Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Identity Mesh — October 27, 2026

Release Date: October 27, 2026
Release Type: Mixed (New Features, Improvements, Bug Fixes, Security Fixes)

Overview​

This release puts a name and an owner against the AI tools running in your estate, adds two more identity governance sources, and makes the non-human identity list easier to work through:

  • Shadow AI labelling — every AI agent found by a security tool is marked against your approved-tools list, and, where the tool reports who ran it, linked to that person.
  • SailPoint IdentityIQ — the on-prem connector reaches general availability and is now a connector you pick from the list.
  • Conductor in the connector catalog — Conductor is now a connector you pick from the list, rather than one you build by hand.
  • Non-human identity list — every row shows the identity's type, and the list can be filtered and sorted by source and by owner.

It also carries four security fixes, including a change to how credentials for on-prem agent connectors are stored.

New features​

Shadow AI labelling​

AI agents discovered by your endpoint security tools are now assessed against a list of tools you approve, so unapproved AI shows up as such instead of sitting in an undifferentiated inventory.

What you get:

  • An approved AI tools list. A new policy type holds the AI tools your organization permits. Until you populate it, nothing counts as approved and every detected agent is labelled — the screen tells you the list has not been set up yet, so an empty policy is never mistaken for a clean result.

  • Three labels, by how the agent was found. A tool observed running on a machine and not on your approved list is Shadow AI. A tool seen only as network traffic to its service is Suspected shadow AI. A tool on your approved list is Approved. Agents registered through a directory or asset source carry no label, because nothing was detected.

  • Filter and count by label, from a summary card, a filter chip, or the AI assistant.

  • The person behind the agent. Where an endpoint tool reports who ran the AI tool, Mesh creates the account record and links the agent to that person, so agent details show the owner instead of "not linked to a person".

Why it matters: an inventory of AI agents answers "what is running". The label and the owner answer the two questions that follow — whether it is allowed, and who to talk to.

SailPoint IdentityIQ​

The SailPoint IdentityIQ connector reaches general availability and is now selectable from Add connector, collecting identities from your on-premises IdentityIQ deployment through an on-prem agent.

Conductor in the connector catalog​

Axiad Conductor is now a connector you select from Add connector, with its own guided setup tile, rather than a universal REST configuration you assemble yourself. Supply the base address and an API token; the collection template comes from the catalog.

Non-human identity list​

The NHI list now shows each identity's type — service account, device, AI agent — on every row, and can be filtered and sorted by source and by owner, including identities with no owner. Sources show their real name rather than an internal identifier.

Improvements​

Analytics queries no longer load the operational database​

The analytics API is now served from the analytics store rather than the live operational database, so reporting tools querying large estates no longer compete with the system collecting your data.

Collected data counts reflect what is stored​

The Collected data view (a connector's menu → View Collection) now shows the rows Mesh actually stored for Machines, Software and Crypto, for every connector. Before, these rows showed what collection runs reported, which could be many times higher after a long first collection, because records read more than once were counted each time.

A new Software installations row shows how many software installs were collected, each piece of software on each machine, for connectors that report installed software, such as ServiceNow CMDB.

Faster directory sign-in collection​

The directory connector now reads all available sign-in pages within one run and resumes by timestamp, instead of a single page per run — high-volume tenants no longer fall behind.

Faster group membership collection from ServiceNow​

Group memberships from ServiceNow are now sent and stored a group at a time, instead of one membership at a time. Large instances finish collecting memberships sooner, and other data collected at the same time waits less behind them.

On-prem agent configuration​

Configuration applied to an on-prem agent is no longer a whole-list overwrite, so two administrators editing different connectors cannot discard each other's changes, and deregistering an agent now clears its configuration on both sides.

Bug fixes​

  • Dark web risks — a failure in the breach-detail lookup marked breached identities as resolved and removed their risks. The lookup now fails safe and leaves existing risks in place.

  • Delegation — delegating an identity from the classic view failed.

  • On-prem connectors — two connectors sharing a display name were treated as the same connector, so disabling one destroyed the other.

  • PQC drill-down — owner and linked-asset counts showed "count unavailable" on large tenants.

  • Knowledge base assistant — connecting intermittently failed when more than one instance was running.

  • Analytics pipeline — the nightly analytics ingest could fail on large tables, and scheduled jobs could overlap. Both are fixed.

Security fixes​

Credentials for on-prem agent connectors were stored unprotected​

Credentials entered for an on-prem agent connector — such as the directory bind password — were written to the Mesh database in readable form, and included in the configuration sent to the agent, despite the form stating they were stored encrypted. They are now protected in storage and in transit to the agent, and existing stored values have been remediated.

Action required: treat any credential entered for an on-prem agent connector before this release as exposed, and rotate it at the source system. Your Axiad contact can confirm which of your connectors are affected.

Agent commands are signed​

Every command sent to an on-prem agent is now signed, rather than configuration changes alone, so an agent will not act on an instruction it cannot verify.

Platform and dashboard dependency updates​

All services were rebuilt on a current language toolchain, and the dashboard was moved to the October runtime and framework security releases, clearing the vulnerabilities reported against the previous versions. No configuration change is required.