Veza

1.1 Identity, Product, and Operating Status

Veza traces its founding to 2020 and identifies Tarun Thakur, Maohua Lu, and Rob Whitcher as its three founders, with current company-page titles of chief executive officer, chief technology officer, and chief architect. The product is an enterprise access platform built around an Access Graph that unifies identities and entitlements across people, machines, third parties, applications, data, on-premises systems, and SaaS. CNBC reported Los Gatos, California, as headquarters in April 2025 and a workforce of 200. A LeadIQ profile instead displayed Valley, Alabama, and a 51-200 employee band, so directory-derived location and staffing fields should not override the dated CNBC report without direct corporate confirmation. By May 2026, ServiceNow described Veza as integrated into the ServiceNow AI Platform, but the assigned evidence does not establish a purchase price, close date, or continuing standalone legal status.[CO001, CO002, CO003, CO005, CO006, CO007, CO015]

1.2 Leadership, Governance, and Key-Person Exposure

Public evidence supports the founders' titles but not a complete, current post-integration management roster or detailed professional biographies for all three founders. Their titles imply concentrated coverage of corporate direction, technical leadership, and architecture, yet the evidence does not quantify succession depth, retention terms, or decision rights. Veza's August 2023 announcement listed Phil Venables as newly appointed to the board, providing one verifiable governance datapoint rather than a complete board enumeration. The company page also lists nine institutional investors, but it does not disclose ownership, voting control, liquidation preferences, board seats, or secondary transactions. This leaves meaningful diligence work around key-person dependence and governance after the ServiceNow integration: the founder roles are visible, while the control framework and current board composition are not.[CO001, CO002, CO013, CO014, CO015]

1.3 Capital History, Scale Signals, and Strategic Transition

Veza emerged from stealth in April 2022 with a company-issued announcement of more than $110 million in funding. Strategic investments from Capital One Ventures and ServiceNow Ventures brought stated total financing to $125 million in August 2023, when Veza also said it had surpassed 125 integrations. In April 2025, CNBC and SecurityWeek reported a $108 million Series D led by New Enterprise Associates; SecurityWeek gave a company valuation of $808 million, while CNBC described just over $800 million including fresh capital. CIO later reported $235 million raised since inception. Revenue remains opaque: CNBC said Veza did not disclose absolute revenue, only that sales more than doubled in the fiscal year ended in January 2025. CIO's November 2025 acquisition report cited discussions above $1 billion but also highlighted integration timing, licensing, and standalone-product uncertainty. Those reported talks are not a substitute for signed transaction terms.[CO004, CO008, CO009, CO010, CO011, CO012, CO016]

1.4 Exhibits

2.1 Market Boundary, Category Taxonomy, and Included Spend

Enterprise identity architecture has reached an inflection point where conventional Identity and Access Management (IAM) systems fail to govern effective permissions in distributed environments. Historically, organizations relied on identity providers such as Okta and legacy directory architectures to authenticate human users and assign broad role-based groupings. However, modern cloud architectures and microservices disaggregate data across disparate cloud service providers, data platforms such as Snowflake, and SaaS business applications. As industry analyst Omdia notes, modern identity security spans three contiguous markets: Identity Security Posture Management (ISPM), Identity Governance and Administration (IGA), and Non-Human Identity (NHI) security. Within this market taxonomy, included software spend encompasses fine-grained authorization mapping, automated user access certifications, toxic combination discovery, service account governance, and machine identity tracking. Conversely, excluded spend includes pure-play authentication endpoints, physical biometric badges, consumer identity verification platforms, and network boundary firewalls. Status-quo substitutes remain widespread: large enterprise security teams frequently attempt to audit permissions using homegrown scripts, manual spreadsheet exports, or static ticketing workflows across ServiceNow and Jira. These status-quo workarounds fail to resolve effective multi-cloud access controls, exposing organizations to excessive privileges, orphaned accounts, and audit deficiencies.[CM001, CM002, CM003, CM004]

