Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Identity Mesh — October 13, 2026

Release Date: October 13, 2026
Release Type: Mixed (New Features, Improvements, Bug Fixes, Security Fixes)

Overview​

This release extends discovery into two places Mesh could not previously see — your endpoint detection telemetry and your cloud and container estate — and turns post-quantum findings into an ordered plan:

  • Cortex XDR and Defender for Endpoint connectors — query the detection telemetry you already own, using each vendor's own query language.
  • Guided ServiceNow CMDB setup — a seven-step flow that confirms your credential before you choose any data.
  • Cloud and workload cryptography — certificates, keys, storage encryption and key rotation from AWS, plus library readiness from container workloads.
  • A dossier for non-human identities — service accounts and AI agents get their own detail view and connectivity graph inside the workspace canvas.
  • A remediation plan for quantum-vulnerable software — an ordered upgrade, reissue and verify sequence on the Asset Dossier.

It also hardens how the dashboard handles credentials you type in, and picks up a third-party vulnerability fix across every service.

New features​

Cortex XDR and Microsoft Defender for Endpoint connectors​

Mesh can now discover identities and AI agents from two more endpoint detection platforms, by running queries against telemetry you already collect.

What you get:

  • Palo Alto Cortex XDR and Microsoft Defender for Endpoint, each using the vendor's own ad-hoc query language, alongside the CrowdStrike connector added last week.

  • No detection add-on required. Ad-hoc query access comes with the enterprise tier you already pay for. Mesh performs the agent and non-human identity classification itself, rather than requiring the vendor's separately licensed detection module.

See Palo Alto Cortex XDR and Microsoft Defender for Endpoint.

Guided ServiceNow CMDB setup​

Adding a ServiceNow CMDB connector now opens a guided, seven-step setup.

What you get:

  • Check your credential first. Test connection on the sign-in step confirms the credential works before you choose any data. Five sign-in methods are supported, including both OAuth options.

  • Choose what Mesh reads. Pick from eleven standard table groups or add your own table, and see how each ServiceNow field becomes a Mesh field.

  • Control the load on your instance. Set how often Mesh reads, how fast it calls the ServiceNow API, and how much one run collects. After the first collection, Mesh reads only what changed.

See ServiceNow CMDB.

Cloud and workload cryptography​

Mesh now collects cryptographic posture from your cloud control plane and container workloads, so cloud-managed keys and certificates sit alongside the rest of your inventory.

What you get:

  • From AWS — certificates, key store keys with their rotation state, load balancer TLS configuration, and bucket encryption settings.

  • From container workloads — the images running in your clusters, the libraries inside them, and whether those library versions are post-quantum capable, with unknown reported as unknown rather than guessed.

  • Private key material is never read. Inspection records configuration and metadata only; private keys and secret values are never retrieved, stored or transmitted.

Why it matters: cloud-managed certificates and keys are usually the part of an estate nobody has an inventory for, and key rotation state is exactly what a post-quantum migration plan needs.

See Amazon Web Services.

A dossier for non-human identities​

Service accounts, workload identities and AI agents now have their own detail view inside the workspace canvas, rather than being inert rows.

What you get:

  • An NHI Dossier and a filtered NHI list, opening in place with back navigation and breadcrumbs, the same way asset drill-downs already work.

  • A connectivity graph running from the human owner, through the identity, to the applications it reaches and the other identities sharing them — so an agent's blast radius and its accountable owner are on one screen.

  • Entry points from everywhere NHIs appear — the agentic AI inventory, the breakdown by identity type, and tables the assistant composes for you.

  • Recognizable tool icons for detected AI tools, and filters that persist as you move around.

A remediation plan on the Asset Dossier​

Software components in the Asset Dossier gain a Remediation view: an ordered plan for removing quantum-vulnerable cryptography, showing which packages to upgrade, what to reissue, and what to verify. Where a component is only reachable through another package, the plan targets the package that brings it in rather than the component itself. Values Mesh does not hold are shown as unknown rather than estimated.

Date filters with before and after​

Date filters now support before and after, not only a fixed range.

Improvements​

ServiceNow CMDB connector hardening​

Corrections to how the ServiceNow CMDB connector derives entity identity and builds machine-to-software links.

Widget exports appear in the audit log​

Exporting data from a widget is now recorded in the audit log, alongside the other export activity already captured. See Audit logging.

Bug fixes​

  • Audit log export — the export control was greyed out and could not be used.

  • Exporting through the assistant — asking the assistant to export returned nothing, while the same export from the widget worked.

  • Azure connector — service principal collection and group license bugs were fixed.

  • Universal REST connector — cursor-based pagination dropped results for sources returning an array cursor, and SBOM ingestion discarded unmapped fields.

  • Edit connector — the edit dialog could not save a Universal REST connector.

  • Crypto assets — owned assets were reported as having no owner.

  • Risk evaluation — nightly orphan sweeps did not run to completion, and some entity categories were forwarded to the engine that it does not process.

  • Asset ownership — ownership is now reconciled for assets whose owning record changed.

Security fixes​

Credentials typed into the dashboard are handled more safely​

Credentials entered when configuring a connector or identity provider — API keys, client secrets, private keys — could be written into the browser in readable form while the page was open.

The dashboard no longer logs the content of a failed request, clears entered secrets when the configuration changes, and masks multiline secrets that were previously shown as plain text, with a deliberate reveal control where you need to check what you typed. Automated checks now fail the build if a credential reaches the browser log.

Third-party vulnerability patched​

Every service in this release was rebuilt against a patched version of a third-party networking library, addressing a denial-of-service vulnerability in its HTTP/2 handling (CVE-2026-78669). No configuration change is required.