Short answer: Pick SailPoint for a complete identity governance lifecycle. It wins on connector breadth and audit-ready compliance across large, mixed estates.
Pick Veza if visibility is your pressing gap. It shows who can actually do what inside cloud, SaaS and data systems.
One caveat changes everything in 2026. ServiceNow completed its acquisition of Veza on 2 March 2026. You are no longer buying from an independent startup.
That last point deserves a moment. Most comparison articles still describe Veza as a venture-backed challenger.
They are out of date. Treating a ServiceNow business unit like a Series D startup will skew your risk assessment badly.
The 2026 context you need before you shortlist
Both vendors changed hands recently, and both changes matter commercially. Here is the current state of play.
| Factor | Veza | SailPoint |
|---|---|---|
| Founded | 2020, by Tarun Thakur, Maohua Lu and Rob Whitcher | Austin, Texas; founder-led by CEO Mark McClain |
| Ownership | Acquired by ServiceNow; deal closed 2 March 2026 | Public company, Nasdaq: SAIL, since February 2025 |
| Last independent valuation | $808M at its $108M Series D, April 2025 | Taken private by Thoma Bravo in 2022, then re-listed |
| Scale signal | Nearly 200 customer organisations | Total ARR of $1.231B as of 31 July 2026 |
| Recent tuck-in | Folding into the ServiceNow AI Control Tower | Acquired Entro Security, June 2026 |
SailPoint reported ARR of $1.231 billion, up 25% year over year, in its fiscal Q2 2027 filing. SaaS ARR reached $847 million.
Veza raised $108 million in April 2025 at an $808 million valuation. ServiceNow then agreed to buy it in a reported $1 billion deal.
Let's correct a myth first
Identity vendors love one statistic: credentials cause nearly every breach. The 2026 data tells a more interesting story.
Verizon's 19th Data Breach Investigations Report analysed over 22,000 breaches across 145 countries. Vulnerability exploitation became the top initial access vector at 31%, overtaking credentials for the first time.
Read the second bar carefully. Counted across the full breach chain, credential abuse appears in 39% of breaches. That beats every other technique.
So identity tooling is not the whole answer, and it is not optional either. Attackers may enter through a flaw, but permissions decide the blast radius.
Architecture: the difference nobody explains well
This is where the two products genuinely diverge. Everything else follows from it.
Veza starts with permissions
Veza built a patented Access Graph. It ingests authorisation metadata and answers one question: who can take what action on what data?
- Maps effective permissions, not just group membership
- Reaches into data systems such as Snowflake, Databricks and cloud object storage
- Supports 325+ integrations
- Adds Access Reviews, Lifecycle Management and Separation of Duties on top
- Covers non-human identities and AI agent security as first-class products
SailPoint starts with the identity lifecycle
SailPoint models a person, then governs their access from joining to leaving. Breadth of connectivity is its structural advantage.
- Offers connectivity to over 1,100 applications, per its SEC filing
- Customers have connected over 20,000 custom applications using that same library
- Splits into Human Fabric and Agentic Fabric product lines
- Still supports IdentityIQ on-premises for regulated estates
- Counts 51% of the Fortune 500 and 26% of the Forbes Global 2000 as customers
Do not treat that chart as a scoreboard. A single deep integration into your core ERP often beats 300 shallow ones.
Feature comparison at a glance
| Capability | Veza | SailPoint |
|---|---|---|
| Core model | Authorisation graph of effective permissions | Identity lifecycle with governed entitlements |
| Access reviews | Yes, with permission-level context | Yes, mature certification workflows |
| Joiner-mover-leaver | Yes, via Lifecycle Management | Yes, the original core strength |
| Data system visibility | Strong — a defining feature | Available via Data Access Security |
| Non-human identities | Dedicated NHI Security product | Agentic Fabric, plus Entro acquisition |
| AI agent governance | AI Agent Security; ServiceNow AI Control Tower | Agentic Business and Agentic Business Plus suites |
| On-premises option | No separate legacy product | Yes, IdentityIQ |
| Self-serve trial | Demo request | Free SailPoint Discovery Tool trial |
What each platform actually costs
Here is the honest version. Neither vendor publishes list pricing, so anyone quoting exact per-seat figures is estimating.
