Topic starter
06/11/2026 6:36 pm
TL;DR: Cayosoft says Gartner named it a Sample Vendor in Identity Recovery and AI Agent Action Rollback, highlighting a shift from prevention-only identity security toward precise restoration of changed roles, permissions and policies. That shift matters because recovery controls must now handle human errors, ransomware and autonomous agent actions without restoring unrelated state.
Editorial analysis by NHI Mgmt Group, based on content published by Cayosoft: “Cayosoft Named a Sample Vendor for Identity Recovery & AI Agent Rollback in Gartner® Hype Cycle™ for Backup and Data Protection Technologies, 2026”.
By the numbers:
- By 2030, 70% of organizations will prioritize the recoverability of identity systems alongside preventive IAM controls, up from less than 15% in 2026.
Key questions
Q: How should teams handle identity recovery after a malicious directory change?
A: Identity recovery after a malicious directory change should restore exact objects, memberships, permissions, and policy state from a known-good baseline, not just the whole directory.
Q: Why does point-in-time restore often fail for identity incidents?
A: Point-in-time restore often fails for identity incidents because directory state is not just data, it is access state.
Q: How do AI agents change identity rollback requirements?
A: AI agents raise rollback requirements because their delegated access is often wider, more dynamic, and tied to runtime tool permissions rather than a single account.
Practitioner guidance
- Define the identity recovery blast radius Map which directory objects, attributes, group memberships, policies and authentication settings must be reversible without restoring the entire environment.
- Separate recovery from production dependencies Keep recovery consoles, backup repositories and standby forests outside the same credentials and management plane used for day-to-day administration.
- Validate recovery points before restoring Confirm that a restore point does not reintroduce privilege escalation, stale permissions or reinfection before any rollback is executed.
Bottom line: Identity incidents are different from ordinary data restores because directory state encodes permissions, policy and trust as well as content.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Identity recoverability is becoming a first-class control, not a backup afterthought. Directory state now carries business continuity, access integrity and audit trust all at once. When identity fails, applications fail with it, so recovery has to be measured by how precisely it can restore trust, not by how quickly it can restore volume. Practitioners should treat identity recoverability as part of the core control stack, not a separate storage exercise.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should an identity recovery plan prove before an incident?
A: An identity recovery plan should prove that you can restore authentication, privilege and ownership after a compromise without relying on the affected directory, secrets store or admin account. It should document break-glass access, offline backups, rotation of API keys and certificates, and a tested path to re-establish control outside the failure domain.
👉 Read our full editorial: AI agent action rollback reshapes identity recovery priorities