies involving platforms like HashiCorp Vault.

The Veza August 2025 Product Update introduces significant enhancements in access governance, identity lifecycle management, and collaboration tools, focusing on AI-powered capabilities, compliance controls, and expanded cloud platform coverage. Key features include AI-powered natural language search for query building, advanced lifecycle management with reusable custom attribute transformers, enhanced access governance through team-based dashboard sharing, and improved risk profile classifications for threat prioritization. The update also extends monitoring support to Microsoft Azure, AWS, and other platforms, while enhancing usability with features like streamlined access reviews and intelligent approval workflows. Veza's enhancements aim to provide enterprises with more effective tools for managing complex access challenges, ensuring security, and improving visibility into identity and access risks across various cloud and enterprise environments.

Non-Human Identity (NHI) ownership involves assigning a named human owner to service accounts, API keys, bots, and enterprise applications to ensure that these identities operate with the least privilege, thereby reducing breach paths, simplifying audits, and maintaining delivery speed. This approach results in stronger compliance, lower cybersecurity insurance risks, and higher operational resilience by providing clear accountability for actions taken by non-human entities. Effective NHI ownership requires mapping permissions to a human owner, ensuring continuous governance, and automating processes like rotation and expiry of keys and tokens. Veza facilitates this by offering a comprehensive view of who can take what actions on which data, enabling teams to prioritize and manage the highest risks first. The success of NHI ownership is measured through metrics like ownership coverage, key hygiene, and evidence completeness, which are continually monitored and improved. This model emphasizes the importance of treating every bot and token as accountable identities with documented ownership to maintain security and compliance over time.

The text highlights the evolving challenges in cybersecurity, emphasizing that traditional security strategies focused on building strong defenses are no longer sufficient, as attackers now prioritize accessing networks through compromised credentials rather than exploits. With 79% of attacks being malware-free, identity security has become a critical battleground where adversaries exploit misconfigurations, dormant accounts, and over-permissioned roles, directly affecting an organization's insurability and insurance premiums. The text advocates for a shift from authentication-focused security to authorization-focused security, where monitoring permissions and access rights is essential to mitigate risks associated with privileged access, non-human identities, third-party and supply chain interactions, and toxic combinations of permissions. Veza is presented as a solution that provides visibility and control over access permissions, helping organizations demonstrate a strong identity security posture to insurers and underwriters. This approach is crucial for meeting the demands of the cyber insurance market, which sees identity as the key determinant of insurability, requiring proactive management of identity risks with verifiable evidence to secure better coverage and optimize premiums.

Veza's 2025.7 release introduces a comprehensive suite of enhancements aimed at fortifying identity security by integrating access visibility, intelligence, governance, and automation for diverse identity types, including human, non-human, and agent identities. Key updates encompass improved access monitoring capabilities with advanced filtering and query options, enhanced user experience with configurable access reviews, and expanded lifecycle management workflows that include custom attribute transformer functions and Azure unique identifier support. In addition, the release emphasizes Non-Human Identity (NHI) security with expanded integration support and refined classification logic. New features also bolster integration and security aspects, such as the ability to handle Salesforce guest user profiles, upload CSVs with entity owners, and utilize Azure secret vaults. The update aims to reduce identity-driven breach risks, lower compliance costs, and enhance operational efficiency through streamlined workflows and automated processes.

Light Identity Governance and Administration (Light IGA) is a streamlined subset of Identity Governance and Administration, emphasizing quick implementation and simple administration with basic lifecycle events, provisioning, and access requests. It is designed for rapid deployment in environments needing basic functionality without extensive customization or deep integration capabilities. While it offers significant speed and ease of use for small portfolios or lightly regulated environments, it may fall short in handling complex applications, fine-grained authorization, and non-human identities (NHIs) due to its limited configurability and shallow entitlement models. Light IGA is contrasted with Legacy and Next-Gen IGA, where Legacy offers deep policy but can be cumbersome, and Next-Gen provides full-featured customization and broad integrations. Choosing the right IGA model depends on the specific needs of the organization, with Light IGA being suitable for simpler setups and Next-Gen more apt for complex, regulated environments.