Ivanti Blog

August 2026 Patch Tuesday

Tue, 11 Aug 2026 20:14:02 Z

Regardless of what everyone thinks about AI, it’s clear that patch acceleration based on identified vulnerabilities is forcing the patch management industry to deal with the Patch Apocalypse. The magic question is how do you deal with it when even Microsoft is recommending a three-day turnaround on patching to stay ahead of the ‘AI-accelerated’ threats? The challenge is that large enterprises are constrained by testing, change control and compatibility requirements. That challenge needs to be addressed by building a process to deploy patches that matter to mitigate risk in days and stay disciplined for everything else.

The first step in this new process is to understand that not all CVEs are created equal. The patches need to be triaged to identify those CVEs that require immediate attention including those tied to known exploitation or disclosure, known malware, CISA’s KEV list, or internet-facing or unauthenticated vulnerabilities, etc. Once these CVEs are identified you can build a list of the patches to consider immediately for your environment. But you need to remain disciplined and remember even CVEs with high CVSS scores which are not exploited or are not internet facing can be handled in a second round of patching. Everything else can be addressed in a normal patch management sequence for your organization which may occur in two to three weeks. This breakdown is roughly how Ivanti Neurons handles patching with the Zero-day patch cycle meeting that three-day Microsoft standard; the Priority patch cycle happening every two weeks, and finally regular maintenance occurring roughly every three weeks or once a month.

Triaging the patches is not the only step in this new process. You need to know your environment and understand your exposure to the triaged CVEs. Based on your network knowledge, you should prioritize internet-facing and remotely exploitable systems first. Systems deeper in your environment may be able to be patched in a broader second wave. Don’t forget to consider the operational impact and disruption risk associated with key business systems; some systems may be more sensitive to patching. Armed with this knowledge you should be able to prioritize and organize systems into priority groups for patching. You can now assign patches and systems to the three patch cycles mentioned earlier. But wait!

The final step in this process is to develop a methodology to test (as needed) before deployment. History has shown that patch quality and impact of patch installation varies wildly on many factors. As an organization only you can decide how much testing is required. Questions to consider include 1) how much test time is available before our next maintenance window opens; 2) can we maintain a minimal smoke-test suite for critical systems so we are not running blindly on live systems 3) can we identify systems which are less sensitive to patches and build a fast-track smoke-test for quick turnaround; 4) and many more. The test methodology needs to match up against the proposed patch cycles to make the final decisions on how fast to run. For example, can we test the latest OS patches containing zero-day CVEs for running on critical business servers and have them deployed in three days? Ideally yes we want to, but in reality, there are security versus operational risks which may dictate another patch cycle.

In summary, only a small fraction of disclosed vulnerabilities are ever confirmed as exploited in the wild. The goal here is to test and deploy the patches addressing the highest risk systems first and methodically working through your entire corporate environment. The process needs to move quickly because another round of software updates is just around the corner in the Patch Apocalypse.

Microsoft’s exploited vulnerabilities

There is one reported exploited vulnerability this month. CVE-2026-68820 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock, rated Important. Microsoft confirms this is being exploited in the wild. This driver has been a recurring target for local privilege-escalation bugs throughout 2026, and past vulnerabilities in this component have let an authorized attacker win a race condition to gain SYSTEM privileges.

Microsoft’s publicly disclosed vulnerabilities

There are two publicly disclosed vulnerabilities of interest this month. CVE-2026-62832 is an elevation of privilege vulnerability in the Windows User Profile Service, rated Important. This is the flaw behind "LegacyHive," the unpatched proof-of-concept released by researcher Nightmare-Eclipse just hours after July's Patch Tuesday. This vulnerability lets a standard user coerce the User Profile Service into loading another user's registry hive — including an administrator's — to gain unauthorized access to that user's Classes registry data.

CVE-2026-72971 is a tampering vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys), rated Important. Public disclosure ahead of a patch means exploit code could follow quickly; organizations running Windows containers, build agents or CI infrastructure on affected hosts should prioritize this update appropriately.

Ivanti security advisories

Ivanti has released two security updates for August. The updates affect Ivanti Endpoint Manager and Ivanti Neurons for Mobile Device Management. They resolve a total of three CVEs. More details and information about mitigations can be found in the August Security Advisory.

