Veza Reviews

My main use case for Veza is identity security and access management, particularly gaining visibility into who has access to critical systems, applications, cloud environments, and our sensitive data. It helps my organization understand and manage access permissions across complex IT environments, making it easier to identify excessive privileges, detect potential access risk, and support security and compliance initiatives.

For example, when reviewing access to a cloud-based application or a sensitive business system, Veza helped security teams determine which users, service accounts, and other identities have permissions to access specific resources. This visibility made it easier to identify unnecessary access, investigate potentially risky permissions, and work with the appropriate teams to ensure that access aligns with each person's responsibility.

Veza has positively impacted my organization by mainly improving visibility into identity access, streamlining access reviews, and helping us identify potential security risks more efficiently. One of the main benefits is having a clear understanding of which users, service accounts, and other identities can access critical applications, infrastructure, and sensitive data. This visibility helps our security team and IT teams to identify excessive permissions, investigate access-related risk, and make better-informed decisions about granting or removing access.

During an access review, Veza helped us understand whether employee or service accounts had permissions beyond what they need to perform their responsibilities and allowed us to prioritize unnecessary access for remediation.

Veza offers valuable features including identity security visibility, access intelligence, permissions analysis, and identity-centric access governance capabilities.

One of its strongest features is the ability to provide a clearer picture of who has access to critical applications, cloud platforms, infrastructure, and sensitive data. I consider this particularly valuable because my organization often operates across multiple environments, making it difficult to understand the full scope of access permissions using traditional identity management tools alone.

Another important feature is its support for access reviews and governance, making access information easier to understand. Veza helps the team review permissions, validate whether access is appropriate for each user responsibility, and support the principle of least privilege.

I consider Veza's AI-related capabilities and identity access intelligence valuable because they help improve the accuracy and reliability of security analysis, particularly when understanding complex permissions and identifying potential access risk.

I wouldn't say major drawbacks, but there are a few minor challenges and limitations to consider. Veza provides significant value for identity security and access governance, but one of the main challenges is the initial implementation and integration process, particularly in organizations with complex environments, multiple cloud platforms, and a larger number of applications.

Connecting different systems and ensuring that identity and permissions data is collected accurately required careful planning, technical coordination, and collaboration between security, IT, and application teams.

Regarding its governance and security, my experience has not been very comprehensive, but the security approach is valuable because the AI-driven security insights need to operate with a clearer framework of access control, accountability, and data protection.

I have been using Veza for the past three years.

We've experienced very minimal downtime or performance issues, so it has been very stable in handling and managing access visibility and governance.

Veza's scalability is an important strength for my organization because it helps us manage identity security across growing cloud environments, multiple applications, and increasingly complex access permissions.

My overall experience with the support team has been very positive and it's an important part of getting value from the platform, particularly because identity security integration can involve complex permissions, cloud configuration, and access relationships that require technical understanding. The support team resolved issues on time.

I would rate the customer support eight out of ten.

We never switched from any previous platform.

Deploying Veza in our AWS environment was relatively straightforward, although it required some initial planning and coordination to ensure that the necessary integrations and permissions were configured correctly.

My experience with Veza's configuration process in our AWS environment was generally positive because the process required some initial planning and technical coordination, but it was manageable and provided a good foundation for improving identity security and access governance.

For the integration part, Veza integrates effectively with our AWS environment by helping to provide visibility into identities, permissions, and access relationships across cloud resources.

We've seen a positive return on investment from Veza, particularly through improved identity visibility, more efficient access reviews, and reduced manual effort in identifying and investigating excessive permissions. One of the main benefits is that our security and IT teams have been able to gain a clearer understanding of who has access to critical applications, cloud resources, and sensitive data without relying entirely on time-consuming manual checks across separate systems. This has helped us streamline access governance and allowed our team to focus more attention on investigating meaningful security risks and resolving access issues more quickly.

My experience with Veza's procurement process was very positive and relatively straightforward, although it required some internal coordination to ensure that the solution aligned with our organization's security requirements, technical environment, and budget.

My overall view of Veza's metering and billing experience is that it's an important part of evaluating the platform's long-term value, particularly for my organization managing complex identity environments across AWS and other enterprise systems.

My experience with Veza's pricing and licensing is best described as a value-focused evaluation with the main consideration being whether the platform's identity security capabilities justify the overall investment.

Before choosing Veza, we considered the capability of existing AWS security tools and other identity security and access governance solutions.