2.2 Market Sizing Lenses, Growth Trajectory, and TAM Constraints

Evaluating market sizing for authorization-centric identity security requires decomposing broad cybersecurity estimates into verifiable product categories. Global spending across enterprise identity security and governance represents a rapidly expanding subset of cloud infrastructure protection. While top-down analyst summaries frequently project multi-billion-dollar total addressable markets across broader IAM and data security software categories, bottom-up enterprise adoption reveals critical boundary constraints. Specifically, Veza's addressable boundary concentrates on enterprise environments managing complex hybrid multi-cloud footprints, extensive SaaS deployments, and heterogeneous data lakes. In enterprise environments, machine identities and API service accounts outnumber human staff members, multiplying the volume of managed entitlements. Industry data from Veza's 2026 State of Identity and Access Report indicates that in typical enterprise environments, an average worker holds 96,000 entitlements, 38% of identity provider accounts are dormant, and only 55% of permissions are safe and compliant. Sizing the Serviceable Addressable Market (SAM) is therefore constrained by organizations operating over 300 applications and cloud systems that necessitate automated graph-based authorization translation rather than basic single-sign-on controls. Sizing the Serviceable Obtainable Market (SOM) requires analyzing deployment willingness among Fortune 500 enterprises, regulated financial institutions, and global hospitality chains managing tens of billions of permissions.[CM005, CM006, CM007, CM008]

2.3 Buyer Segmentation, Budget Ownership, and Adoption Workflows

Procurement dynamics in the authorization intelligence market span distinct technical buyers and functional stakeholders. The primary economic buyer is typically the Chief Information Security Officer (CISO) or VP of Information Security, who owns corporate risk reduction, audit defensibility, and regulatory compliance posture. Secondary budget stakeholders include Identity and Access Management (IAM) directors, Cloud Platform and Site Reliability Engineering (SRE) leads, and Data Governance officers. Enterprise case studies, such as Choice Hotels International, illustrate that cloud migration to microservice architectures on AWS creates severe entitlement complexity across distributed data stores. Adoption workflows typically initiate when security and platform engineering teams discover orphaned accounts, unattached policies, or audit-readiness deficiencies that manual reviews cannot remediate. Platforms that ingest metadata agentlessly out-of-band and route policy violations into existing workflow backbones like ServiceNow accelerate initial deployment. However, purchasing authority often fragments between infrastructure engineering teams operating cloud databases and corporate IT teams managing traditional directory access, requiring cross-departmental consensus to finalize enterprise contracts.[CM009, CM010, CM011, CM012]

2.4 Adoption Drivers, Autonomous AI Dynamics, and Market Constraints

Market momentum in authorization governance is propelled by the explosion of non-human identities, regulatory mandates, and enterprise deployment of autonomous AI agents. As organizations deploy AI assistants and automated agents across enterprise systems, machine tokens and automated workflows rapidly multiply. Analysts at HFS Research emphasize that while enterprise automation platforms enable AI agents to execute tasks across customer service and IT operations, autonomous execution requires rock-solid authorization rules to prevent unauthorized enterprise data traversal. Concurrently, regulatory frameworks including GDPR, HIPAA, and Sarbanes-Oxley require verifiable access controls and least-privilege enforcement to mitigate ransomware risks. Despite these tailwinds, material adoption constraints govern deployment velocity. Competitive evaluations by Linx Security point out that passive visibility engines requiring manual query execution can create operational friction compared to automated proactive remediation. Furthermore, the reported $1 billion acquisition of Veza by ServiceNow introduces platform dependency and vendor lock-in concerns for enterprise buyers evaluating multi-year ecosystem commitments.[CM013, CM014, CM015, CM016]