August update to-do list

Revisit your Apple devices to confirm the latest patches from August 6th have been deployed. Likewise, double-check Oracle Java and other Oracle apps were updated from the monthly CPU release. Also, remember Oracle is releasing security updates monthly now.
The priority this month is to patch the Windows operating systems. The Winsock vulnerability CVE-2026-68820 is being exploited in the wild and impacts all operating systems from Windows Server 2012 to the latest versions of Windows 11 and Server 2025 — patch immediately. These updates will also address CVE-2026-62832 which has been disclosed with no official patch for more than a month. It's fixed as of today's release, so treat these OS updates as a priority.

August 2026 Security Update

Tue, 11 Aug 2026 14:23:41 Z

Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and Ivanti uses leading technologies to proactively find and fix issues ––including integrating advanced LLMs into our Engineering and product security to enhance the capabilities of our teams.

Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Neurons for MDM and Endpoint Manager (EPM).

It is important for customers to know:

We have no evidence of these vulnerabilities being exploited in the wild.
These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

How AI will affect vulnerability disclosures in our products

Ivanti continues to explore, test, and implement leading technologies and processes in every stage of our product development. In recent months, our security team began a project to integrate multiple advanced LLM models into our product security processes.

This project has increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities, especially those that are difficult to identify with traditional tooling, such as SAST and DAST. We have already successfully identified vulnerabilities which traditional tools missed.

As these tools are integrated further into our processes and refined, we expect an increase in vulnerability disclosures. We will continue to share transparently what we have found and resolved to ensure the security of our products. If you are not already following our Security Blog or subscribed to receive alerts for updates on the products you own through the Ivanti Innovators Hub, we highly recommend you do so.

Importantly, we are committed to using AI responsibly in product security, including keeping a human in the loop to verify automated or agentic work. While this will result in an uptick in disclosures, we see this as a good thing, and an important part of ensuring our products keep pace with modern security requirements as they change.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

How to Build and Scale Unified Asset Intelligence for AI Success

Thu, 06 Aug 2026 04:00:02 Z

Every IT leader has felt this tension: your organization has invested in AI, automation and digital operations, and yet outcomes still fall short of expectations. Even with the right tools and intent, you won’t be able to fully realize the value of your AI investments if they’re built on an unsteady foundation.

The data confirms this challenge. Ivanti’s 2025 AITSM research found that 89% of organizations say siloed data negatively impacts IT operations, and 44% cite security and compliance concerns as barriers to IT automation. Ivanti’s 2026 AI Maturity Report reinforces the same pattern: 57% of organizations reported improved knowledge sharing between IT and security and 53% reported easier data sharing after establishing a unified AI approach based on a system of record.

PwC's 2026 Digital Trends in Operations Survey adds a broader operations lens: 89% of operations leaders say technology investments haven’t fully delivered expected outcomes, and 87% report that poor data quality has limited value realization from their digital initiatives.

The pattern is consistent: AI and automation can only move as fast as the data foundation beneath them. When asset data is fragmented, stale or disputed, teams may collect more signals but still lack the confidence to prioritize, automate or prove results.

The pattern is consistent: AI and automation can only move as fast as the data foundation beneath them.

The goal is not simply to see more assets, but to create an operational system of record that acts as a data authority for what exists, what matters, what should happen next and whether the outcome was achieved.

That system-of-record foundation is also what makes agentic AI practical. As organizations adopt AI-driven workflows, human oversight, policy controls, and auditable decision paths remain essential for maintaining trust and accountability. Autonomous action depends on current context, clear policy, and a reliable decision trail. Without those conditions, AI may accelerate activity without improving control.

The Ivanti Neurons Platform addresses this problem directly to help IT and security teams turn fragmented operational signals into a trusted system of record, a contextual foundation for AI-assisted workflows and governed automation that helps teams scale action with control.

Ivanti’s 2026 AI Maturity Report reinforces the point. AI adoption is accelerating, but governance has not always kept pace. More than half of organizations reported that they deploy AI broadly across IT workflows or at business-critical scale. Yet only 42% of those same respondents say accountability for AI decisions is clear. Even more disconcerting, just 24% say AI policies are followed very consistently in day-to-day work.

