Cayosoft today announced AI-assisted forensics in Cayosoft Guardian, a SaaS deployment option for Guardian Instant Forest Recovery, and Cayosoft Group Policy Management. These new offerings accelerate ransomware investigations, support trusted recovery, and reduce the risk of malicious policy changes.
Cayosoft will showcase the new capabilities at Microsoft Ignite, Booth 5163, November 17-20, 2026, at the Moscone Center in San Francisco.
AI-Assisted Forensics Accelerates Investigations and Informs Trusted Recovery
With the new AI-assisted forensics capabilities, administrators can ask Guardian questions in plain language to determine which identities acted, what changed, and when. That evidence helps teams select a known-good recovery state that predates the compromise.
Restoring a compromised state can reintroduce attacker access or unauthorized changes. Guardian reconstructs identity change timelines, including when an AI agent was created, who created it, and how its permissions changed. Administrators control query execution, evidence interpretation, and containment and recovery decisions.
Instant Forest Recovery Introduces New SaaS Deployment Option
According to Gartner®, “Because malicious changes often predate incident detection by weeks or months, recovery efforts should combine backup data with change visibility, threat investigation and recovery validation processes. Success depends not only on having backups but also on trusting the recovered identity state.”
Guardian Instant Forest Recovery can maintain multiple standby Active Directory forests powered down in isolation. Teams can use forensic timelines to select and activate a validated standby forest, reducing the risk of restoring a compromise. The new SaaS option reduces the infrastructure teams need to deploy and maintain for forest recovery, freeing them to focus on validating recovery states and testing readiness.
Group Policy Management Replaces Unsupported AGPM With Stronger Controls
Group Policy Management helps control a ransomware distribution path. Attackers with privileged access can misuse Group Policy to deliver malicious payloads or disable defenses across devices and servers. However, Microsoft ended support for Advanced Group Policy Management (AGPM) in April 2026, leaving organizations still using it dependent on unsupported change controls.
Cayosoft Group Policy Management provides an alternative for organizations that relied on AGPM to govern policy changes. Teams can prepare policies in an offline repository, review proposed settings, and approve changes before deployment to live Active Directory. Separate editing, approval, and deployment permissions limit privilege exposure. Archived versions and approval records support audit review and rollback.
The new offerings provide:
- AI-assisted investigation that helps administrators trace identity changes and identify the likely compromise window using plain-language questions.
- SaaS deployment option for Guardian Instant Forest Recovery standby forest recovery that helps teams activate a validated, known-good Active Directory environment.
- Governed Group Policy changes with approval workflows, version history, policy analysis, and rollback across trusted and untrusted domains and forests.
AI-assisted forensics will be available Q1 2027 and is included in Guardian for current customers. The Guardian Instant Forest Recovery SaaS option will be available Q1 2027 under a separate license. Cayosoft Group Policy Management will be available now. For more information, visit cayosoft.com.
Click here to book a personalized Microsoft Ignite demonstration with Cayosoft.
Gartner, IAM Backup and Recovery Playbook, Sankalp Rastogi, Michael Hoeck, 17 September 2026.
Gartner is a trademark of Gartner, Inc. and/or its affiliates.
Related
This entry was posted on November 11, 2026 at 1:30 pm and is filed under Commentary with tags Cayosoft. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Cayosoft Launches AI-Assisted Forensics and Group Policy Management to Strengthen Ransomware Resilience
Cayosoft today announced AI-assisted forensics in Cayosoft Guardian, a SaaS deployment option for Guardian Instant Forest Recovery, and Cayosoft Group Policy Management. These new offerings accelerate ransomware investigations, support trusted recovery, and reduce the risk of malicious policy changes.
Cayosoft will showcase the new capabilities at Microsoft Ignite, Booth 5163, November 17-20, 2026, at the Moscone Center in San Francisco.
AI-Assisted Forensics Accelerates Investigations and Informs Trusted Recovery
With the new AI-assisted forensics capabilities, administrators can ask Guardian questions in plain language to determine which identities acted, what changed, and when. That evidence helps teams select a known-good recovery state that predates the compromise.
Restoring a compromised state can reintroduce attacker access or unauthorized changes. Guardian reconstructs identity change timelines, including when an AI agent was created, who created it, and how its permissions changed. Administrators control query execution, evidence interpretation, and containment and recovery decisions.
Instant Forest Recovery Introduces New SaaS Deployment Option
According to Gartner®, “Because malicious changes often predate incident detection by weeks or months, recovery efforts should combine backup data with change visibility, threat investigation and recovery validation processes. Success depends not only on having backups but also on trusting the recovered identity state.”
Guardian Instant Forest Recovery can maintain multiple standby Active Directory forests powered down in isolation. Teams can use forensic timelines to select and activate a validated standby forest, reducing the risk of restoring a compromise. The new SaaS option reduces the infrastructure teams need to deploy and maintain for forest recovery, freeing them to focus on validating recovery states and testing readiness.
Group Policy Management Replaces Unsupported AGPM With Stronger Controls
Group Policy Management helps control a ransomware distribution path. Attackers with privileged access can misuse Group Policy to deliver malicious payloads or disable defenses across devices and servers. However, Microsoft ended support for Advanced Group Policy Management (AGPM) in April 2026, leaving organizations still using it dependent on unsupported change controls.
Cayosoft Group Policy Management provides an alternative for organizations that relied on AGPM to govern policy changes. Teams can prepare policies in an offline repository, review proposed settings, and approve changes before deployment to live Active Directory. Separate editing, approval, and deployment permissions limit privilege exposure. Archived versions and approval records support audit review and rollback.
The new offerings provide:
AI-assisted forensics will be available Q1 2027 and is included in Guardian for current customers. The Guardian Instant Forest Recovery SaaS option will be available Q1 2027 under a separate license. Cayosoft Group Policy Management will be available now. For more information, visit cayosoft.com.
Click here to book a personalized Microsoft Ignite demonstration with Cayosoft.
Gartner, IAM Backup and Recovery Playbook, Sankalp Rastogi, Michael Hoeck, 17 September 2026.
Gartner is a trademark of Gartner, Inc. and/or its affiliates.
Share this:
Like this:
Related
This entry was posted on November 11, 2026 at 1:30 pm and is filed under Commentary with tags Cayosoft. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.