2.5 Exhibits

3.1 Landscape and Buyer Options

The available evidence supports a broad competitive set rather than a single direct peer group. C1.ai, a competitor, names nine enterprise IGA alternatives spanning modern automation vendors, mature governance suites, identity-provider extensions, and PAM-led platforms; Krowdbase separately lists 23 alternatives, but provides little product-level proof. Buyers can therefore choose a focused authorization layer such as Veza, a mature IGA suite, governance bundled with an incumbent IdP, an authentication or PAM specialist, or continued internal tooling. The assigned evidence does not establish reliable funding, revenue, or installed-base figures for those vendors, so the profile table marks scale as unknown rather than using marketing reach as a proxy. This fragmented landscape favors evaluation by control plane and workflow fit, not by a single generic competitor ranking.[CP009, CP013, CP014]

3.2 Capability Boundaries and Differentiation

Veza's public differentiation is its Access Graph: the company says it normalizes identities and entitlements across human, machine, third-party, cloud, SaaS, data, and on-premises contexts, expresses effective permissions in create-read-update-delete terms, and connects through more than 300 agentless read-only integrations. That is a differentiated authorization lens, but not a complete identity control stack. Veza's own Zero Trust guide says the product is not a ZTNA tunnel or SSE proxy, while RFP.wiki scores Veza strongly in authorization governance but weakly in native SSO. The comparison therefore supports a multi-product architecture: Veza can complement an IdP, PAM, or network-access layer rather than displace all of them. These are public product claims and procurement-site assessments, not production benchmarks, so connector depth, remediation quality, and workload coverage still require testing.[CP001, CP002, CP003, CP004, CP005, CP006, CP008, CP015]

3.3 Commercial and Switching Dynamics

Commercial comparison is constrained by uneven disclosure. RFP.wiki reports no public Veza pricing and assigns a 1.4-of-5 Commercial Clarity score. C1.ai publishes list-price assertions for Okta and Microsoft Entra, but those figures come from a competing vendor rather than the vendors' current pricing pages, so they are useful only as directional procurement inputs. Veza's claimed connector breadth may lower initial data-ingestion friction, yet durable lock-in would arise later from normalized permission models, review campaigns, lifecycle policies, remediation workflows, and audit evidence embedded in operations. The pool contains no customer switching study, contract sample, renewal data, or independently measured migration cost. Buyers should consequently compare realized annual contract value, implementation services, connector maintenance, and exit assistance on a common scope before inferring a price or switching-cost advantage.[CP002, CP007, CP011, CP012, CP015]

3.4 Moat Durability and Displacement Risk

Veza's moat appears conditional, not absolute. The Access Graph and integration footprint can create a useful data-model and workflow advantage, especially if buyers need consistent effective-permission analysis across many systems. However, the numerous alternatives identified by two directories show that governance, lifecycle automation, non-human identity coverage, and AI-oriented access controls are contested categories. Veza itself reports an average of 96,000 entitlements per worker in a typical enterprise, illustrating the complexity that can reward a normalized graph while also attracting suite vendors and internal platform teams. A C1.ai page argues that ServiceNow integration will delay the roadmap and create migration risk, but that is a competitor-issued forecast, not independent evidence of an observed delay. Durability therefore depends on verified connector fidelity, remediation outcomes, post-transaction product investment, and renewal behavior, none of which the assigned public evidence measures directly.[CP002, CP003, CP009, CP013, CP014, CP016]

