AI Defense Stack

Agent & MCP security

Veza AI Agent Security: AI agent identity security product

Veza AI Agent Security is an AI agent identity security product from ServiceNow. It is a commercial product offered as: SaaS. Pricing model: not published.

  • Last reviewed
Visit Veza AI Agent Security (opens in a new tab)
Commercial Layer 7: Agent and tool access

Best for

  • Identity and access teams that want to treat AI agents and MCP connections like other identities, with access paths and human owners recorded
  • ServiceNow customers who want agent access findings to open remediation workflows in the tools they already run

Ownership

ServiceNow's Form 10-Q for the quarter ended March 31, 2026 states that it acquired all outstanding shares of Veza Technologies, Inc. on March 2, 2026. Source, checked October 21, 2026: sec.gov (opens in a new tab)

Consider instead if

  • You want runtime policy that allows, blocks or shuts down agents rather than access review. See Zenity.
  • You care most about issuing agents short-lived, just-in-time credentials and rotating leaked secrets, and you are an existing customer. See Astrix AI Agent Security.

What Veza AI Agent Security does

Veza comes at AI agents from identity governance, next to its non-human identity product: the Access Graph maps what each agent, and the model behind it, can reach. The product page lists agent discovery on Bedrock and AgentCore, Azure AI Foundry, Copilot Studio, Vertex AI, Agentforce and OpenAI's agent platform, links to 2,000 public MCP servers such as GitHub's, a blast radius per agent, and removal of excess permissions. A Suggested Owner Agent maps each agent to a human owner and alerts when that person leaves. Fixes can start workflows in ServiceNow, which bought Veza in March 2026, or Jira. Where Astrix centers on issuing short-lived credentials, Veza centers on mapping and trimming standing access, and neither product page describes prompt inspection. The docs need a login and no price is published, though a free trial is offered.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
ServiceNow (Veza) Source, checked October 21, 2026: sec.gov (opens in a new tab)
Status
Active Source, checked October 21, 2026: veza.com (opens in a new tab)
Ownership
ServiceNow's Form 10-Q for the quarter ended March 31, 2026 states that it acquired all outstanding shares of Veza Technologies, Inc. on March 2, 2026. Source, checked October 21, 2026: sec.gov (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: veza.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
SaaS Source, checked October 21, 2026: aws.amazon.com (opens in a new tab)
Pricing model
Not published in the sources we checked Source, checked October 21, 2026: veza.com (opens in a new tab)
Website
veza.com Source, checked October 21, 2026: veza.com (opens in a new tab)
Documentation
Not documented in the sources we checked
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
veza.com Source, checked October 21, 2026: veza.com (opens in a new tab)
Attestations or disclosure
SOC 2 and ISO 27001 certifications, as stated by the vendor Source, checked October 21, 2026: veza.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Veza AI Agent Security fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Veza AI Agent Security covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L2 Discovery Discovery and posture Also covers Documents unified discovery of AI agents and MCP servers across major AI platforms. Discovers AI agents across major AI platforms and connections to public MCP servers in one inventory; Shows access paths from agents and their models to tools, data and systems, and sizes each agent's blast radius; Discovers Copilot Studio agents and third-party agents registered with Microsoft Entra Agent ID

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Veza AI Agent Security, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM06 Excessive Agency Maps what each agent can reach and removes excessive permissions to enforce least privilege. Discovers AI agents across major AI platforms and connections to public MCP servers in one inventory; Shows access paths from agents and their models to tools, data and systems, and sizes each agent's blast radius; Reviews and enforces least privilege for AI agents by removing excessive permissions; Access risk detection flags over-permissioned agents and misconfigured MCP servers, and shows which models and secrets each agent uses; Discovers Copilot Studio agents and third-party agents registered with Microsoft Entra Agent ID

Not mapped in our analysis: LLM01, LLM02, LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Veza AI Agent Security FAQ

Who owns Veza?

ServiceNow. Its Form 10-Q for the quarter ended March 31, 2026 states that it acquired all outstanding shares of Veza Technologies, Inc. on March 2, 2026.

Does Veza publish a price for AI Agent Security?

Not on the product page we opened, which offers a free trial and a demo request.

Is Veza AI Agent Security open source?

No. It is a commercial product, and we found no public source repository for it.

Which agent platforms does it cover?

The product page lists AWS Bedrock and Bedrock AgentCore, Azure AI Foundry, Copilot Studio, Google Vertex AI, Salesforce Agentforce and the OpenAI Agent Platform, plus connections to 2,000 public MCP servers. The data sheet adds third-party agents registered with Microsoft Entra Agent ID.

Key facts you can cite

We have no commercial relationship with ServiceNow (Veza).

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.