My experience has been very positive overall, and I would rate Veza four out of five. I choose four because it provides valuable visibility into our identity permissions and helps us streamline access reviews, supports compliance efforts, and enables our security teams to identify and address excessive access more effectively.

My advice to any organization considering purchasing Veza is to begin by clearly defining identity security and access governance objectives, then evaluate how the platform can address their specific challenges. Veza is particularly worth evaluating for an organization that needs better visibility into effective permissions across AWS, cloud infrastructure, SaaS applications, and other connected systems.

Public Cloud

Amazon Web Services (AWS)

I manage a couple of use cases through Veza, and one of the very useful use cases is managing team groups. I have given team groups owner access to the managers or owners of the team, and they themselves manage their team by adding or removing people. That team group gets synced with Active Directory, and then Active Directory syncs with Okta. Based on the Okta group, there are multiple application assignments, so in short, whatever application access is needed, the owner or manager of the team can decide from Veza. This is a very useful use case, and I can say it's a self-driven portal to manage access by the manager or team owners.

Another use case involves detecting orphan accounts in downstream systems. I have integrated Veza with multiple systems, including cloud environments such as AWS, GCP, and Azure, as well as Active Directory and Okta integrations. I have integrated many SaaS products, on-premises infrastructure, and platforms with Veza, and my source of truth for users is Workday. Veza checks if the user is present at the source system and similarly checks whether the same user is present at the target system. Sometimes a user gets terminated from the source system when the user leaves the company, but many times their access is still present on the target system, such as AWS, Okta, Slack, Google, or PagerDuty. This is not only a compliance issue but also a company security issue as well as a licensing issue. If the user is already terminated but is not terminated from the target system, then it consumes the license, which directly impacts the cost. Veza helps by continuously checking with the target system and the source system. If the user got terminated or deleted from the source system, it checks whether they are still present on the target system and generates alerts based on that. This helps a lot from a compliance perspective, security perspective, and license perspective.

Earlier, team management or group management was ticket-based. When a new member got added to the team, the owner or manager had to raise an HR ticket to add the member to Workday. The Workday team would manually add that member, which was a time-consuming process. Once I implemented Veza, the owner and manager have access to manage their teams and add or remove people. If any user's or member's job role changed, the manager or owner has the capability to move them from the team.

Compliance has positively impacted my organization as the auditor and stakeholders are very happy and have a very good user experience. The productivity of the engineers has also increased because from day one, or at the time of joining, the engineer gets access to whatever they need, enabling them to start working right away. I can say that Veza is useful and helps my company from the productivity side, compliance side, security side, and cost-effective side.

For time-saving, the manager or owner of the team can manage the access of their team. If anyone is going to join the team, earlier they would have had to raise a ticket and it was a time-consuming process, but once they manage their team's access independently, they don't need to go through a lengthy process. They can manage access within zero minutes, and that team member will have access instantly. This is a very time-saving process, and from a compliance and audit perspective and security perspective, I have given the example of the orphan account where the user is terminated from the company, but their access is still present on the target system, which was not getting detected earlier. Someone manually had to check it. This process saved significant manual time, and as I can have compliance from day zero, I can go ahead and terminate access from the specific target system. For the cost perspective, as I am terminating or eliminating access from day one or day zero once I get the alert, it saves the license and releases it, which reduces the cost. Another feature of Veza is that if any user or any resource is not getting used for, say, 90 days, and their access or that resource is still present at the target system, I can say it's a stale or idle resource. Veza alerts on this and suggests removing that license, which again helps to reduce cost.

The best feature is that there are many out-of-the-box integrations into Veza, so I don't need to have domain knowledge of Veza. I can just open Veza portal, and it's plug-and-play. I get the out-of-the-box integration by just clicking there, filling in some input details, and having the integration in place within a couple of minutes. That's a very amazing feature provided by Veza.

The out-of-the-box integration saves a lot of time because, for example, when I want to integrate Atlassian with Veza, I just go on Atlassian, create one service account, create a token, and come to Veza, giving the Atlassian endpoint URL, the user service account username, and token, and connect with Atlassian. The integration is in place with this very less time-consuming activity, and my team is very happy about that. In one dashboard or one place, I can see all the company's identity. For example, if I want to check which level of access a specific user has on which system as an auditor or for compliance, I can easily go on Veza and have visibility from one platform to all areas. If I click on the user, then I can see which account access that particular user has, such as AWS. On AWS, there's deep-level visibility about what S3 buckets they have access to and what major resources they access to, which can also be drilled down. That is a very good feature.

