The IT Nerd

Cayosoft today announced AI-assisted forensics in Cayosoft Guardian, a SaaS deployment option for Guardian Instant Forest Recovery, and Cayosoft Group Policy Management. These new offerings accelerate ransomware investigations, support trusted recovery, and reduce the risk of malicious policy changes.

Cayosoft will showcase the new capabilities at Microsoft Ignite, Booth 5163, November 17-20, 2026, at the Moscone Center in San Francisco.

AI-Assisted Forensics Accelerates Investigations and Informs Trusted Recovery

With the new AI-assisted forensics capabilities, administrators can ask Guardian questions in plain language to determine which identities acted, what changed, and when. That evidence helps teams select a known-good recovery state that predates the compromise.

Restoring a compromised state can reintroduce attacker access or unauthorized changes. Guardian reconstructs identity change timelines, including when an AI agent was created, who created it, and how its permissions changed. Administrators control query execution, evidence interpretation, and containment and recovery decisions.

Instant Forest Recovery Introduces New SaaS Deployment Option

According to Gartner®, “Because malicious changes often predate incident detection by weeks or months, recovery efforts should combine backup data with change visibility, threat investigation and recovery validation processes. Success depends not only on having backups but also on trusting the recovered identity state.”

Guardian Instant Forest Recovery can maintain multiple standby Active Directory forests powered down in isolation. Teams can use forensic timelines to select and activate a validated standby forest, reducing the risk of restoring a compromise. The new SaaS option reduces the infrastructure teams need to deploy and maintain for forest recovery, freeing them to focus on validating recovery states and testing readiness.

Group Policy Management Replaces Unsupported AGPM With Stronger Controls

Group Policy Management helps control a ransomware distribution path. Attackers with privileged access can misuse Group Policy to deliver malicious payloads or disable defenses across devices and servers. However, Microsoft ended support for Advanced Group Policy Management (AGPM) in April 2026, leaving organizations still using it dependent on unsupported change controls.

Cayosoft Group Policy Management provides an alternative for organizations that relied on AGPM to govern policy changes. Teams can prepare policies in an offline repository, review proposed settings, and approve changes before deployment to live Active Directory. Separate editing, approval, and deployment permissions limit privilege exposure. Archived versions and approval records support audit review and rollback.

The new offerings provide:

• AI-assisted investigation that helps administrators trace identity changes and identify the likely compromise window using plain-language questions.
• SaaS deployment option for Guardian Instant Forest Recovery standby forest recovery that helps teams activate a validated, known-good Active Directory environment.
• Governed Group Policy changes with approval workflows, version history, policy analysis, and rollback across trusted and untrusted domains and forests.
  

AI-assisted forensics will be available Q1 2027 and is included in Guardian for current customers. The Guardian Instant Forest Recovery SaaS option will be available Q1 2027 under a separate license. Cayosoft Group Policy Management will be available now. For more information, visit cayosoft.com.

Click here to book a personalized Microsoft Ignite demonstration with Cayosoft.

Gartner, IAM Backup and Recovery Playbook, Sankalp Rastogi, Michael Hoeck, 17 September 2026.

Gartner is a trademark of Gartner, Inc. and/or its affiliates.

Cayosoft today announced the launch of Cayosoft Microsoft Migration Services, a new offering designed to help organizations modernize Active Directory, Entra ID, and Microsoft 365 with greater control, lower risk, and stronger long-term outcomes. Delivered in partnership with XMS Solutions, a long-time provider of migration and cybersecurity services, the offering pairs expert migration delivery with Cayosoft’s platform for management, monitoring, and recovery to enable full-lifecycle identity modernization.

Cayosoft’s proven track record of helping customers—including the Department of War, the IRS, and AAA—modernize identity administration and recovery across hybrid Microsoft environments repositions migration and consolidation–-often driven by mergers and acquisitions (M&As)—as a structured modernization milestone, helping organizations move beyond one-time project thinking toward a continuous, resilient operating model. The Microsoft Migration Service offering provides end-to-end migration services for Active Directory, Microsoft 365, Exchange, SharePoint, Teams, and related identity infrastructure, combining proven execution with pre- and post-migration capabilities.