Be sceptical of pricing pages. We found third-party benchmarks that disagree with each other by more than 100% for the same product. Treat all of them as negotiation context, never as a budget.
| Cost factor | What is verifiable |
|---|---|
| Pricing model | Both quote per managed identity, plus modules and term length |
| Published list price | Neither vendor publishes one |
| Third-party estimate A | $60–$90 per identity per year list, $30–$55 effective after discount |
| Third-party estimate B | $6–$9 per identity per month, which implies $72–$108 per year |
| Implementation | Commonly cited at 30–60% of year-one spend for SailPoint |
| Scope creep risk | Identity counts grow as contractors and service accounts get governed |
That last row is the one that bites. Contracts get sized for employees, then service accounts and AI agents arrive.
SailPoint's Agentic suites include a starting allotment of five non-human identities per human identity. Model that ratio against your own environment before you sign.
How the market rates them
Third-party recognition leans clearly toward SailPoint, largely because of tenure and installed base.
- Named a Leader in the IDC MarketScape for Integrated Solutions for Identity Security, 2025
- Recognised in the 2026 Gartner Peer Insights Customers' Choice for IGA
- Ranked first by revenue in IGA per Gartner Market Share: Security Software, Worldwide, 2024
- Top ratings across the KuppingerCole Leadership Compass for Access Governance, 2024
Veza's evidence base is younger but credible. Its customer list includes Blackstone, Snowflake, Wynn Resorts, Expedia and CrowdStrike.
On PeerSpot, SailPoint holds 9.2% mindshare against Veza's 1.6%. Notably, 100% of reviewing Veza users said they would recommend it.
Choose SailPoint if these describe you
- Auditors expect a recognised, long-established IGA platform on your architecture diagram
- You operate in financial services, healthcare or government with heavy certification duties
- Your estate mixes mainframe, on-premises and SaaS, so connector breadth decides the timeline
- You need joiner-mover-leaver automation as the primary outcome
- You want one vendor for human, machine and AI agent governance
- Your programme runs three to five years and vendor stability outweighs novelty
Choose Veza if these describe you
- You already run an identity provider and need intelligence layered on top
- Your crown jewels sit in Snowflake, Databricks, S3 or similar data systems
- You cannot currently answer who can read a specific sensitive table
- Access reviews pass on paper but you do not trust the underlying data
- Your organisation already runs ServiceNow and wants that consolidation
- Least privilege, not lifecycle automation, is the board-level ask
Honest risks on both sides
Every comparison that lists only strengths is selling something. Here are the real trade-offs.
| Concern | Ask Veza | Ask SailPoint |
|---|---|---|
| Roadmap | What stays standalone post-ServiceNow? | How do Standard customers reach agentic features? |
| Commercials | Will pricing move to ServiceNow terms? | What triggers identity-count true-ups? |
| Delivery | Who implements without a ServiceNow contract? | What is the realistic services cost? |
| Coverage | Which of my systems lack an integration? | How deep is each connector, really? |
Ask those eight questions in your first vendor call. The answers will separate the shortlist faster than any feature matrix.
A practical evaluation sequence
- Inventory first. Count human, service and agent identities before requesting quotes.
- Pick three hard systems. Choose your messiest applications, not the easy SaaS ones.
- Run a scoped proof of concept. Require both vendors to connect those same three systems.
- Time the first access review. Measure days to a defensible, evidence-backed certification.
- Price year three, not year one. Model identity growth of 30% or more.
- Test the exit. Confirm how you export entitlement data if you leave.
Step four separates demos from reality. A platform that looks elegant in a sandbox can stall on one legacy system.
Automation is reshaping this whole category, which we cover in how technology is making security compliance seamlessly integrated. Identity tooling is only one layer of a wider control set.
Frequently asked questions
Is Veza still available after the ServiceNow acquisition?
