Identity security platform
Know exactly who has access to what.
Veyra connects your directory, cloud and SaaS apps, draws every path from a person to a system, and hands each risky path to the one owner who can close it.
- 14 min
- to first graph
- Read-only
- connectors
- 140+
- apps mapped
A. Okonkwo still has admin access to production.
Moved to the Data team in February. Not used since.
Who
AOA. Okonkwo
Moved to Data team
Signs in through
OOkta
eng-admins group
Reaches
AAWS
halden-prod
With access to
Unused 91 daysprod-admin
38 resources
Security and IT teams at 46 companies review access in Veyra.
- HALDEN
- northline
- Sable Health
- KITE/
- Bramble & Co
- orrio
01 · Standing privilege
Admin rights expire when the work does.
Veyra reads last-use from the cloud and the app itself. Any privileged role idle past your threshold becomes a finding, with the person who granted it.
- Thresholds per system, set once
- Last use read from audit logs
- Closes through the identity provider you already run
Days since last use
Threshold 90dprod-admin
AWS
91d
billing-owner
Stripe
12d
org-admin
GitHub
118d
warehouse:write
Snowflake
64d
super-admin
Okta
3d
payroll:view
HRIS
104d
3 roles over threshold · owners notified
Close 3 roles02 · Third parties and machines
Vendors and bots sit on the same graph as your people.
Every outside identity gets a human owner and an end date. When a contract ends, Veyra closes every door that firm still holds, including the service accounts it left behind.
| Identity | Type | Owner | Access | State |
|---|---|---|---|---|
| Northline | Vendor | Finance · R. Patel | Billing read | Healthy |
| ledger-bot | Service account | None | Warehouse write | No owner |
| J. Hale | Contractor | People · D. Mensah | HRIS, payroll view | Expired 1d |
| Kite Studio | Agency | Marketing · L. Chen | CMS editor | Renews in 12d |
| ci-deployer | Service account | Platform · S. Ito | Deploy to prod | Healthy |
Q4 review · by owner
75%
complete on day 3 of 14
Evidence log
- 09:14T. Reyes closed prod-admin for A. OkonkwoAWS · written to audit trail
- 09:16R. Patel kept invoices:read for Northline, 90dBilling · written to audit trail
- 10:02S. Ito assigned owner to ledger-botGitHub · written to audit trail
- 10:40D. Mensah closed HRIS access for J. HaleHRIS · written to audit trail
03 · Reviews that finish
The review arrives already sorted by owner.
Each approver gets only the paths they can judge, with usage beside them. Every close, keep or reassign is written to the audit trail as it happens, ready for the control test.
Built for the team that has to defend the answer.
Veyra is designed around one question an auditor, a board or an incident will ask: who could reach this system, and who decided they should.
- 01
Read-only by default
Connectors observe. Changes go through your identity provider, with approval.
- 02
A graph in an afternoon
Directory, cloud and the top fifty apps on day one. The rest arrive weekly.
- 03
Evidence as a side effect
Every decision lands in the audit trail with approver, time and system.
- 04
Priced per identity
Machines and vendors count. Console seats are free for every reviewer.
Use cases
One graph, four teams.
Security
Find the standing admin rights an attacker would use first, ranked by blast radius.
Weekly risk digest
IT operations
Joiner, mover and leaver events that reach every app, including the ones outside SSO.
Leavers closed in 4 min
GRC and audit
Quarterly certification with evidence written as decisions happen.
SOC 2 CC6 evidence
M&A integration
Map an acquired company’s access before you merge directories.
Day-one access map
Illustrative outcome · Halden
41%
fewer standing admin rights in one quarter, with no freeze on engineering releases.
Standing admin roles, month end
“Our access review used to be a spreadsheet nobody finished. Now each owner gets ten paths on Monday and the audit evidence writes itself.”
See every open path in your directory by Friday.
Connect read-only. We walk your security lead through the graph and the first ten findings on a 30-minute review.