jain.com — data centers, connectivity and security, analyzed daily

Tag: identity and access management

  • Hexnode Synapse Tests Whether AI Agents Can Run IT and Security Work

    Hexnode Synapse Tests Whether AI Agents Can Run IT and Security Work

    TL;DR · 30-second read

    The Short Version

    A software company called Hexnode has built a system where artificial intelligence helpers do routine office tech work largely on their own. Examples include setting up a new employee’s laptop and accounts, or cutting off a computer that may have been hacked.

    The big question is how much software should do without a person clicking ‘yes.’ Hexnode says the riskiest moves, like erasing a device, still need human sign-off, and every action is recorded.

    Nobody can buy it yet. A small, invitation-only test starts later this year.

    Hexnode, the enterprise software division of Mitsogo, unveiled Hexnode Synapse on September 16, 2026, at HexCon26, its annual user conference, according to the company’s announcement datelined Munich. Synapse is described as an agent-based orchestration layer for IT and security operations. It uses specialized AI agents to turn requests, alerts and system events into coordinated, governed and traceable actions across multiple business systems.

    At launch, Synapse ships with a device agent, an identity agent and a threat agent. It connects to Hexnode’s own endpoint management, threat detection and identity products, plus ServiceNow, Zendesk, Microsoft Entra ID and BambooHR. An invitation-only trial is planned for later this year.

    Executive Summary

    Hexnode Synapse is Hexnode’s bid to move AI from answering questions to doing work. Instead of an administrator hopping between a device console, an identity directory, an HR system and a ticketing tool, Synapse’s agents read the request, decide the next step and act within limits set by the administrator. Hexnode’s headline example is a single instruction, ‘Onboard John,’ which pulls the new hire’s HR profile, creates their identity, assigns app licenses by department, pushes device and endpoint-protection settings, and logs the IT ticket.

    Hexnode makes governance the central claim. Administrator-defined guardrails, per-action approvals and an exportable execution log called the Execution Center are meant to keep agents under human control. High-impact actions, including wiping a device, isolating an endpoint from the network or changing access privileges, are routed to a designated approver before they run.

    The announcement matters because it puts a concrete product behind a question the whole security industry faces: whether autonomous software can be trusted with actions that lock people out, erase data or quarantine machines. For now, the answer rests on design claims. Synapse is not generally available, and Hexnode has not published pricing, customer names or performance data.

    The Bottleneck Is the Handoff, Not the Tool

    Hexnode’s pitch starts from a familiar complaint in corporate IT: tool sprawl. Chief executive and founder Apu Pavithran framed it plainly, noting that onboarding touches identity, devices and the HR system, and threat response touches the endpoint, user access and the incident ticket. Today, a person stitches those pieces together each time. Every handoff adds manual work and delay.

    That framing is important because Synapse does not claim to do anything a skilled administrator cannot already do. Its value proposition is coordination: carrying one request across several systems without a human copying data between screens. For a lean IT team, the gains from eliminating those context switches can be real. However, they are hard to measure from the outside, and Hexnode has not quantified them.

    Hexnode’s structural advantage is that it already sells the three systems most involved in these workflows. Those are Hexnode UEM (unified endpoint management, which configures and secures laptops and phones), Hexnode XDR (extended detection and response, which spots and contains threats) and Hexnode IdP (an identity provider, which controls who can log in to what). Synapse draws on native context from all three, which should make its agents better informed inside the Hexnode estate than a bolt-on tool would be.

    Autonomy on a Leash

    The governance design is the most substantive part of the announcement. It has three layers. Guardrails define what an agent may do on its own. Action-level approvals gate specific steps. The Execution Center records every action, whether autonomous or approved, and teams can search and export that history. Hexnode says this turns audits into a data download rather than an evidence hunt that could stretch for weeks. That is a plausible benefit for regulated organizations, though it is Hexnode’s characterization rather than a measured result.

