Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Identity Mesh — October 20, 2026

Release Date: October 20, 2026
Release Type: Mixed (New Features, Improvements, Performance, Bug Fixes, Security Fixes)

Overview​

This release delivers a new generation of post-quantum cryptography in Mesh — always-on discovery of how your software uses cryptography, evidence you can trace, and a priority that tells you what to fix first — together with a new governance area for your compliance programs:

  • Always-on cryptography discovery — the algorithms your software uses, how its cryptography is configured, and whether each version is post-quantum capable, kept current continuously.
  • Multi-source crypto evidence — every source's view of an asset is kept, and the strongest evidence wins.
  • Asset priority — one clear 0–100 priority for software and crypto assets, driven by the most serious compliance finding.
  • Compliance Frameworks and Initiatives — build your own frameworks and track your security programs in Settings.
  • Identity Dossier — one complete view of every person in your organization.

It also makes dashboards, lists and exports noticeably faster, and makes background processing smarter so Mesh stays responsive during heavy data loads.

New features​

Always-on cryptography discovery for your software​

Mesh now keeps the cryptographic profile of your software up to date continuously, rather than in periodic runs.

What you get:

  • Usage — the algorithms each software product actually uses.

  • Configuration — how its cryptography is configured by default, and where that can be changed.

  • Capability — whether the installed version is post-quantum capable.

  • Traceable findings. Every finding records where it came from, and products already analyzed are recognized instantly, so new software in your inventory is profiled without delay.

Post-quantum capability for every software asset​

Each software asset now shows whether its installed version is post-quantum capable, and the first version that is. Capability feeds directly into your PQC verdicts and your remediation plan, so you can see which upgrades actually move you to quantum safety. Where a version is not known, Mesh says so plainly rather than guessing.

Multi-source crypto evidence​

Mesh now keeps every source's view of an asset's cryptography — whether declared in an SBOM or CBOM, read from a real configuration, or found by scanning.

What you get:

  • The strongest evidence wins. When sources disagree, a confirmed configuration takes precedence over a vendor's documented default.

  • See what backs each finding. A new Basis column on the Asset Dossier shows the evidence behind every algorithm.

Algorithm discovery and cataloging​

When your inventory contains an algorithm Mesh does not yet recognize, it is captured automatically and queued for review by Axiad, together with a suggested identification and how often it has been seen. Once confirmed, it is mapped to its standard name or added to the Mesh algorithm catalog — and your reports and verdicts pick it up with no action from you.

Asset priority​

Software and crypto assets now carry a priority from 0 to 100, replacing the summed risk score with a more accurate, impact-based number.

What you get:

  • Severity first. Priority is driven by the most serious open compliance finding on the asset or anything it depends on, then by how much compliance risk sits beneath it.

  • Signal over noise. Routine housekeeping findings no longer inflate the number, so a single critical issue rises above a long tail of minor ones.

  • Everywhere you work. Asset lists, the Top 10 widget and exports sort by priority, you can filter on it, and hierarchy views show it for every copy.

Machines keep their existing risk score.

PQC posture drill-down​

Select any posture tile to see every asset in it, with its exact readings and the policy reason behind its grade. Assets that are still awaiting a grade now have their own Not graded tile.

Asset Dossier Risks view​

A new Risks view on the Asset Dossier — score cards plus Findings, Algorithms, Contributors and Calculation tabs — shows exactly why an asset carries the risk it does.

Certificate expiry at a glance​

New Expiration date and Days since expiry columns, color-coded so certificates that need attention stand out.

Compliance Frameworks and Initiatives​

A new Governance area in Settings brings your compliance programs together in one place.

What you get:

  • Compliance Frameworks. Create your own framework or duplicate an existing one, give it a version, and build its controls. Each control cites a compliance policy that Mesh grades automatically, or is marked attestation-only. Enable or disable a framework at any time.

  • Initiatives. Plan and track your security programs — scope, owner, start and target dates, milestones and work items — with progress measured from graded assets and the attestations you record.

  • A clear overview. The Governance overview explains how policies, frameworks and initiatives work together — cite, grade, measure, report — and exactly what is affected when you switch one off.

Policy rollout progress​

When you activate a compliance policy, you now see its rollout progress live, along with a clear list of any assets that cannot be graded yet. Conflicting policies are caught before activation.

Identity Dossier​

One complete view of every person in your organization: source records, groups and permissions, applications, risk findings, a correlation map and connections, plus an Ask the agent shortcut. Every identity link across Mesh now opens the dossier.

Audit log sorting, filtering and export​

Sort any column in the audit log, filter with type-ahead suggestions, and export either your filtered view or the complete log. See Audit logging.

Improvements​

Redesigned PQC readiness view​

A clearer, more compact readiness gauge and matrix. Every state can be drilled into, Undecided is broken down by its cause, and a new Not yet assessed state makes the picture easier to read. See PQC dashboard.

Accurate algorithm naming​

A richer algorithm catalog — valid key sizes, hybrid schemes, protocols, TLS 1.3 cipher suites and stateful hash-based signature parameter sets — means every algorithm appears under one consistent name, and Mesh never assumes a parameter set or key size it has not actually seen.

One policy per widget​

Each compliance widget can now follow the policy you choose, and can be limited to post-quantum cryptography only.

Readable shadow-AI detections from CrowdStrike​

AI tools detected by CrowdStrike now show a clean name, whether each was found as a running process or through DNS, its owner, and a drill-down to the details.

ServiceNow CMDB​

A clear link now opens each record directly in ServiceNow, and you can optionally name the license field that identifies a software owner. Data now matches the managed connector even more closely. See ServiceNow CMDB.

Safer identity-provider changes​

When disabling an identity provider would lock users out, Mesh now explains clearly why the change was refused.

Workspace freshness​

Each workspace now shows when its data was last updated.

Performance and reliability​

  • Faster dashboards — dashboards, Top 10 lists, blast-radius views and policy drill-downs load noticeably faster.

  • Quicker asset lists and dossiers — asset lists appear sooner, and dossiers and drill-downs open faster.

  • Large exports complete reliably — even very large inventories now export completely.

  • Faster updates after changes — changes in your environment are reflected in risk and compliance results sooner.

  • Lighter nightly analytics — the nightly analytics refresh finishes faster and uses fewer resources.

  • More responsive during heavy data loads — Mesh now keeps your dashboard responsive while large amounts of data are being processed.

Bug fixes​

  • Identity correlation — records are no longer joined simply because they share an address, and the Workday connector now collects only each worker's own work and home email.

  • Lifecycle risk — lifecycle-based risk findings now apply to every identity-provider user.

  • Connector health — a connector that pauses after reaching its collection limit for a run is now shown accurately, rather than as failed or unknown.

  • ServiceNow software — large ServiceNow software catalogs now load fully on their first sync.

  • AI assistant — the assistant now ignores identity providers you have removed, matching the Settings screen.

  • Posture counts — retired machines and assets no longer count toward posture, asset drill-down headers match their lists, and grading respects each rule's effective dates.

  • Export retention — exports are kept when no retention period is set.

Security fixes​

Governance access and audit​

Governance settings are limited to tenant administrators, and every change to policies, frameworks and the algorithm catalog is recorded in the audit log.

Platform hardening​

Strengthened internal security and updated third-party components that address published vulnerabilities. No configuration change is required.