The next phase of AI in IT will not be defined by who experiments fastest. It will be defined by who can scale automation responsibly, with trusted data, clear accountability, policy-aware workflows and evidence that actions produced the intended result.

"Deploying AI is no longer the hard part. The real challenge is scaling it responsibly.”

— Brooke Johnson, Chief Legal Counsel and SVP, HR & Security, Ivanti

That shift does not require organizations to solve every data, automation and governance challenge at once. It requires a practical starting point, a clear baseline and a repeatable model that can expand as confidence grows.

That is where the framework begins. It gives teams a way to move from aspiration to execution without turning unified asset intelligence into a large, abstract transformation program. The sequence is simple: establish trusted truth, connect it to decisions, act through governed workflows, verify outcomes and repeat the model at greater scale.

A 6-step framework for building unified asset intelligence

Step 1: Start with one high-value use case

Endpoint management is often the best place to start because it is operationally familiar and strategically important. Visibility gaps quickly become security, compliance, and productivity issues. By identifying managed, unmanaged, remote, BYOD, and non-compliant endpoints, organizations can reduce exposure, improve compliance confidence, and create a trusted baseline for action.

The objective is not to discover everything at once. It is to prove that better asset intelligence can change decisions and outcomes in one high-value area, then use that proof point to build organizational confidence and expand the model.

Step 2: Establish a baseline

Before teams act on new intelligence, they need a shared view of the current endpoint reality. A simple baseline clarifies what is known, what is stale, what is missing, and where action should be prioritized. Capture the current state across five areas:

Inventory accuracy
Data freshness and update frequency
Consistency of definitions across teams
How endpoint data flows into ITSM, ITAM, cloud platforms and SaaS systems
Whether actions and remediations can be verified

This baseline becomes the reference point for measuring progress and building trust. Many initiatives stall because teams do not agree on what is accurate, current, or complete. Others stall because ownership, governance, or change management is unclear. Unified asset intelligence succeeds when trusted data is paired with clear processes and defined ownership and accountability.

Step 3: Connect live data to a trusted operating context

With the endpoint focus and baseline defined, the next step is to connect current signals into a trusted operating context. Discovery and integration capabilities continuously pull and normalize asset signals from managed and unmanaged data sources, including remote endpoints, BYOD devices, cloud resources and SaaS applications. This allows teams to work from a consistent, up-to-date view of their entire environment. The value is not discovery for its own sake; it is reducing uncertainty so teams can trust the decisions that follow.

Step 4: Prove value through closed-loop automation

The value of asset intelligence becomes visible when it changes what teams do next. Many organizations can identify issues, but struggle to act consistently because the data is disputed, the workflow is manual, or the outcome cannot be verified. Closed-loop automation connects the decision to the action and confirms the result.

Start with one or two closed-loop workflows that deliver immediate benefit, such as:

Patching high‑risk vulnerabilities as soon as affected endpoints are detected
Isolating non‑compliant or unmanaged devices and restoring them automatically once corrected
Reclaiming unused software licenses based on verified usage data
Keeping lifecycle management and contextual relationships records current
Automatically closing ITSM tickets once remediation is confirmed

Ivanti has experienced this progression internally through its "Customer Zero" approach, using its own platform and automation capabilities within enterprise operations. According to Tony Miller, Vice President of Enterprise Services at Ivanti, as AI capabilities expanded, trust in the underlying system grew alongside measurable operational results. The experience reinforced a common pattern seen across mature organizations: consistent value comes not from automation alone, but from integrating automation into trusted operational workflows supported by governance, accountability, and verified outcomes.

Each closed loop demonstrates the platform’s role in practical terms: trusted data informs the decision, governed automation carries out the action and verification confirms the outcome. This is the difference between activity and control.

Before launching, agree on one or two proof points that matter to your stakeholders s upfront, such as reduced time to identify unmanaged endpoints, faster remediation of high-risk devices, fewer stale asset records or stronger confidence in compliance reporting. These become the baseline against which you’ll prove the model.

Step 5: Scale by repeating the model

Once the endpoint model works, scaling becomes additive rather than disruptive. Teams can extend the same truth, decision, action, and verification pattern to additional endpoint types, business units, cloud environments, SaaS applications and security data sources.

The important shift is reuse. Teams are not reinventing the model each time; they are applying a proven operating pattern to new domains while strengthening the shared system of record beneath them.