Cayosoft Launches Microsoft Migration Services to Redefine Identity Modernization

Specifically, Cayosoft Microsoft Migration Services include:

• Pre-migration assessments that identify risks, dependencies, and readiness gaps across identity, collaboration, and infrastructure environment.
• Structured, phased migration execution designed to reduce disruption, shorten coexistence, and ensure predictable outcomes.
• Validation of data integrity, permissions, metadata, and version history across Microsoft 365 workloads.
• Post-migration monitoring, governance, and recovery capabilities to support long-term operational resilience. By integrating these capabilities into a single approach, organizations can modernize identity and collaboration platforms while reducing migration risk, simplifying hybrid environments, and strengthening security and compliance outcomes.

Cayosoft Microsoft Migration Services is available starting May 2026. For more information, please visit: https://www.cayosoft.com/support/active-directory-migration-microsoft-365-consolidation/

Cayosoft today reported record growth, product innovation and customer momentum in 2025. Cayosoft significantly expanded its presence across enterprise and government sectors, adding the Internal Revenue Service (IRS), U.S. Department of War (DoW), CCL Industries, athenahealth, Australian Trade and Investment Commission, and Heartland Coca-Cola, among others. The company also invested in new technology innovations and earned industry accolades from Gartner, CISA, and other organizations.

Used by 90% of large organizations worldwide, Microsoft Active Directory and Entra ID remain the backbone of enterprise identity, serving as the central hub for managing permissions, logins, and access. Cayosoft delivers the industry’s only unified solution for identity security and operational resilience that supports all on-premises and cloud Microsoft environments, including Active Directory, Entra ID,  Microsoft 365, and Intune. 

In addition to expanding its customer base, Cayosoft achieved other significant milestones and accolades last year, including: 

Industry Recognition & Analyst Validation 

In 2025, Cayosoft earned expanded industry and analyst acclaim, including:

• Named a finalist for the InfoWorld 2025 Technology of the Year Award in Cloud Backup and Disaster Recovery.
• Affirmed the technical and economic advantages of Cayosoft Guardian Instant Forest Recovery by analyst firm Paradigm Technica, validating that the Cayosoft solution is at least 99% faster than specialized or general-purpose alternatives—setting a new industry benchmark for identity resilience.
• Featured in seven Gartner reports in the last 12 months, including a newly released January 2026 report, Market Guide for Microsoft 365 Governance Tools, reinforcing Cayosoft’s growing influence and credibility with prominent analysts and enterprise buyers. 
• Recognized by CISA and listed on the Secure by Design page, validating Cayosoft’s secure-by-default approach to identity governance and resilience.

Product Adoption, Innovation & Velocity

Cayosoft’s innovation engine saw one of its biggest years ever:

• Secured SOC 2 Type II certification, reinforcing its commitment to enterprise-grade security and compliance and confirming that Cayosoft maintains robust, independently audited security controls that perform effectively over an extended period.
• Delivered over 148 net-new features and enhancements in Cayosoft’s core platform in 2025, reflecting one of the most active innovation cycles in the company’s history.
• Released Cayosoft Guardian Protector, the industry’s first free, always-on threat detection for Active Directory and Entra ID. 
• Announced the upcoming Cayosoft Guardian SaaS to be generally available in Q2 2026.

Business Momentum, Customer Expansion & Adoption 

Cayosoft reported 76% year-over-year annual recurring revenue growth, driven by:

• A significant increase in net-new enterprise customers and expanding adoption across highly regulated industries and complex environments. 
• Continued strength in legacy AD vendor tool replacement business from Quest Software and Semperis.
• Strong demand and traction from large enterprises and state, local and federal government organizations, including:

• Heartland Coca-Cola
• Australian Trade and Investment Commission
• Los Angeles County Employees Retirement Association (LACERA)
• CCL Industries
• athenahealth
• Internal Revenue Service (IRS)
• U.S. Department of War (DoW) 
• Yukon Hospital Organization

For more information about Cayosoft’s solutions for managing and protecting the modern Microsoft enterprise, visit cayosoft.com.  