3.5 Exhibits

4.1 Revenue Model, Monetization Mechanics, and Pricing Opacity

Veza generates software revenue through an enterprise subscription software-as-a-service (SaaS) and software licensing model anchored on its Access Platform. The platform provides Identity Security Posture Management (ISPM), Identity Governance and Administration (IGA), non-human identity (NHI) management, and access lifecycle automation. Monetization is fundamentally structured around multi-system enterprise scale rather than self-service consumption. Commercial pricing is not published on public catalog tiers; instead, commercial agreements require direct sales quoting and scale based on monitored target systems, connected data sources, directory identities, and optional modules such as Access AI, Access Requests, and Access AuthZ. While list pricing is opaque, enterprise go-to-market execution relies on annual and multi-year upfront SaaS subscriptions, complemented by channel distribution via the Veza Identity Partner Program (VIPP) spanning value-added resellers, global system integrators, and cloud marketplace alliances. Because Veza operates as an analytics and authorization governance control plane connecting to more than 250 to 300 agentless integrations across AWS, Microsoft Azure, Google Cloud, Snowflake, and Workday, its contract sizes historically reflect enterprise-wide security scope, driving strong expansion inside large-scale deployments.[CI001, CI002, CI003, CI004, CI005]

4.2 Commercial Traction, Expansion Dynamics, and Public Metrics

Publicly disclosed financial milestones indicate substantial commercial momentum preceding Veza's strategic exit. In conjunction with its $108 million Series D financing round announced in April 2025, the company reported that it more than doubled its annual recurring revenue (ARR) year-over-year during 2024. Furthermore, Veza reported enterprise Net Revenue Retention (NRR) nearing 150%, demonstrating extensive expansion across existing customer deployments as security teams connected additional cloud services, database repositories, and SaaS platforms to the Access Graph. Traction in top-tier enterprise tiers was highlighted by customer adoption across 10 Fortune 500 and 16 Fortune 1000 organizations, including major institutions such as Blackstone, Workday, Sallie Mae, and Snowflake. Strategic corporate venture investments from Atlassian Ventures, Workday Ventures, and Snowflake Ventures in the Series D round served as both financial backing and commercial validation of Veza's integrations. However, Veza has never publicly disclosed its absolute baseline ARR in US dollars, its annual contract value (ACV) distribution, or its customer concentration percentages, creating a material gap for financial underwriting.[CI006, CI007, CI008, CI009, CI010]

4.3 Cost Structure, Capital Adequacy, and Acquisition Transition

Veza's cost structure reflects a typical high-growth enterprise infrastructure software profile, dominated by technical headcount, cloud compute expenses for graph-processing infrastructure, and global enterprise go-to-market investments. Across four primary institutional equity rounds, Veza raised a cumulative $235 million in total equity financing from investors including New Enterprise Associates, Accel, Google Ventures (GV), True Ventures, Norwest Venture Partners, Ballistic Ventures, and Blackstone Innovations Investments. Headcount expanded from approximately 110 employees around its 2022 launch to more than 190 worldwide by mid-2025, with public industry profiles tracking approximately 191 to 230 employees prior to acquisition. While the $108 million Series D round at an $808 million post-money valuation provided multi-year balance sheet runway, standalone cash burn and gross margin dynamics were superseded by ServiceNow's acquisition of the company. With Veza transitioning into ServiceNow's Autonomous Security and Risk portfolio, standalone capital adequacy and financing dependencies have been absorbed by the parent enterprise, rendering forward cash runway and independent refinancing triggers moot while permanently locking private standalone margin and unit-economics data.[CI011, CI012, CI013, CI014, CI015, CI016]

4.4 Exhibits

5.1 Core Platform Definition and the Access Graph Operating Model

Veza defines its product offering as an authorization-centric identity security platform engineered to answer the foundational enterprise operational question: who can and should take what action on what data across modern IT environments. The platform addresses fundamental visibility and enforcement limitations inherent to traditional identity and access management systems, which historically focused on authentication and siloed role memberships rather than effective permissions at the data asset layer. At the technological core of the architecture lies the Veza Access Graph, an AI-native graph engine that maps an organization's multi-cloud and SaaS identity ecosystem across human users, service accounts, non-human identities (NHIs), groups, roles, policies, and granular resources. The Access Graph traverses nested relationships and heterogeneous access policies to determine effective permissions, converting complex vendor-specific access models into a standardized, intuitive permission vocabulary centered on create, read, update, and delete actions. This graph-centric paradigm enables enterprise security teams to systematically uncover dormant identity accounts, discover excessive entitlements, monitor privileged identities, and continuously enforce least-privilege Zero Trust policies across hybrid enterprise estates.[CE001, CE002, CE003, CE004]