Each expansion improves the quality of operational context available to people both teams and AI-assisted workflows / AI agents, making governed automation more reliable as scope increases.

Step 6: Make unified asset intelligence part of daily operations

Over time, unified asset intelligence becomes part of daily operations, not a separate visibility project. Trusted truth drives decisions, decisions trigger action and outcomes remain under control through continuous verification. Endpoint teams enforce policy consistently. IT operations resolve incidents faster. ITAM teams optimize cost and lifecycle decisions with confidence. Security teams understand exposure in context. Compliance teams work from audit-ready evidence instead of manually assembled, point-in-time reports.

This is the operating model organizations need as agentic AI becomes part of IT execution: a trusted system of record, governed automation, and evidence that every action can be explained and verified.

Scaling AI-ready asset intelligence

Organizations rarely fail because they lack information. They struggle because information is fragmented, decisions lack shared context, workflows depend on manual effort and outcomes are difficult to verify. Unified asset intelligence addresses those gaps by connecting operational truth, decision-making, execution and accountability in one repeatable model.

The most effective teams start small, prove the model, and scale with confidence. Endpoint management is a practical starting use case because the risks are visible, the actions are concrete and the outcomes can be measured.

The Ivanti Neurons Platform is designed to support that journey by providing a trusted foundation for operational truth, AI-ready context for agentic workflows, and governance that keeps automation accountable as your team goes from AI aspirations to scalable AI deployments that produce measurable results.

Not sure where your asset data stands today?

Get our Evaluation Guide for Unified Asset Intelligence and Continuous Discovery to assess your readiness for unified asset intelligence.

The Industrial Mobile Browser Built for Supply Chain Work

Wed, 05 Aug 2026 08:00:05 Z

Warehouse workers don’t think about whether their mobile interface runs on a browser. They’re focused on getting the job done. But for operations and IT teams evaluating or upgrading mobile technology in supply chain environments, platform choice matters more than most people realize.

Consumer mobile browsers such as Safari, Edge and Chrome are useful tools designed for everyday web use. They help people search, shop, read, collaborate and access web applications from almost anywhere. That versatility is exactly what makes them the wrong choice for the warehouse floor.

Work in the supply chain and other industrial operations is different. Workers are using rugged handheld devices, wearable data-capture systems, vehicle-mounted computers and tablets built for long shifts, fast barcode scanning and repeated task transactions. They aren’t browsing the web. They’re completing assigned task workflows.

So, the question operations managers need to ask isn’t, “Can this page open in a browser?” The better question is, “Can this browser help my team complete tasks faster, more accurately and with fewer distractions?”

What makes an industrial mobile browser different?

Supply chain teams need an industrial mobile browser built for how supply chain work is done. Instead of treating WMS, ERP and other enterprise applications as ‘just another website,’ the right browser shapes the worker experience around the realities of the floor: scanning barcodes, entering data into specific fields, connecting with adjacent peripherals, completing workflows and immediately moving to the next task.

In a receiving or put-away task, the worker scans an item, confirms the quantity, captures the location and moves on to the next task. In a consumer browser, that experience depends on how the page renders, how the keyboard appears, whether the right field is active and whether the scan data lands where it should. Each friction point may seem minor in isolation. But across hundreds of tasks, thousands of data entry fields and an entire shift of workers, even small inconsistencies add up to significant lost labor hours.

To minimize those productivity risks, operations need mobile web browsing that supports task-specific keyboard experiences, barcode data parsing and workflow automation that consolidates steps. Instead of asking workers to adapt to a generic browsing experience, operations teams need a browser interface that adapts the experience to the task. That matters when the goal isn't simply to display a screen, but to keep goods moving accurately.

Why warehouse operations need a controlled browser experience

Consumer browsers are built for flexibility across varied consumer use cases. But in the warehouse, flexibility becomes a liability. Workers don’t need address bars, open navigation or access to unrelated sites while they’re picking, packing, receiving or replenishing. They need a controlled experience designed to keep them focused on completing tasks within approved workflows.

Connecting warehouse workflows to enterprise systems

Device consistency is another operational reality consumer browsers can’t address. Warehouses rarely run on a single form factor. A team may use a mix of rugged mobile devices, wearable scanners and vehicle-mounted computers across a single shift.