Yes. Veza continues to operate its platform and product line under ServiceNow ownership. The deal closed on 2 March 2026, and Veza is being integrated into the ServiceNow AI Control Tower.
Which is better for a mid-sized business?
Both target enterprise budgets, so neither is a natural mid-market fit. If you have fewer than roughly 1,000 identities, evaluate lighter IGA tools first.
Can Veza and SailPoint run together?
Yes, and some organisations do exactly that. SailPoint handles the lifecycle while Veza supplies permission-level visibility into data systems.
Do either handle AI agents?
Both do now. Veza ships AI Agent Security, while SailPoint sells Agentic Business suites and acquired Entro Security in June 2026.
How long does implementation take?
Neither vendor publishes a standard timeline, because it depends entirely on connector complexity. Insist on a reference customer with an estate like yours.
Which one is cheaper?
Nobody can answer that honestly without your identity count and module list. Both price per managed identity and both negotiate.
The bottom line
SailPoint is the safer institutional choice, backed by $1.231 billion in ARR and 1,100-plus connectors. It wins on governance depth, audit credibility and estate coverage.
Veza is the sharper diagnostic tool. If your real problem is not knowing who can reach your data, its Access Graph answers that faster.
Choose based on which sentence describes your Monday morning. Are you failing audits because provisioning is manual, or because nobody can explain your permissions?
Related reading
- Data loss prevention software: safeguarding your business from data breaches
- Why users log in again when switching between web and mobile apps
- Protecting business spaces with advanced entry tech
- How technology is making security compliance seamlessly integrated
Sources
- ServiceNow Newsroom — acquisition announcement and close date
- Veza — Series D press release, April 2025
- SailPoint — fiscal Q2 2027 results, SEC filing
- SailPoint — annual report, connector and customer figures
- Verizon — Data Breach Investigations Report
- SailPoint — suite packaging and non-human identity ratio
- SailPoint — analyst recognition
- SecurityWeek — reported deal value
All figures verified September 2026. Vendor pricing and packaging change frequently, so confirm details directly before purchase.
Short answer: Pick SailPoint for a complete identity governance lifecycle. It wins on connector breadth and audit-ready compliance across large, mixed estates.
Pick Veza if visibility is your pressing gap. It shows who can actually do what inside cloud, SaaS and data systems.
One caveat changes everything in 2026. ServiceNow completed its acquisition of Veza on 2 March 2026. You are no longer buying from an independent startup.
That last point deserves a moment. Most comparison articles still describe Veza as a venture-backed challenger.
They are out of date. Treating a ServiceNow business unit like a Series D startup will skew your risk assessment badly.
The 2026 context you need before you shortlist
Both vendors changed hands recently, and both changes matter commercially. Here is the current state of play.
| Factor | Veza | SailPoint |
|---|---|---|
| Founded | 2020, by Tarun Thakur, Maohua Lu and Rob Whitcher | Austin, Texas; founder-led by CEO Mark McClain |
| Ownership | Acquired by ServiceNow; deal closed 2 March 2026 | Public company, Nasdaq: SAIL, since February 2025 |
| Last independent valuation | $808M at its $108M Series D, April 2025 | Taken private by Thoma Bravo in 2022, then re-listed |
| Scale signal | Nearly 200 customer organisations | Total ARR of $1.231B as of 31 July 2026 |
| Recent tuck-in | Folding into the ServiceNow AI Control Tower | Acquired Entro Security, June 2026 |
SailPoint reported ARR of $1.231 billion, up 25% year over year, in its fiscal Q2 2027 filing. SaaS ARR reached $847 million.
Veza raised $108 million in April 2025 at an $808 million valuation. ServiceNow then agreed to buy it in a reported $1 billion deal.
Let's correct a myth first
Identity vendors love one statistic: credentials cause nearly every breach. The 2026 data tells a more interesting story.
Verizon's 19th Data Breach Investigations Report analysed over 22,000 breaches across 145 countries. Vulnerability exploitation became the top initial access vector at 31%, overtaking credentials for the first time.