    The harder questions sit in the details. The line between ‘autonomous’ and ‘needs approval’ is set by administrators, so real-world safety depends on sensible defaults and on how easily a busy team can loosen them. Threat containment also carries a built-in tension. Endpoint isolation is on Hexnode’s list of critical actions that require approval, yet speed is the main reason to automate incident response. How organizations balance a waiting approver against a spreading intrusion will likely shape whether the threat agent is used aggressively or cautiously.

    There is also the reasoning layer itself. Hexnode says its agents ‘reason’ about incoming requests and alerts to decide the next step. Misjudging an alert, or misreading an HR record during onboarding, could grant the wrong access or miss a real threat. Approvals and logs make such errors visible and reversible after the fact. They do not by themselves make the agents more accurate.

    A Platform Play With a Short Integration List

    Strategically, Synapse looks like a way to make Hexnode’s product suite more valuable when bought together. Organizations already running Hexnode UEM, XDR and IdP stand to gain the most. Those standardized on other endpoint, security or identity vendors get less, because the launch integrations beyond Hexnode’s own products are limited to ServiceNow and Zendesk for ticketing, Microsoft Entra ID for identity and BambooHR for HR data.

    Those are sensible first choices that cover common help-desk, directory and HR systems, but many enterprises run a wider mix. Hexnode says it will expand the integration catalog and Synapse’s core capabilities in future phases, and that customers can configure custom agents built on their own tools and knowledge sources. How far custom agents can reach, and whether the same guardrails apply to them, will determine whether Synapse becomes a genuine cross-vendor orchestration layer or remains mainly a Hexnode accessory.

    Announced, Not Yet Proven

    Synapse will enter an invitation-only trial later this year, which makes this announcement a statement of direction rather than a shipping product. The self-healing behavior Hexnode describes is a good illustration of what still needs field testing. In Hexnode’s example, a stalled onboarding recovers on its own, files a ticket when app licenses run out, and resumes provisioning once a seat frees up. It is a compelling scenario, but real IT environments are messier than demonstrations.

    For buyers, the practical takeaway is to treat the trial as an evaluation of governance as much as of automation. Useful checks include whether approvals route cleanly, whether logs are complete enough for auditors, and how often the agents pick the right next step. For the broader market, Synapse adds to evidence that endpoint and identity vendors see agentic AI as the next competitive front, and that trust controls, rather than raw autonomy, are becoming the selling point.

    Background

    Hexnode is the enterprise software arm of Mitsogo. It is best known for unified endpoint management (UEM), the category of tools companies use to enroll, configure, update and secure employee laptops, phones and other devices from one console. The company has since added Hexnode XDR, an extended detection and response product that spots and contains security threats, and Hexnode IdP, an identity provider that governs who can sign in to which applications. HexCon is Hexnode’s annual user conference, where it typically showcases new products.

    Synapse arrives as enterprise software vendors move beyond AI assistants that answer questions toward agentic AI that takes actions. In IT and security, that shift is especially sensitive. The same actions that save time, such as granting access, wiping a lost device or isolating a compromised computer, can cause serious disruption if triggered wrongly. As a result, approval workflows and audit trails have become central to how vendors present these products.

    Sources

    Source: Hexnode presenta Hexnode Synapse, que aporta orquestación basada en agentes a las operaciones de TI y seguridad, Hexnode’s announcement of its agent-based orchestration layer for IT and security operations, unveiled at HexCon26.

  • AI Agents as Digital Actors: Governance Lags Adoption

    AI Agents as Digital Actors: Governance Lags Adoption

    Info-Tech Research Group, an IT research and advisory firm, published new research on 28 August 2026 from Arlington, Virginia, arguing that enterprise AI agents should be governed as a distinct class of digital actor rather than as ordinary IT assets or as earlier generative AI models. The blueprint, Govern Enterprise AI Agents While Preserving Innovation, sets out a three-phase framework for managing agent identity, access, autonomy limits and ongoing oversight.