5.2 Product Lines, Module Capabilities, and Enterprise Workflows

The commercial platform organizes its capabilities into three primary solution pillars: Identity Security Posture Management (ISPM), modern Identity Governance and Administration (IGA), and Non-Human and Agentic AI Identity Security. Under the ISPM pillar, Veza provides Access Visibility for multi-cloud permission visualization, Access Intelligence powered by more than 500 pre-built inspection queries and automated ticketing hooks, and Access Monitoring to compare authorized access against actual access history. Within modern IGA, the platform delivers automated Access Reviews that prioritize high-risk entitlements for certification campaigns, Lifecycle Management featuring dry-run simulation capabilities to catch policy violations prior to provisioning, self-service Access Requests through Access Hub, and Access AuthZ to automate enforcement and eliminate provisioning bottlenecks. In response to identity sprawl from automation, the platform includes Non-Human Identity (NHI) Security to inventory service accounts and secrets, alongside AI Agent Security to govern autonomous agents, map human accountability, and maintain audit trails for AI Security Posture Management. Integration with ServiceNow's AI Control Tower following the March 2026 acquisition further links Veza's authorization graph into enterprise IT workflows.[CE005, CE006, CE007, CE008, CE009]

5.3 Connector Architecture, Platform Security, and Engineering Trade-Offs

Veza's architecture depends heavily on its distributed integration and ingestion tier, which supports over 300 agentless, read-only connectors spanning major cloud providers (AWS, Azure, GCP), SaaS platforms (Box, HashiCorp, Databricks), and identity providers such as Okta. Ingestion pipelines and backend services, built primarily in Golang and Java, extract authorization metadata via RESTful APIs and microservices without deploying invasive host agents or risking service interruptions. For proprietary enterprise applications, the Open Authorization API allows organizations to publish access metadata into the platform. Operational security and tenant trust rely on complete tenant isolation, inflight and at-rest encryption, zero external access by design, and regular independent penetration testing. The platform's security controls and design practices hold certifications for SOC 2 Type I, SOC 2 Type II, and ISO 27001. Key engineering and operational risks center on connector maintenance overhead as third-party APIs evolve, potential data synchronization latency across sprawling cloud environments, and the post-acquisition integration roadmap as Veza transitions into ServiceNow's broader product portfolio.[CE010, CE011, CE012, CE013, CE014]

5.4 Exhibits

6.1 Enterprise security is the core buying surface

Veza is positioned for complex enterprises rather than lightweight identity administration. Its official surfaces address security, identity, compliance, data, and platform teams that need to map effective permissions across SaaS, cloud, on-premises, data, and custom systems. SecurityWeek independently described the underlying product as software for enterprise SaaS applications and cloud platforms, while LeadIQ repeats the focus on global enterprises and names Wynn Resorts, Expedia, and Blackstone. LeadIQ is low-reputation corroboration and even carries inconsistent location data, so it should not be treated as authoritative. The strongest segmentation conclusion is therefore functional: CISOs and identity leaders are likely economic buyers, identity and security operators are primary users, and application or data owners participate in reviews and remediation. No source in the assigned set discloses segment-level revenue, ACV, geography mix, or payer concentration.[CU001, CU004, CU014]

6.2 Named references and observed data scale indicate real use, not disclosed economics

Veza's homepage and syndicated company release name recognizable enterprises and describe identity-security use cases, providing stronger evidence than a logo wall alone. The 2026 State of Identity and Access report says Veza analyzed more than 230 billion permissions across 160 enterprises using data observed through 2025. That is evidence of substantial technical visibility, but it is not a disclosed paying-customer count, revenue measure, or retention cohort. The product page also claims more than 300 agentless, read-only integrations; this broadens the potential deployment surface without proving that each connector is actively used. The public proof therefore supports enterprise relevance and production-like data scale, while leaving adoption depth, licensed modules, deployment dates, and independently verified outcomes unresolved.[CU002, CU003, CU004, CU013, CU014]