In Veza, there is some scope for improvement, as I can see that custom integration is not easy. When any application does not have an out-of-the-box integration template present, having the custom integration is a very tedious or difficult task. It's not easy or user-friendly, so if that feature gets increased, or if Veza has multiple out-of-the-box integration templates, that will be very useful.

For improvement, I provided one of the examples. If Veza had more out-of-the-box integrations and made the custom integration process as easy as possible, that would be very useful for integration. New users can handle it easily.

I have been using Veza for my organization's identity for two years.

Veza is stable.

As I am using a SaaS service, I have around 10,000 users onboarded with more than 100 integrations with Veza, and I have not found any latency or capacity issues, so I can say it's very scalable on the back-end side.

Their customer support is very active, and I can say they are proactive and help me whenever I require assistance.

I would rate Veza an eight out of ten.

I chose eight out of ten because I provided a couple of examples of how it helps from different angles, and the remaining two points are because I feel some improvements are needed, such as the example I gave about the integrations.

My advice for others looking into using Veza is that if they want their identity to be very strong, compliant, and time-saving, I would advise the new purchaser to go with Veza. It's a very nice tool and the integration is very useful.

Public Cloud

Amazon Web Services (AWS)

My main use case for Veza is to use it for authentication and to determine who can access what and what can be accessed by the system or organization users. We set permissions for cloud platforms across the organization to our database and other tools using Veza, managing who can access the data, what they can access such as user roles and resource permissions.

The best features Veza offers in my experience are access visibility to see who can access what and which parts, relationship mapping of a user to roles, policies and resources, and risk detection such as over-permission and unused permission privileges. I can perform audit compliance using those features and the platform supports multiple platforms.

Out of those features, I find risk detection to be the most valuable in my day-to-day work because I can check who has over-permission or unused permissions and understand relationship mapping and access visibility.

Veza has positively impacted my organization by improving access for our users, allowing us to check the user and perform auditing for our system or organization. We are now able to implement least privilege practices, which has made our organization and system more secure.

Veza can be improved as it is currently not suitable for small projects due to its high cost, complex setup, and requirement for more integration with multiple systems. Additionally, there are no enforcement tools available, only visibility and insights, which I would like to see improved.

I have been using Veza for six to seven months.

In my experience, Veza is stable.

Veza's scalability is good.

The customer support is good.

We have not previously used a different solution.

I have seen a return on investment as fewer employees are needed because we are now able to manage access using Veza, which has made our work easier.

My experience with pricing, setup cost, and licensing is that the pricing is much higher and the setup is very complex.

Before choosing Veza, we decided to evaluate other options but selected Veza because of the ratings and reviews.

My advice to others looking into using Veza is that if they want to manage their system organization's access and policies, perform mapping from user to policy and resource, detect the risk for users' over-permissions and unused permissions, and audit multiple supported platforms, they should consider using it. I would rate this product an 8 out of 10.

Public Cloud

Amazon Web Services (AWS)

We are currently in the implementation stages of Vanta. It's been challenging to build out as it is not as intuitive as OneTrust, especially in terms of scoping and needs.

Vanta has made the security questionnaire process much easier, thanks to AI. It automatically extracts answers and populates them within the SIG. 

The custom control framework allows me to incorporate our HITRUST controls and additional ISO twenty-seven thousand and one and financial controls.

Moreover, it includes a knowledge bank for questionnaires and RFPs, making information updates more streamlined.

The most valuable features of Vanta are the custom framework option and the support services. It's the only current GRC vendor with licensing rights for HITRUST 11.3 framework, and I've avoided expensive HITRUST licensing costs through a custom control framework.

The support experience could be better. We often need to escalate our issues to the account executive to receive a response, especially when support is needed for integrations.

We started using Vanta about three months ago.

So far, I would rate the stability of the product as ten out of ten, with no issues in that regard.

In terms of scalability, I would rate it better than OneTrust, giving it an eight out of ten. It accommodates small, lean teams or larger public organizations, providing a holistic view of compliance without being limited by capacity.

Although I've read that others have had issues with Vanta's support, our experience involves having to escalate matters to our account executive to get a response. 

The support team itself has been less responsive, which can be problematic when integrating and building out the platform.

Neutral

The overall price point of Vanta is commendable, especially considering the custom control framework that allows me to evade the high costs associated with HITRUST licensing.

The test feature of Vanta is great, making it a recommendable product to others.

I'd rate the solution eight out of ten.