    The firm names five governance gaps it says organizations hit as agent use spreads: shadow AI, capability mismatch, runtime drift, unmanaged access and ambiguous ownership. The blueprint ships with a governance playbook, a charter example, an executive dashboard template and a glossary. Info-Tech says it serves more than 30,000 IT, HR and marketing leaders and has operated for nearly 30 years.

    Executive Summary

    The core claim is narrow and worth taking seriously: an AI agent does not merely produce output, it takes action. It can call systems, trigger workflows and make decisions on its own, at machine speed. That breaks the assumption underneath most enterprise AI governance to date, which is that a human reviews and approves a model’s output before anything consequential happens. Info-Tech’s position is that one-time approval gates cannot govern something that keeps operating after the gate.

    Altaz Valani, principal advisory director at Info-Tech, frames the problem in the release as a mismatch on both sides: agents cannot be governed like IT assets because they act across systems, and they cannot be governed like employees because, in the firm’s words, they move quicker and lack emotions, conscience and consequences. The practical translation is that the controls that work on people — training, incentives, accountability, the fear of being fired — have no purchase here. What is left is identity, credentials, permissions, monitoring and a defined kill switch.

    That is not a new discipline. It is the same control discipline that regulated supply chains already run under. On the same day, Nelson Miller Group announced it had earned Cybersecurity Maturity Model Certification (CMMC) Level 2, the US Department of Defense standard that obliges defense manufacturers to demonstrate control over access to sensitive information. The difference is that defense suppliers are made to prove those controls by contract, while most enterprises are deploying agents years ahead of anything comparable.

    Approval Gates Do Not Govern Things That Keep Moving

    Most enterprise AI governance was designed for a request-and-response world. A team proposes a use case, a committee reviews it, a model is approved, and a human checks the output before it becomes a decision. That control model has a hidden dependency: the risk sits still long enough to be reviewed. An agent breaks the dependency because the approval happens once and the behaviour continues indefinitely, across systems, with credentials attached.

    Info-Tech’s five named gaps are really five ways that assumption fails. Shadow AI means agents created outside sanctioned tools that IT does not know exist — the same problem as unsanctioned SaaS, except the unsanctioned thing holds credentials and acts. Capability mismatch means an agent’s autonomy and access outrun the validation and monitoring applied to it. Runtime drift means an agent quietly expands its scope as tools, prompts and permissions change, so the thing running in month six is not the thing that was approved in month one. Unmanaged access means service accounts and permissions let an agent do more than anyone intended. Ambiguous ownership means that when something goes wrong, no one is clearly accountable.

    None of these are exotic. They are the standard failure modes of any privileged non-human identity, which is why the useful reading of this research is deflationary rather than alarming: agentic AI is largely an identity and access management problem wearing new clothes. The genuinely new part is speed and volume. As Valani notes in the release, many people will have multiple agents working for them — which means identity populations that were once measured in employees start being measured in some multiple of employees.

    The CMMC Parallel: Regulated Sectors Already Do This, Under Contract

    The comparison worth drawing is with the defense industrial base. CMMC is the US Department of Defense’s framework for verifying that contractors and subcontractors protect sensitive government information; Level 2 aligns with the NIST SP 800-171 control set for controlled unclassified information, covering access control, identification and authentication, audit and accountability, configuration management and incident response. Nelson Miller Group’s 28 August 2026 announcement that it earned Level 2 certification is, in commercial terms, a supply chain credential: it is how a manufacturer stays eligible for programs that handle protected data.

    Strip away the acronym and the CMMC control families read like a specification for governing agents: know every identity, prove who owns it, restrict what it can reach, log what it did, detect when it drifts, and be able to respond. The defense supplier does this because a contracting officer requires it and an assessment verifies it. The enterprise deploying a fleet of agents has no equivalent forcing function — no customer withholding a purchase order, no assessor arriving to check the evidence.

    That asymmetry is the real story. Control discipline in enterprise technology almost never arrives because it is a good idea; it arrives because a contract, a regulator or an insurer demands proof. Agentic AI is currently in the window between capability and requirement. Firms in regulated supply chains have an unusual advantage here: the muscle memory of proving controls to a third party transfers directly to governing non-human identities. Firms without that history are building the practice from a standing start, and doing it while the agents are already running.