6.3 The operating model is designed around renewals and expansion

A reposted Veza customer-success role describes portfolios of approximately eight to ten strategic enterprise customers, executive engagement with CIOs and CISOs, multi-year success plans, and direct responsibility for renewal and expansion outcomes. It also identifies adoption depth, executive engagement, and realized value as leading indicators of account health. Those statements show the intended commercial motion, not achieved retention. The reviewed materials disclose no NRR, GRR, logo churn, renewal rate, cohort expansion, contract length, implementation duration, or customer-satisfaction denominator. They also do not identify top-customer exposure. Investors should therefore treat the high-touch model as a plausible durability mechanism whose effectiveness remains private, rather than as evidence of durable recurring revenue.[CU005, CU006, CU007, CU008, CU012]

6.4 ServiceNow may expand distribution while narrowing platform neutrality

Veza's company archive shows continued 2026 publication activity around the ServiceNow combination, but the assigned evidence does not quantify post-close cross-sell, retained customers, or packaging changes. Netwrix, a direct competitor rather than an independent benchmark, argues that folding Veza into ServiceNow's security portfolio creates roadmap and pricing uncertainty for non-ServiceNow customers. It also says remediation coverage depends on connectors and that heterogeneous legacy or custom on-premises environments may require manual intervention. The critique is commercially motivated, yet it identifies diligence questions that the official sources do not answer. Renewal analysis should test whether ServiceNow distribution improves expansion enough to offset neutrality concerns, connector gaps, migration friction, and possible changes in commercial terms.[CU009, CU010, CU015]

6.5 Exhibits

7.1 Risk Topology and Severity Ranking

Evaluating enterprise authorization and access governance risks requires separating foundational identity security posture from the acute operational dependencies introduced by multi-cloud infrastructure and strategic acquisition. Veza addresses structural enterprise access vulnerabilities where workers accumulate excessive entitlements and dormant accounts multiply across fragmented identity providers. However, deploying an authorization graph across diverse software-as-a-service, cloud-native infrastructure, and emerging AI agent environments exposes organizations to operational complexity, integration drift, and architectural lock-in. This chapter ranks risk exposures across regulatory compliance, operational execution, platform dependencies, and financial capitalization based on verified technical characteristics and published market evaluations.[CR001, CR002, CR003]

7.2 Regulatory Compliance and Legal Liabilities

Regulatory mandates including GDPR, HIPAA, and PCI-DSS have expanded beyond basic perimeter authentication to require verifiable least-privilege authorization and continuous entitlement auditing. Organizations face severe financial and legal penalties if unauthorized identities or over-privileged service accounts access protected customer or healthcare records. Traditional role-based access controls and manual certification campaigns frequently fail audit scrutiny because they do not reflect true effective permissions across complex hybrid multi-cloud data stores. While Veza provides out-of-band streaming metadata translation and automated access reviews to substantiate compliance, enterprises remain legally accountable for access misconfigurations, toxic combinations, and audit coverage gaps.[CR004, CR005, CR006, CR007]

7.3 Operational, Security, and Architectural Failure Modes

Operational security risks center on the sheer scale and complexity of identity ecosystems across enterprise data architectures. As organizations adopt distributed cloud architectures, non-human identities such as APIs, service accounts, and automated AI agents rapidly outnumber human personnel, multiplying potential attack paths and toxic permission combinations. When access permissions drift or service accounts retain dormant administrative privileges, attackers can leverage credential abuse to traverse enterprise databases and SaaS applications undetected. Veza's Access Platform counters these failure modes through continuous access monitoring, automated lifecycle deprovisioning, and pre-built policy violation queries, but deployment efficacy remains bounded by connector coverage and cross-platform synchronization latency.[CR008, CR009, CR010, CR011, CR016]

