- October 6, 2026
- Posted by: admin
- Category: Newsletter
This Month in IAM
Innovation is not a destination. It is a discipline. At CyberSolve Innovation Labs, every month brings new ideas, experiments, product releases, and engineering breakthroughs that push the boundaries of Identity and Cybersecurity. September was the month AI agents started getting the identity plumbing people have had for years. Dick Hardt, the author of OAuth 2.0, is proposing AAuth, an authorization protocol built for agents: instead of borrowing API keys and shared secrets, each agent carries its own cryptographic identity and asks for permission one action at a time. At Oktane, Okta brought agents into its core platform with
Agent SSO, which gives AI agents first-class identities, and published a Blueprint for the Secure Agentic Enterprise with an industry alliance behind it. And TypeSafe AI released Jev, a small model that doesn't write text at all. It answers yes, no, or a score, very fast, and one of its first uses is checking an agent's next action before it runs. A protocol, a platform, and a referee. Same direction: agents are being treated as identities that have to be proven, governed, and checked.
In this edition:
- AI agents of every kind, built the way companies actually build them, now run in our labs with NeuroShield protecting every one of them
- SafeAccessCopilot launches: entitlement owners answer five simple questions, and an LLM turns cryptic entitlement names into plain-English descriptions, so managers approve with confidence and reviewers spend their time on risky access instead of rubber-stamping
- NeuroID reaches further: it now automates Windows desktop applications, and it carries out access requests raised in ServiceNow directly inside the target application
- Customer impact: a leading surgical services provider runs its annual access review in-house with NeuroID, and a reporting change it asked for cut one reviewer’s daily task from about 30 minutes to about 5
- CyberSolve in the industry: on the main stage at ServiceNow World Forum New York, and a new video series, The Cybersecurity Xchange
WHAT WE BUILT THIS MONTH
NEUROSHIELD: A TEST BENCH FOR EVERY KIND OF AI AGENT
Ask a company where its AI agents live and you will get three different answers. Some live inside software the company already pays for, like the assistant built into a CRM or IT service platform. Some are built on a cloud provider's agent platform. And some were written by an internal team and run on the company's own servers. Each kind is built differently, runs somewhere different, and gives the security team a different amount of control. A custom agent you can inspect end to end. An agent inside someone else's product, you can barely see. Carmakers deal with the same problem when they test airbags. They don't crash one car with one dummy. They crash sedans and SUVs, at different speeds, from different angles, with dummies of different sizes, because a car that is safe in one crash can fail in another. A security control that works on one kind of agent can be blind to the other two. So this month we built a fleet of working AI agents covering all three kinds, with real sign-in, real permissions, and real guardrails, not mock-ups:
A banking agent that signs in the way a real enterprise app does, swapping the customer’s login for a separate, narrower pass for every service it calls instead of carrying one master key everywhere.
A travel booking agent that hands parts of each booking to other agents, to test what happens when agents trust each other.
A clinical agent that answers by reading from a library of medical documents.
A medical records agent that remembers what it has been told across conversations, to test what happens when that memory is tampered with.
The fleet runs across AWS and Microsoft's cloud, and every agent is tested against the attack patterns catalogued by industry frameworks such as MITRE ATLAS and OWASP. When an attack lands, it tells us exactly what NeuroShield needs to handle next, so the product is shaped by what actually breaks rather than what might. It also gives Discovery, the next NeuroShield module, real agents to learn from as it learns to find the agents a company doesn't know it has. Your teams are building agents on different platforms right now. Would one security control catch them all?
SAFEACCESSCOPILOT: ACCESS YOU CAN ACTUALLY READ
Almost every enterprise still uses Active Directory groups and application entitlements to decide who gets access to what. Many of them were created years ago, with names that made sense to IT at the time and mean nothing to a manager approving access at 9 AM on a Monday. Multiply that across a company and you get thousands of entitlements with no clear owner, no useful description, and no business context. It's like being handed a restaurant bill printed in a language you can't read and being asked to check it. You'll sign it. That's what happens in access reviews too: managers approve everything, certifications stop catching anything, auditors raise findings, and people keep access they no longer need. SafeAccessCopilot launched this month to fix that, with one workflow from start to finish: discover, enrich, validate, improve, govern.
The IAM team launches an accountability campaign: which applications, which entitlements, and who owns each one.
Entitlement owners answer five simple questions: Who typically gets this access? What task does it enable? Which business process does that task support? What is it usually bundled with? How should it be classified? It can also capture which other access should never be combined with this one, to avoid segregation-of-duties conflicts.
An LLM turns those answers into a plain-English description that anyone in the business can understand.
The IAM team checks quality before anything goes live. Every enriched entitlement is approved, rejected, or sent back to the owner with what’s missing. Only clean, complete data reaches the IGA platform.
Hierarchy is built in. Real access is nested: a group inside another group, a role that bundles several permissions. SafeAccessCopilot understands those links, maps them for each application, and shows the effect underneath when something higher up is enriched.
The payoff reaches the whole access lifecycle. Employees can search for access in business terms instead of guessing at codes. Managers approve with clear context. Reviewers can spend their time on higher-risk access, like data entry and approval rights, instead of giving read-only reporting access the same attention. The next time your managers certify access, will they be reading it, or signing it?
