# Identity Mesh — October 6, 2026 **Release Date**: October 6, 2026 **Release Type**: Mixed (New Features, Improvements, Bug Fixes) ------------------------------------------------------------------------ ## Overview This release turns post-quantum findings into a ranked work list, and adds discovery for the AI agents running inside your estate: - **Blast-radius ranking** — quantum-vulnerable assets ranked by how much else depends on them, so the list answers "what do we fix first" rather than just "what is vulnerable". - **AI agent and Shadow AI discovery through CrowdStrike** — a new connector that inventories AI agents from CrowdStrike's catalog and hunts for unmanaged ones with your own search queries. - **The Asset Dossier opens from anywhere** — asset nodes in graphs, agent-composed tables and charts, and compliance heatmap cells all open the same detail view. It also brings a group of connector reliability and data-accuracy fixes. ------------------------------------------------------------------------ ## New features ### Blast-radius ranking for quantum-vulnerable assets Quantum-vulnerable assets are now ranked by **blast radius** — how much of your estate is affected if an asset has to be replaced — instead of by a single risk score with ties broken arbitrarily. **What you get:** - **A score built from real dependencies.** The ranking combines how many software assets depend on the asset, how many machines those dependent assets are installed on, and whether the asset is policy-compliant. A non-compliant, widely deployed component outranks a compliant one with the same score. - **A ranked, paginated list** with the highest blast radius first. - **Click through to the graph.** Selecting a row opens the dependency graph focused on that asset, so you can see what sits behind the number and walk through to the owner. **Why it matters:** discovery tells you what is vulnerable; it does not tell you what to do on Monday. A cryptographic library present in a hundred packages installed across two hundred thousand machines is a different problem from the same algorithm on one host, and the ranking now says so. ### AI agent and Shadow AI discovery through CrowdStrike A new CrowdStrike connector brings AI agents into Mesh as non-human identities, from two complementary directions. **What you get:** - **Agents from the CrowdStrike catalog**, including the owner's email address on each agent record — so an agent is tied to a person from the moment it is discovered, rather than sitting unattributed. - **Your own search queries for the agents the catalog does not know about.** A search builder runs queries against CrowdStrike's security data to hunt for agents by process name or by the API hosts they call, which catches self-hosted and recently renamed tools that no product catalog has classified yet. - **Optional standard term lists.** Prepared, editable lists of known AI tool process names and API hostnames can be switched on with a checkbox, extended with your own terms, or skipped entirely. - **More than Shadow AI.** The same search mechanism covers service account and scheduled task creation, privilege escalation, credential-dumping detections, dormant account activity, and remote-access lateral movement. - **Available from both connector screens**, including the guided setup in the newer workspace settings. ### The Asset Dossier opens from anywhere The asset detail view now opens directly from the places you are already looking: asset nodes in an identity graph, tables and charts the assistant composes for you, and cells in the compliance heatmap. ### Universal REST connector: Search APIs that require POST The universal REST connector can now send a request body, and can drive APIs that start a search job and return results only once that job finishes. This is what makes search-style APIs reachable as a connector at all, rather than only endpoints that answer a simple query. ------------------------------------------------------------------------ ## Improvements ### Faster post-quantum and asset views The PQC readiness filter, asset type filtering and blast-radius ranking now respond noticeably sooner on large estates. ### A newer model behind the assistant The AI assistant now runs on a newer underlying model. ### The asset list hides internal connectors Connectors that exist for internal purposes no longer appear in the asset list and dossier filters. ### Sign-in service brought up to date The sign-in service was updated to a current release, picking up the fixes made in the versions in between. ------------------------------------------------------------------------ ## Bug fixes - **Azure connector** — an expired delta link left users and groups out of sync. Expired rounds are now detected and restarted automatically. - **Connector scheduler** — a connector stuck initializing kept running full synchronizations indefinitely. Repeated runs that make no progress now stop and report why. - **PQC Readiness Index** — no score was shown when a policy graded the same algorithm at two different disapproved levels. - **Identity details** — accounts from most connector types were labelled "Unsupported". They now show a readable source name. - **Crypto assets** — algorithm columns sorted on a different value from the one displayed. - **Dark web risks** — risks cleared during a breach-lookup failure have been restored. - **Universal REST connector** — a template generated by the wizard could not be loaded back, and the request body was not sent on search endpoints. - **Connector setup** — adding a connector for some REST sources was rejected. - **Native Okta connector** — accounts were not attributed correctly. - **Cryptographic parameter detector** — flagged assets whose parameters were in fact complete. - **Risk service** — could fail on large tenants when resolving example references, because it used too much memory.