 Cayosoft today announced a pivotal expansion in the deployment of its flagship platform–Cayosoft Guardian SaaS. Unveiled live at Microsoft Ignite 2025 (Booth #5332), this milestone marks a major evolution in identity security—empowering enterprises to detect, respond, and recover instantly, even when infrastructure is under attack.

The cloud delivery model builds on Cayosoft’s explosive business momentum and its continued recognition as a Representative Vendor in six Gartner reports over the past 12 months. For the first time, enterprises can now deploy the same award-winning Cayosoft Guardian hybrid-identity protection they trust as an always-on, maintenance-free service. Built for zero downtime and zero compromise, it brings continuous visibility, real-time threat detection, and instant rollback capabilities as a secure, fully managed cloud platform. The new SaaS deployment model will be generally available in Q1 2026.

A Significant Milestone in Hybrid Identity Protection
Modern enterprises face mounting risk from hybrid management complexity, misconfiguration, and cyber attacks. With Cayosoft Guardian SaaS deployment, organizations can maintain operational continuity and trust through continuous monitoring, automated alerting of misconfigurations and drift, and sustained resilience with instant rollback of unwanted changes, without maintaining on-premises systems.

Cayosoft Guardian SaaS Capabilities

• Continuous Hybrid Change Monitoring: Real-time visibility of security drift and full audit trail across Active Directory, Entra ID, Teams, Intune, and Exchange Online, with instant rollback and recovery for any object or attribute.
• One-Click Rollback & Automated Remediation: Reverses malicious or accidental changes in seconds to maintain uptime and compliance.
• Fully Managed SaaS Delivery – Enterprise-grade protection with no infrastructure overhead, automatic updates, and built-in resilience.
• Audit-Ready Reporting: Simplifies compliance for SOX, HIPAA, and GDPR, with detailed change history and evidence trails.
• Zero-Trust Enforcement: Role-based access controls ensure privileged changes are authorized and verified.

Momentum and Market Validation
Cayosoft’s growth trajectory underscores the accelerating demand for hybrid identity continuity. Following triple-digit revenue growth in FY24 and 60% year-over-year growth in FY25, the company continues to expand globally across regulated sectors including healthcare, government, and financial services.

Reinforcing the credibility of Cayosoft’s solutions, the company has been recognized as a Representative Vendor in six Gartner reports within the last 12 months, including:

• Enhance Cybersecurity and Resiliency by Extending the Discipline of ITDR, 2025
• Reduce Your IAM Attack Surface Using Visibility, Observability, and Remediation, 2025
• A Well-Run Active Directory Requires Strong Identity Controls, 2025
• Hype Cycle for Backup and Data Protection Technologies, 2025
• Microsoft Intune  – The Top 10 Considerations, 2025
• Address Top IAM Hygiene Issues to Enhance Security and Reduce Risk, 2024

According to Gartner Peer Insights, Cayosoft Guardian received exceptional customer ratings, including 5/5 rating for Integration & Deployment and 4.8/5 rating for Product Capabilities and Support, further validating its ease of use, robust alerting, and operational reliability.

Cayosoft Guardian SaaS will be generally available in Q1 2026. Cayosoft will continue to develop and support on-premises versions of Cayosoft Guardian and Cayosoft Administrator.

Attendees at Microsoft Ignite 2025 can experience live demonstrations of hybrid identity monitoring and instant rollback at Booth #5332 or at the virtual booth.

To learn more or register interest in the SaaS deployment, visit www.cayosoft.com.

It’s coming to the end of the year which means it’s prediction season. I’ll be gathering up all of the predictions for 2026 bringing them to you for your reading pleasure. Here are three predictions from Craig Birch, Technology Evangelist & Principal Security Engineer and Dmitry Sotnikov, Chief Product Officer at Cayosoft:

#1 AI tool sprawl will fuel a rise in shadow AI and a push to standardization. As organizations quickly adopt new AI tools, many are finding that identity chaos is becoming a big concern. This is fueled by employees in a rush to adopt AI tools to support business productivity but are doing so under their own personal accounts. These AI -powered tools are taking advantage of often over-provisioned access, and performing unintended tasks without much formal oversight and control. This is particularly concerning for IT management, where consequences can be dramatic and affect multiple employees and applications. With employees managing too many logins and the rise of inconsistent access rights, IT teams are losing visibility over who has access to what – resulting in security blind spots due to the complexity and fast evolution of AI systems. IT teams will be forced to find solutions to gain better visibility and control to address and mitigate these vulnerabilities effectively. create security blind spots, forcing IT to uncover more ways for visibility and control and ultimately close this gap.

