Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Identity Mesh — October 6, 2026

Release Date: October 6, 2026
Release Type: Mixed (New Features, Improvements, Bug Fixes)

Overview​

This release turns post-quantum findings into a ranked work list, and adds discovery for the AI agents running inside your estate:

  • Blast-radius ranking — quantum-vulnerable assets ranked by how much else depends on them, so the list answers "what do we fix first" rather than just "what is vulnerable".
  • AI agent and Shadow AI discovery through CrowdStrike — a new connector that inventories AI agents from CrowdStrike's catalog and hunts for unmanaged ones with your own search queries.
  • The Asset Dossier opens from anywhere — asset nodes in graphs, agent-composed tables and charts, and compliance heatmap cells all open the same detail view.

It also brings a group of connector reliability and data-accuracy fixes.

New features​

Blast-radius ranking for quantum-vulnerable assets​

Quantum-vulnerable assets are now ranked by blast radius — how much of your estate is affected if an asset has to be replaced — instead of by a single risk score with ties broken arbitrarily.

What you get:

  • A score built from real dependencies. The ranking combines how many software assets depend on the asset, how many machines those dependent assets are installed on, and whether the asset is policy-compliant. A non-compliant, widely deployed component outranks a compliant one with the same score.

  • A ranked, paginated list with the highest blast radius first.

  • Click through to the graph. Selecting a row opens the dependency graph focused on that asset, so you can see what sits behind the number and walk through to the owner.

Why it matters: discovery tells you what is vulnerable; it does not tell you what to do on Monday. A cryptographic library present in a hundred packages installed across two hundred thousand machines is a different problem from the same algorithm on one host, and the ranking now says so.

AI agent and Shadow AI discovery through CrowdStrike​

A new CrowdStrike connector brings AI agents into Mesh as non-human identities, from two complementary directions.

What you get:

  • Agents from the CrowdStrike catalog, including the owner's email address on each agent record — so an agent is tied to a person from the moment it is discovered, rather than sitting unattributed.

  • Your own search queries for the agents the catalog does not know about. A search builder runs queries against CrowdStrike's security data to hunt for agents by process name or by the API hosts they call, which catches self-hosted and recently renamed tools that no product catalog has classified yet.

  • Optional standard term lists. Prepared, editable lists of known AI tool process names and API hostnames can be switched on with a checkbox, extended with your own terms, or skipped entirely.

  • More than Shadow AI. The same search mechanism covers service account and scheduled task creation, privilege escalation, credential-dumping detections, dormant account activity, and remote-access lateral movement.

  • Available from both connector screens, including the guided setup in the newer workspace settings.

The Asset Dossier opens from anywhere​

The asset detail view now opens directly from the places you are already looking: asset nodes in an identity graph, tables and charts the assistant composes for you, and cells in the compliance heatmap.

Universal REST connector: Search APIs that require POST​

The universal REST connector can now send a request body, and can drive APIs that start a search job and return results only once that job finishes. This is what makes search-style APIs reachable as a connector at all, rather than only endpoints that answer a simple query.

Improvements​

Faster post-quantum and asset views​

The PQC readiness filter, asset type filtering and blast-radius ranking now respond noticeably sooner on large estates.

A newer model behind the assistant​

The AI assistant now runs on a newer underlying model.

The asset list hides internal connectors​

Connectors that exist for internal purposes no longer appear in the asset list and dossier filters.

Sign-in service brought up to date​

The sign-in service was updated to a current release, picking up the fixes made in the versions in between.

Bug fixes​

  • Azure connector — an expired delta link left users and groups out of sync. Expired rounds are now detected and restarted automatically.

  • Connector scheduler — a connector stuck initializing kept running full synchronizations indefinitely. Repeated runs that make no progress now stop and report why.

  • PQC Readiness Index — no score was shown when a policy graded the same algorithm at two different disapproved levels.

  • Identity details — accounts from most connector types were labelled "Unsupported". They now show a readable source name.

  • Crypto assets — algorithm columns sorted on a different value from the one displayed.

  • Dark web risks — risks cleared during a breach-lookup failure have been restored.

  • Universal REST connector — a template generated by the wizard could not be loaded back, and the request body was not sent on search endpoints.

  • Connector setup — adding a connector for some REST sources was rejected.

  • Native Okta connector — accounts were not attributed correctly.

  • Cryptographic parameter detector — flagged assets whose parameters were in fact complete.

  • Risk service — could fail on large tenants when resolving example references, because it used too much memory.