Ivanti Velocity is built to support a consistent workflow experience across varying mobile screen sizes, so operations teams can standardize how work gets done without requiring workers to relearn navigation every time they pick up a different device. That consistency is especially valuable for seasonal workers and new hires, where onboarding speed directly affects output.

The right mobile browser also reduces operational risk when integrating with enterprise systems. Ivanti Velocity is built to work with mission-critical supply chain environments — including SAP, S/4HANA and EWM — while preserving existing host systems without requiring modifications to the applications your operations already depend on. Choosing the right industrial mobile platform protects and extends the value of systems your business already depends on.

Different by design

Ultimately, consumer browsers are built for consumer use cases. Ivanti Velocity is built for throughput, accuracy and uptime in supply chain operations. That distinction isn't just technical but operational.

When a picker completes a task without extra taps; when a scan is parsed correctly the first time; when a worker stays in the workflow instead of backing out of it, the browser has done more than render a page. It's helped protect productivity.

For supply chain and warehouse operations managers, that's the real measure. The right browser shouldn't only support daily workflows. It should improve them.

Ready to move beyond consumer browsers? Learn more about how Ivanti Velocity helps supply chain teams work faster and smarter

5 Generative AI Security Risks Compliance Teams Need to Know

Mon, 27 Jul 2026 10:00:07 Z

Your employees aren't trying to create compliance incidents by using AI tools. They're trying to finish their work faster. According to a 2026 BCG survey, 74% of frontline employees now use generative AI every day or a few times a week. When an employee uses an enterprise AI assistant to summarize a customer contract before a meeting, another pastes application logs into a public generative AI tool to troubleshoot an issue, or a developer relies on an AI coding assistant connected to an internal knowledge base, each action moves organizational data into a new processing pipeline that traditional security and privacy programs were not designed to govern.

Unlike traditional applications, generative AI processes retrieve enterprise data, maintain context, create new content and may log interactions for improvement or audit purposes. Each of these stages introduces a potential exposure point and broadens your organization’s attack surface.

For data privacy and compliance teams, the use of generative AI in the workplace raises new questions they may not be able to easily answer during your next inquiry or audit such as: who authorized that AI tool to process this data, where did it go and how long was it retained? For CISOs and privacy officers, that gap between what employees do and what governance programs currently cover is where generative AI security risks arise. The issue is no longer whether to adopt AI, but whether organizations understand where their data goes once AI enters the workflow.

What are the security risks of generative AI?

Generative AI is more than another enterprise application. It changes how organizational data is accessed, interpreted, shared and retained. Generative AI systems interact with prompts, internal repositories, conversational context and generated outputs, creating new exposure points if those interactions are not properly governed.

Key security risks include:

Sensitive data leakage: Employees may unintentionally share confidential information, source code, customer records, or intellectual property with shadow AI tools that are not approved to process that data.
Prompt injection attacks: Malicious prompts or hidden instructions can manipulate AI behaviour, bypass safeguards, retrieve unauthorized information, or generate misleading responses.
Unauthorized data retrieval: If knowledge sources have broad or misconfigured permissions, AI applications may expose documents users should not be able to access.
Context and conversation leakage: Without session isolation and memory controls, sensitive information shared in one interaction may resurface later in the same conversation or influence future responses.
Weak logging and retention controls: Prompts and outputs can contain sensitive business or personal data. Without defined retention, masking and access controls, logs can become new repositories of regulated information.

These risks may look technical, but they are primarily governance challenges. Generative AI amplifies existing gaps in data classification, identity and access management, monitoring and information governance. Organizations that know where sensitive data resides, who can access it, and how it should be protected are better positioned to adopt AI securely.

How generative AI affects data privacy

Generative AI changes how organizations collect, process, store and share data. Unlike traditional applications with defined processing paths, generative AI systems interpret prompts, retrieve information from multiple sources, generate new content, and may retain interactions for monitoring, auditing, or service improvement. This expands how sensitive data moves through the enterprise.

Key privacy challenges include:

Greater exposure of personal and confidential data: Employees may include personal data, customer records, financial data, or intellectual property in prompts, potentially moving that data outside direct organizational control.
Expanded processing scope: AI applications often combine prompts with data from internal repositories and business systems, raising questions around purpose limitation, data minimization and access governance.
New retention obligations: Prompts, outputs and system logs may contain regulated or confidential data, requiring clear rules for retention, access and secure deletion.
Higher risk of unauthorized disclosure: Weak access controls, prompt injection, or overly broad retrieval mechanisms can expose information users were never intended to process.