Read the second bar carefully. Counted across the full breach chain, credential abuse appears in 39% of breaches. That beats every other technique.
So identity tooling is not the whole answer, and it is not optional either. Attackers may enter through a flaw, but permissions decide the blast radius.
Architecture: the difference nobody explains well
This is where the two products genuinely diverge. Everything else follows from it.
Veza starts with permissions
Veza built a patented Access Graph. It ingests authorisation metadata and answers one question: who can take what action on what data?
- Maps effective permissions, not just group membership
- Reaches into data systems such as Snowflake, Databricks and cloud object storage
- Supports 325+ integrations
- Adds Access Reviews, Lifecycle Management and Separation of Duties on top
- Covers non-human identities and AI agent security as first-class products
SailPoint starts with the identity lifecycle
SailPoint models a person, then governs their access from joining to leaving. Breadth of connectivity is its structural advantage.
- Offers connectivity to over 1,100 applications, per its SEC filing
- Customers have connected over 20,000 custom applications using that same library
- Splits into Human Fabric and Agentic Fabric product lines
- Still supports IdentityIQ on-premises for regulated estates
- Counts 51% of the Fortune 500 and 26% of the Forbes Global 2000 as customers
Do not treat that chart as a scoreboard. A single deep integration into your core ERP often beats 300 shallow ones.
Feature comparison at a glance
| Capability | Veza | SailPoint |
|---|---|---|
| Core model | Authorisation graph of effective permissions | Identity lifecycle with governed entitlements |
| Access reviews | Yes, with permission-level context | Yes, mature certification workflows |
| Joiner-mover-leaver | Yes, via Lifecycle Management | Yes, the original core strength |
| Data system visibility | Strong — a defining feature | Available via Data Access Security |
| Non-human identities | Dedicated NHI Security product | Agentic Fabric, plus Entro acquisition |
| AI agent governance | AI Agent Security; ServiceNow AI Control Tower | Agentic Business and Agentic Business Plus suites |
| On-premises option | No separate legacy product | Yes, IdentityIQ |
| Self-serve trial | Demo request | Free SailPoint Discovery Tool trial |
What each platform actually costs
Here is the honest version. Neither vendor publishes list pricing, so anyone quoting exact per-seat figures is estimating.
Be sceptical of pricing pages. We found third-party benchmarks that disagree with each other by more than 100% for the same product. Treat all of them as negotiation context, never as a budget.
| Cost factor | What is verifiable |
|---|---|
| Pricing model | Both quote per managed identity, plus modules and term length |
| Published list price | Neither vendor publishes one |
| Third-party estimate A | $60–$90 per identity per year list, $30–$55 effective after discount |
| Third-party estimate B | $6–$9 per identity per month, which implies $72–$108 per year |
| Implementation | Commonly cited at 30–60% of year-one spend for SailPoint |
| Scope creep risk | Identity counts grow as contractors and service accounts get governed |
That last row is the one that bites. Contracts get sized for employees, then service accounts and AI agents arrive.
SailPoint's Agentic suites include a starting allotment of five non-human identities per human identity. Model that ratio against your own environment before you sign.
How the market rates them
Third-party recognition leans clearly toward SailPoint, largely because of tenure and installed base.
- Named a Leader in the IDC MarketScape for Integrated Solutions for Identity Security, 2025
- Recognised in the 2026 Gartner Peer Insights Customers' Choice for IGA
- Ranked first by revenue in IGA per Gartner Market Share: Security Software, Worldwide, 2024
- Top ratings across the KuppingerCole Leadership Compass for Access Governance, 2024
Veza's evidence base is younger but credible. Its customer list includes Blackstone, Snowflake, Wynn Resorts, Expedia and CrowdStrike.
On PeerSpot, SailPoint holds 9.2% mindshare against Veza's 1.6%. Notably, 100% of reviewing Veza users said they would recommend it.
