Cayosoft

The new executive order signals a shift: advanced AI is now a national security concern.

But the conversation is starting in the wrong place.

In AI environments, the real risk isn’t what can be patched. Its valid access being abused through weak identity controls and overprivileged non-human accounts.

Craig Birch, Principal Technologist breaks down how AI is shrinking the gap between discovery and exploitation, and why the bigger issue is how much privilege these new AI identities carry when governance is already weak.

👉Check out the full article where he dives into this further: https://okt.to/Ck8mFb

RC4 enforcement is coming in July. Are you ready?

In July 2026, RC4 will be fully disabled in Kerberos across Active Directory environments, so anything still relying on it will fail authentication. This removes a long-standing weak point that has enabled offline credential attacks against service accounts.

With June halfway over, this is the window to find what’s still relying on it before it turns into an outage.

Here’s a quick checklist on what to focus on before enforcement. 👇

Modern Active Directory recovery requires a different approach.

Restoring AD from backup is only part of the problem. Knowing you didn’t restore the compromise is the real challenge.

In practice, AD recovery often fails in ways most plans don’t account for:

🔸Trying to recover everything at once creates unnecessary complexity
🔸Restoring AD or rebuilding systems can reintroduce the attack
🔸Recovery plans are documented but rarely tested end to end
🔸RTOs and RPOs don’t hold up under real-world conditions

The result isn’t just a slow recovery. It’s uncertainty about whether you actually fixed the problem.

Modern recovery has to focus on trust, not just restoration.

This graphic outlines the key principles for achieving a clean and reliable Active Directory forest recovery. 👇

Because if you can’t validate trust, you haven’t really recovered.

Nonhuman identities aren’t new. Service accounts, API keys, tokens, and workload identities have long powered enterprise environments.

But a new type of identity is emerging and outpacing existing controls.

In his latest Forbes Technology Council article, our CEO and Founder Robert Bobel details the rise of the AI agent identity and how it’s expanding the attack surface beyond what most identity programs were built to govern.

Read the full article for insight into how organizations will need to redefine identity governance to keep pace with AI-driven identities: https://okt.to/GiREzd

We are thrilled to share Cayosoft has been named to Inc.’s 2026 Best Workplaces List.

“Being named to Inc.’s Best Workplaces list is especially meaningful because it reflects how our employees experience Cayosoft every day. The feedback consistently points to a culture built on trust, transparency, flexibility, and respect. We are committed to creating an environment where people feel supported, valued, and empowered to do great work.” - Jo Ann Scavina, Senior Vice President of Human Resources, Cayosoft.

Check out the full release for all the details: https://okt.to/LMdWoq

A single misconfigured Conditional Access policy can quietly disable MFA for every admin in your tenant.

No alert. No signal. No warning.

That’s the reality many teams are operating in with Entra ID.

Conditional Access is one of the most powerful controls in your identity stack, but without the right structure, rollout strategy, and governance, it can just as easily open gaps in your security as protect it.

In our latest blog, we break down:

🔸 How Conditional Access policies actually evaluate sign-ins
🔸 The signals that drive access decisions (identity, device, risk, location)
🔸 Practical best practices to design, deploy, and govern policies without
gaps

👉Check out the full article: https://okt.to/d301zF

Would you and your team know how to respond to an identity attack in real time?

Join us for a live, interactive Identity Attack Simulation on June 16th at 1 PM ET and find out.

Experience multiple attack techniques unfolding across Active Directory and Entra ID, where your decisions directly impact how the attack progresses.

You'll be dropped into a real attack simulation where you'll see:

🔸 The signals your environment would actually generate
🔸 How real threats disappear into everyday noise
🔸 How timing, judgment, and response change the outcome

A live leaderboard will track your responses so you can see how you stack up against your peers as each scenario unfolds.

It's a fun, hands-on way to experience how these attacks play out and how your response shapes the outcome.

👉Register here to put your instincts to the test: https://okt.to/8x5deG

31% of breaches now start with exploited vulnerabilities and most aren’t fully remediated for 43 days.

In a new SC Media op ed, Craig Birch, Principal Technologist explains how AI is collapsing exploit timelines, leaving defenders with far less time to react as attackers pivot from initial access to AD and Entra ID, abusing credentials, roles, and trust paths to operate as normal activity within identity.

📎Check out the full article where Craig outlines what security leaders should focus on now to keep up:
https://okt.to/wrkx0Z

Today we honor and remember all those who served.

Grateful for their sacrifice.