7.4 Platform Dependencies, Acquisition Dynamics, and Financial Posture

Platform concentration and supplier dependency represent critical structural risks following ServiceNow's agreement to acquire Veza. Third-party evaluations emphasize that deep technical embedding within ServiceNow's AI Platform risks vendor lock-in, organizational support restructuring, and roadmap redirection away from non-ServiceNow environments. Concurrently, while Veza secured $108 million in Series D capital at an $808 million standalone valuation prior to transaction execution, standalone unit economics, annual recurring revenue, and cash burn metrics remain private. Customer organizations evaluating long-term authorization architecture must weigh the operational benefits of unified ServiceNow security workflows against switching costs and ecosystem neutrality risks.[CR012, CR013, CR014, CR015]

7.5 Exhibits

8.1 Decision and Investability

Recommendation: research-more, with medium confidence, high information risk, and an unknown current valuation stance. The strongest public anchor is the April 2025 Series D: Veza raised $108 million, independent coverage and Forge place the post-money mark at about $808 million, and the company said cumulative equity raised reached $235 million [CV001, CV002, CV003]. That anchor is historical rather than investable. Forge now records an M&A announcement in December 2025 and closing in March 2026, labels market activity limited, and shows no available price [CV011, CV012]. Public evidence therefore does not support a current standalone entry price, target return, or holding-period case [CV016].

8.2 Thesis and Anti-Thesis

The thesis is strategic rather than conventionally financial. Veza reported more than doubling annual recurring revenue year over year and enterprise net revenue retention nearing 150% in its 2025 financing disclosure [CV004, CV005]. Its current product material claims more than 300 integrations, while its platform spans human, machine, and third-party identities across on-premise, SaaS, application, and data environments [CV008, CV009]. CNBC also reported a Gartner analyst's view that Veza focused on access visibility where adjacent providers lacked technology [CV010]. The anti-thesis is disclosure quality: CNBC said Veza was not disclosing revenue, and Forge cautions that its private-market data may rely on limited inputs without audit or independent verification [CV006, CV014]. Strategic participation from enterprise software vendors is useful validation, but it is not a substitute for audited economics [CV007].

8.3 Scenarios, Comparables, and Entry Discipline

The assigned evidence supports relative scenarios, not precise return probabilities or dollar ranges. A bull outcome would require disclosed acquisition consideration above the $808.05 million Series D mark and proof that product breadth translated into durable economics. A base outcome is simply a completed strategic exit whose value to each security class remains indeterminate. A bear outcome is consideration below the last round or a waterfall that reduces common-holder proceeds; neither can be quantified without deal documents. Forge's own-company financing history provides only a milestone reference, moving from a reported $493.78 million Series C post-money valuation to $808.05 million at Series D [CV013, CV002]. It is not a public-company comparable set, and the current record does not support substituting named public peers or unsupported revenue multiples [CV006, CV016].[CV002, CV006, CV013, CV016]

8.4 Exit Readiness and Diligence Triggers

Veza has already reached a recorded strategic exit, so diligence should focus on realized security-level proceeds and post-close integration rather than IPO readiness [CV011]. The view improves only if definitive documents disclose purchase consideration, payment mix, rollover or earnout terms, and the preference waterfall; audited standalone revenue, gross margin, retention cohorts, and cash use are also needed to judge whether the 2025 mark represented efficient growth [CV006, CV016]. The view weakens if disclosed consideration is below $808.05 million, if material value is contingent, or if integration reduces product autonomy and customer retention. Forge's limited activity and unavailable price mean secondary indications cannot close these gaps [CV012], while its general warning that private securities are illiquid reinforces the need for documentary evidence rather than a modeled liquidity assumption [CV015].

8.5 Exhibits