Choose SailPoint if these describe you
- Auditors expect a recognised, long-established IGA platform on your architecture diagram
- You operate in financial services, healthcare or government with heavy certification duties
- Your estate mixes mainframe, on-premises and SaaS, so connector breadth decides the timeline
- You need joiner-mover-leaver automation as the primary outcome
- You want one vendor for human, machine and AI agent governance
- Your programme runs three to five years and vendor stability outweighs novelty
Choose Veza if these describe you
- You already run an identity provider and need intelligence layered on top
- Your crown jewels sit in Snowflake, Databricks, S3 or similar data systems
- You cannot currently answer who can read a specific sensitive table
- Access reviews pass on paper but you do not trust the underlying data
- Your organisation already runs ServiceNow and wants that consolidation
- Least privilege, not lifecycle automation, is the board-level ask
Honest risks on both sides
Every comparison that lists only strengths is selling something. Here are the real trade-offs.
| Concern | Ask Veza | Ask SailPoint |
|---|---|---|
| Roadmap | What stays standalone post-ServiceNow? | How do Standard customers reach agentic features? |
| Commercials | Will pricing move to ServiceNow terms? | What triggers identity-count true-ups? |
| Delivery | Who implements without a ServiceNow contract? | What is the realistic services cost? |
| Coverage | Which of my systems lack an integration? | How deep is each connector, really? |
Ask those eight questions in your first vendor call. The answers will separate the shortlist faster than any feature matrix.
A practical evaluation sequence
- Inventory first. Count human, service and agent identities before requesting quotes.
- Pick three hard systems. Choose your messiest applications, not the easy SaaS ones.
- Run a scoped proof of concept. Require both vendors to connect those same three systems.
- Time the first access review. Measure days to a defensible, evidence-backed certification.
- Price year three, not year one. Model identity growth of 30% or more.
- Test the exit. Confirm how you export entitlement data if you leave.
Step four separates demos from reality. A platform that looks elegant in a sandbox can stall on one legacy system.
Automation is reshaping this whole category, which we cover in how technology is making security compliance seamlessly integrated. Identity tooling is only one layer of a wider control set.
Frequently asked questions
Is Veza still available after the ServiceNow acquisition?
Yes. Veza continues to operate its platform and product line under ServiceNow ownership. The deal closed on 2 March 2026, and Veza is being integrated into the ServiceNow AI Control Tower.
Which is better for a mid-sized business?
Both target enterprise budgets, so neither is a natural mid-market fit. If you have fewer than roughly 1,000 identities, evaluate lighter IGA tools first.
Can Veza and SailPoint run together?
Yes, and some organisations do exactly that. SailPoint handles the lifecycle while Veza supplies permission-level visibility into data systems.
Do either handle AI agents?
Both do now. Veza ships AI Agent Security, while SailPoint sells Agentic Business suites and acquired Entro Security in June 2026.
How long does implementation take?
Neither vendor publishes a standard timeline, because it depends entirely on connector complexity. Insist on a reference customer with an estate like yours.
Which one is cheaper?
Nobody can answer that honestly without your identity count and module list. Both price per managed identity and both negotiate.
The bottom line
SailPoint is the safer institutional choice, backed by $1.231 billion in ARR and 1,100-plus connectors. It wins on governance depth, audit credibility and estate coverage.
Veza is the sharper diagnostic tool. If your real problem is not knowing who can reach your data, its Access Graph answers that faster.
Choose based on which sentence describes your Monday morning. Are you failing audits because provisioning is manual, or because nobody can explain your permissions?
Related reading
- Data loss prevention software: safeguarding your business from data breaches
- Why users log in again when switching between web and mobile apps
- Protecting business spaces with advanced entry tech
- How technology is making security compliance seamlessly integrated
Sources
- ServiceNow Newsroom — acquisition announcement and close date
- Veza — Series D press release, April 2025
- SailPoint — fiscal Q2 2027 results, SEC filing
- SailPoint — annual report, connector and customer figures
- Verizon — Data Breach Investigations Report
- SailPoint — suite packaging and non-human identity ratio
- SailPoint — analyst recognition
- SecurityWeek — reported deal value
All figures verified September 2026. Vendor pricing and packaging change frequently, so confirm details directly before purchase.