NEUROID: IF A PERSON CAN CLICK IT, NEUROID CAN RUN IT
NeuroID does the identity work a person would otherwise do by hand in applications your identity governance platform can't connect to. This month it took two steps forward.
Desktop applications, now automated Some of the most important applications in a company were never built for the web. HR and payroll tools, finance and billing systems installed on a Windows machine in a back office, business tools that only run as a desktop client. No API, no connector, and often no plan to ever get one. Every joiner, role change, and leaver in these systems means a person at a keyboard, clicking through the same screens. NeuroID already worked with web applications and mainframe screens. Now it works with desktop applications too. It learns the way a new team member would, from the step-by-step instructions with screenshots you'd give a new hire, then a small agent on the machine opens the application, reads the screen the way a person does, and carries out the steps. In one run, it created a new user in an HR application, then pulled every user and their access into a spreadsheet. Nobody touched the mouse. Every step is captured as a screenshot and a timestamped log, bundled into an evidence package for the auditor. The business benefit: applications that were always going to stay manual can now join automated provisioning and access reviews like everything else.
ServiceNow requests, carried out automatically Most companies route access requests through a ticketing system like ServiceNow. For an application with no connector, the approved ticket lands in someone's queue and waits until a person logs in and does the work by hand. Now NeuroID closes that gap. A request raised in ServiceNow goes to NeuroID, NeuroID carries it out inside the application, and the result comes back with logs and screenshots of every step. It has been proven end to end with SAP: creating a user, assigning a role, removing a role, and end-dating a user. The business benefit: new joiners get access without waiting in a queue, leavers lose it without anyone having to remember, and every change comes with its own evidence. That application still managed through a shared spreadsheet and someone's afternoon? If a person can click through it, NeuroID can learn it.
NEUROID: IF A PERSON CAN CLICK IT, NEUROID CAN RUN IT
Every Reviewer, One Screen
A LEADING SURGICAL SERVICES PROVIDER's annual access review is live, and NeuroID is no longer a one-time cleanup. Before the campaign launched, NeuroID enriched and matched the data going in, so reviewers started with accounts already linked to the right people. Now the IAM team opens NeuroID's campaign report every day to see who hasn't started, how far each application has moved, and which items need reassigning. It's like an airport departures board: one screen shows what's late.
The clearest sign it has stuck is how the team uses it. When the reassignment view was slow to work through, they asked for a date filter. Our delivery team added it, and the reviewer doing that task every morning felt the difference the next day. Their leadership is already planning the next use: spotting reviewers with big backlogs and booking time with them before the deadline. That is what adoption looks like: the tool stops being something new and starts being the way the job gets done.
30 min → 5 min
Daily reassignment task, after a reporting change the customer requested
In-House
Annual review cycle run by their own IAM team
Every Day
NeuroID report used to track reviewers, progress and reassignments
Before Launch
Accounts enriched and matched by NeuroID ahead of the campaign
NEUROID: IF A PERSON CAN CLICK IT, NEUROID CAN RUN IT
SERVICENOW WORLD FORUM NEW YORK
On the Main Stage With ServiceNow At ServiceNow World Forum New York, Ankush Kapoor (EVP, Solutions and Global Delivery, CyberSolve) shared the main stage with Diane Tetrault (Product Marketing Leader, ServiceNow). Their argument: AI is creating new exposures faster than any team can find and fix them one ticket at a time, so organizations have to "Shift Zero" and move toward security that runs itself.
THE CYBERSECURITY XCHANGE
A New Video Series From CyberSolve What does pushing carts in a warehouse have to do with running an enterprise IAM program? More than you'd think. That is how Amit Kumar Verma (Associate Vice President, CyberSolve) opened The Cybersecurity Xchange, a new conversation series where security leaders talk about what actually works. His first guest, a global IAM leader at one of the world's largest retailers, started his career on a warehouse floor, and it still shapes how he designs access for people. Five short segments are out:
Design for people, not systems. A warehouse worker, a pharmacist, and a corporate analyst don’t work the same way, so why give them one access experience?
“Invisible to the user. Legible to the board.” Users shouldn’t have to think about IAM, but leadership should see its value.
More capability or more adoption? When the next feature matters less than getting people to use the ones already in place.
Is RBAC dead? “Roles as a concept, yes. Roles as handcrafted furniture, no.”
Self-service password reset. Not a password problem, but “an identity proofing problem wearing a password reset costume.”
What's Next?
Where each solution accelerator is headed in October 2026 and beyond.
October'26 | In Progress | NeuroShield Agent Discovery
Finding the AI agents a company doesn't know it has. NeuroShield is learning to look where agents actually live: cloud platforms, identity providers, and code repositories, with groundwork started on a map of who and what each agent can reach.
October'26 | In Testing | NeuroID Record My Session
No instructions written? No problem. An admin records themselves doing the task once, and NeuroID learns from the recording and writes the instructions for them. Onboarding a disconnected application goes from "document it first" to "just show it".
October'26 | In Progress | NeuroID Campaign Reporting
Driven by feedback from customers running live reviews: reviewer workload exported to Excel, direct links to each campaign when one report covers several, and a refreshed report layout. Small changes that save the people running the cycle time every day.
October'26 | In Progress | SafeAccessCopilot
After its first release, SafeAccessCopilot is being hardened for wider rollout: automated testing across every workflow and full documentation, so new customers can get started quickly.