In 2026, this AI tool sprawl will drive a major push toward identity standardization, with enterprises consolidating access control and governance around Active Directory and Entra ID as their single source of truth. The era of “plug-and-play” AI adoption will give way to a new focus on governance, compliance, and secure integration. Dmitry Sotnikov, Chief Product Officer, Caysoft

#2 Organizations will start closing the AD security age gap.  Active Directory is still the foundational infrastructure for most enterprises, with 90% of organizations still using it as their primary identity provider. With many of the admins who know AD recovery and management  nearing retirement, a real capability gap will emerge. We will see an increased focus on security teams prioritizing Active Directory (AD) recovery, and with that, I predict an increased adoption of solutions that prove and increase the speed of recovery, and reduce the likelihood of failure. In 2026 we will also see organizations turn to AI to help address the people training challenge runbook validation where it makes sense. However, it’s too early to rely solely on AI to close this critical gap, therefore, I also predict traditional recovery companies will purchase identity companies to increase their capabilities and gain a foothold in this market space.” Craig Birch, Technology Evangelist & Principal Security Engineer, Caysoft 

#3 Instant recovery will define resilient enterprises. The Vodafone outage showed how quickly disruption can cripple connectivity and trust. People and businesses across the UK  were reminded how fragile dependencies can be in a connected world. In 2026, downtime tolerance will vanish. Customers and employees will expect systems that recover instantly. In practice, this means embedding instant recovery mechanisms—auto-rollbacks, standby environments, and transparent failover paths—into identity and access infrastructure. Enterprises that bake this resilience into their identity infrastructure will win in uptime, trust, and operational continuity. Craig Birch, Technology Evangelist & Principal Security Engineer, Caysoft

Cayosoft today introduces Cayosoft Guardian Protector, the industry’s only free, always-on solution that delivers real-time threat detection, proactive alerts, resolution guidance, and change history for complex Microsoft hybrid identity environments. Unlike other free solutions that offer point-in-time scans without alerts, Cayosoft Guardian Protector offers administrators and security teams continuous, real-time visibility and control across Active Directory (AD), Entra ID, Microsoft 365, Microsoft Teams, Microsoft Intune, and Microsoft Exchange Online.

More than 90% of large enterprises run Microsoft Active Directory and Entra ID, making them prime targets for ransomware and insider attacks. As seasoned AD engineers retire, IT teams are left with fewer resources to monitor the growing complexity. Meanwhile, the attack surface keeps expanding into Teams, Intune, and Exchange Online, creating blind spots attackers exploit. Most tools can’t keep up, offering partial visibility, delayed alerts, or costly licenses. Cayosoft Guardian Protector closes that gap.

Alongside Guardian Protector, Cayosoft is also introducing two powerful new resources to help the IT and security community stay ahead of attackers. The Cayosoft Guardian Reddit Community gives admins, security architects, and engineers a dedicated forum to collaborate, share expertise, and solve problems together. The Cayosoft Threat Directory delivers continuously updated intelligence on hybrid identity attack techniques and detection patterns. 

Together with Guardian Protector, these resources create a more powerful, comprehensive defense, blending real-time detection with community expertise and actionable intelligence. IT and security teams gain not only the tools to stop threats as they happen, but also the shared knowledge and foresight to stay ahead of whatever comes next.

Cayosoft Guardian Protector key benefits and features include:

• Spot Threats Instantly. Detect risky, suspect changes as they happen with real-time detection and alerts: privilege escalations, dormant account activations, Group Policy tampering, and more.
• See Every Change. Continuous Monitoring across AD, Entra ID, Intune, Teams, and Exchange Online gives unprecedented visibility of every change, resulting in fewer blind spots, faster investigations, and more substantial alignment of compliance across your identity infrastructure. 

• Unlimited Coverage. Monitor every change of every identity object, every second without caps or license restrictions. 

Download Caysoft Guardian Protector for free.