    What the Release Substantiates, and What It Does Not

    This is analyst research promoting a paid deliverable, and it should be read as such — evenly, without either deference or dismissal. What is substantiated is a structured method. The three phases are specific and sequenced: Phase 1 establishes governance authority, decision rights and a small set of enforceable guardrails; Phase 2 maps the agent lifecycle, discovers agents wherever they are created, classifies them by risk and defines runtime monitoring and intervention actions by risk tier; Phase 3 assigns accountability across business owners, technical owners, AI governance and enterprise risk, then defines metrics, executive dashboard reporting and a phased rollout. The named artifacts — playbook, charter example, executive dashboard, glossary — are the ordinary output of this kind of advisory engagement and are reasonable to expect.

    What is not substantiated is the scale of the problem the framework addresses. The release describes a widening gap between adoption and governance but offers no survey data, no incidence rates for shadow agents, no measured cost of a runtime-drift failure and no baseline for how many organizations currently classify agents by risk at all. It refers to case studies without naming an organization or an outcome. The assertion that agents “lack conscience and cannot be morally incentivized” is a framing device rather than a finding; it is intuitively correct and empirically untested as stated here.

    That is not a criticism of the firm — vendor and analyst releases are marketing documents by design, and this one is unusually specific about method for the genre. It does mean a buyer should treat the framework as a hypothesis to be tested against their own environment rather than as evidence that their environment is on fire. The prudent question for a CIO is not whether the five gaps sound plausible, but which of them they can actually measure in their own estate this quarter.

    Who Gains: Identity Vendors, Platform Owners and Whoever Owns the Log

    If agent governance becomes an identity problem, the commercial gravity moves toward whoever already holds the identity layer. Identity and access management providers, privileged access management vendors and cloud platforms that issue and rotate machine credentials are positioned to extend existing products rather than sell new categories. Security operations vendors benefit from the runtime monitoring requirement, since drift detection is a telemetry problem before it is a policy problem. Governance, risk and compliance platforms gain a new object type to track.

    The harder position belongs to business units that have deployed agents quickly using departmental budgets and low-code tooling. Info-Tech’s Phase 2 — find agents wherever they are created — is the phase that generates conflict, because discovery inevitably surfaces work that was never registered with IT. Organizations that treat that discovery as an audit failure will drive the remaining agents further underground; the ones that treat it as an inventory exercise will get better data.

    For infrastructure operators specifically, there is a second-order consequence worth noting. Agents that act autonomously across systems generate authentication events, API calls and audit records continuously rather than in bursts tied to human working hours. Logging, retention and monitoring costs scale with that behaviour. Governance frameworks tend to be discussed as policy; the bill arrives as storage, egress and detection capacity.

    Background

    Info-Tech Research Group is an IT research and advisory firm that publishes structured methodologies — it calls them blueprints — covering IT strategy, security and governance, alongside affiliates McLean & Company for HR research and SoftwareReviews for software buying data. Its business model is subscription advisory, so its research releases both inform the market and market the firm; that dual purpose is standard for the analyst sector and is worth holding in mind when reading any single publication.

    The wider context is a two-year shift from generative AI, where models produce content a human then uses, to agentic AI, where software is granted credentials and permitted to act. That shift moves AI from a content-quality question into an access-control question, territory enterprise security teams have worked in for decades under frameworks such as NIST SP 800-171 and, for defense suppliers, the Department of Defense’s CMMC program. The unresolved issue is timing: regulated supply chains prove their controls because contracts require it, while most enterprises are deploying agents without an equivalent obligation.

    Source: AI Agents Must Be Governed as Persistent Digital Actors, Advises Info-Tech Research Group — the firm’s 28 August 2026 announcement of its Govern Enterprise AI Agents While Preserving Innovation blueprint, with background from Nelson Miller Group’s same-day CMMC Level 2 certification release.