PAIRING · MEASURED SIDE BY SIDE
C1 (formerly ConductorOne) vs Veza: reach beyond the IdP and IGA
The short answer
On our default weights Veza scores higher overall, 6.37 against 6.30 out of 10. C1 scores higher on Unmanaged app discovery, Executes changes itself and Pricing transparency; Veza scores higher on Accounts inside the app, Reach into apps without APIs or SCIM, Orchestrates through the existing stack, Machine, service and agent accounts and Audit evidence. They sit in different layers (Identity governance (IGA) platform and Access graph and governance), so many teams run both.
By The Credential Desk · IAM Compared · Published 2026-10-08
Desk research from public vendor pages and documentation read in September 2026, updated 2026-10-13. Editorial assessment; we did not test the products.
How do they score on each criterion?
| Criterion | Weight | C1 | Veza | Higher |
|---|---|---|---|---|
| Unmanaged app discovery | 18% | 6.0 Monitors shadow app sign-ups and logins to decide whether to bring an app under governance, and lists Shadow AI Discovery. | 3.5 Finds accounts outside identity platforms within the systems it integrates with; discovery of applications nobody connected is not described. | C1 |
| Accounts inside the app | 16% | 6.0 Finds what offboarding missed; mapping of local accounts inside apps is not detailed. | 8.0 Reveals local, machine and service accounts and dormant accounts, with effective permissions from the Access Graph. | Veza |
| Reach into apps without APIs or SCIM | 14% | 6.5 Open-source Baton connectors and C1 Bridge for on-prem systems; apps with no connector are not described in detail. | 7.0 The Open Authorization API imports authorization metadata from any system, including custom or on-premise apps, through a JSON schema and REST API; someone has to build the feed. | Veza |
| Orchestrates through the existing stack | 14% | 7.0 Connects to existing IdPs and HR systems rather than replacing them. | 7.5 Adds visibility beside existing IdP and HR sources and writes changes back through OAA Write; now part of ServiceNow. | Veza |
| Executes changes itself | 12% | 7.8 HR systems and directories trigger join, role change and departure workflows. | 7.2 Birthright access, role-change and offboarding automation, including local accounts, with Dry Run and Safety Limits. | C1 |
| Machine, service and agent accounts | 10% | 6.0 Shadow AI Discovery is listed; service account and credential coverage is not detailed. | 7.5 Reveals machine and service accounts; the acquisition post frames the combined offer as an agent identity control plane. | Veza |
| Audit evidence | 10% | 6.5 Records each offboarding action; a framework evidence export is not described. | 7.0 Audit logging for lifecycle actions; a framework-mapped evidence export is not described on the pages reviewed. | Veza |
| Pricing transparency | 6% | 3.0 Publishes the pricing structure but no prices. | 2.0 No public pricing. | C1 |
| Total | 100% | 6.30 | 6.37 | Veza |
What shape is each tool's reach?
- DISC
- Unmanaged app discovery
- 6.0
- INAPP
- Accounts inside the app
- 6.0
- NOAPI
- Reach into apps without APIs or SCIM
- 6.5
- ORCH
- Orchestrates through the existing stack
- 7.0
- EXEC
- Executes changes itself
- 7.8
- NHI
- Machine, service and agent accounts
- 6.0
- EVID
- Audit evidence
- 6.5
- PRICE
- Pricing transparency
- 3.0
Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.
- DISC
- Unmanaged app discovery
- 3.5
- INAPP
- Accounts inside the app
- 8.0
- NOAPI
- Reach into apps without APIs or SCIM
- 7.0
- ORCH
- Orchestrates through the existing stack
- 7.5
- EXEC
- Executes changes itself
- 7.2
- NHI
- Machine, service and agent accounts
- 7.5
- EVID
- Audit evidence
- 7.0
- PRICE
- Pricing transparency
- 2.0
Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.
Which parts of the estate does each document?
| Zone | C1 | Veza |
|---|---|---|
| Unsanctioned SaaS | Partial Shadow app sign-up and login monitoring | Not documented Discovery of unconnected SaaS not described |
| On-prem and legacy apps | Documented C1 Bridge for on-prem systems | Documented The Open Authorization API imports authorization metadata from custom or on-premise apps |
| Custom-built apps | Partial Open-source Baton connectors you can extend | Documented Custom systems connect through OAA |
| Local accounts in apps | Partial Find what offboarding missed | Documented Reveals local accounts outside identity platforms |
| Service accounts and hardcoded credentials | Not documented Not described on the pages reviewed | Partial Reveals machine and service accounts; hardcoded credentials not described |
| AI agents | Partial Shadow AI Discovery listed | Partial Acquisition post frames the combined offer as an agent identity control plane |
What do they cost?
C1 (formerly ConductorOne)
Pricing
Pricing structure published (Platform or Flex; Pro or Advanced; 100 to 20,000 managed identities) without prices.
Source: C1 pricing · Read 12 Oct 2026
Deployment
SaaS with hosted or on-prem connectors (C1 Bridge). EU instance with tenant data held in the EU since September 2026.
Which should you choose?
Frequently asked questions
Which scores higher overall, C1 (formerly ConductorOne) or Veza?
On our default weights Veza scores higher overall, 6.37 against 6.30 out of 10.
Where does C1 (formerly ConductorOne) score higher than Veza?
C1 scores higher on Unmanaged app discovery (6.0 against 3.5), Executes changes itself (7.8 against 7.2) and Pricing transparency (3.0 against 2.0).
Can C1 (formerly ConductorOne) and Veza be used together?
Often, yes. They sit in different layers (Identity governance (IGA) platform; Access graph and governance), and each one's pages describe working with existing identity tools.