Generative AI does not change the core principles of data privacy; it makes them harder to apply consistently. Data minimization, purpose limitation, transparency, security of processing and accountability must now extend across the full AI data lifecycle.

The five data-flow risks security risks introduced by gen AI

1. Training data leakage

When employees use public AI tools with confidential pricing, customer records, source code, or internal documents, sensitive data can leave the organization’s governed environment. Even if the provider does not use the data for training, the organization may lose visibility into how that information is processed, retained, or shared. The leadership question is simple: should this data have entered an AI system at all?

2. Prompt injection

Prompt injection allows malicious instructions hidden in prompts, documents, or web content to influence AI behaviour. For enterprises, the risk is that an AI assistant connected to internal knowledge sources may bypass intended safeguards, expose sensitive information, or generate misleading outputs. This requires AI-specific monitoring, testing and guardrails beyond traditional input validation.

3. Context-window exfiltration

AI systems retain conversational context to improve continuity, but that same memory can expose sensitive information beyond its intended use. For example, confidential HR, legal, or customer details shared for one task may resurface later in the same session. One must ensure session isolation, memory limits and clear controls for sensitive workflows.

4. RAG retrieval over-permissioning

Retrieval-Augmented Generation makes enterprise AI more useful by connecting models to internal knowledge sources. However, if permissions are broad or misconfigured, AI may surface documents users should not access — such as legal files, executive compensation data, or restricted HR records. Strong identity governance and repository audits are essential before scaling AI broadly.

5. Output logging and retention

AI prompts and responses may be stored in logs, monitoring systems, backups, or analytics platforms long after the original business purpose ends. If those records contain personal, customer, or regulated data, they become new governance obligations. Organizations should define retention, storage, access, masking and deletion rules for AI-generated content.

How organizations can ensure data privacy when using generative AI

Protecting privacy in generative AI is not about slowing innovation. It is about governing how data moves through prompts, retrieved knowledge, model outputs, conversational context, and AI-generated content.

Foundational practices include:

Classify data before AI use: Identify personal data, financial records, intellectual property, and regulated data before they enter AI systems. Give employees clear guidance on what can and cannot be shared.
Understand and manage cross-border data flows: Generative AI introduces additional cross-border data transfer risks that organisations must understand and assess before connecting data sources, knowledge repositories, or third-party AI services.
Enforce least-privilege access: Ensure AI applications retrieve only the information a user is already authorized to access, especially when connected to for example RAG-based knowledge repositories.
Govern prompts and outputs: Define policies for logging, monitoring, retention, storage, masking, access, and secure deletion of AI interactions.
Build privacy into AI design: Incorporate privacy by design and default, data minimization, masking, and human oversight during AI design and deployment — not after implementation.
Train employees on responsible AI use: Use awareness training and acceptable-use policies to reduce accidental exposure from well-intentioned AI usage.

Ultimately, technology alone cannot ensure AI privacy. Secure adoption requires governance across security, privacy, legal, compliance, and product teams. By understanding AI data flows and applying controls at every stage, organizations can use generative AI while protecting sensitive information, maintaining trust, and meeting regulatory obligations.

Regulatory overlay: GDPR, CCPA and the EU AI Act

Security incidents involving generative AI rarely remain just security incidents. Once personal data or confidential information is exposed, organizations must also consider their privacy and regulatory obligations. Rather than introducing entirely new compliance requirements, generative AI amplifies the need to apply existing privacy principles consistently across new AI-driven data flows.

The table below maps common gen AI risks to the obligations they are most likely to trigger.

Risk area	Business impact	Regulatory focus	Leadership action
Training data leakage	Sensitive data leaves governed environments and may be reused or retained externally.	Data minimization, lawful use, transparency, and vendor accountability.	Approve AI usage policies, restrict public tools, and validate provider controls.
Prompt injection	Malicious instructions can bypass safeguards and expose sensitive information.	Secure processing, access controls, risk management, and incident response.	Fund AI threat monitoring, testing, and prompt-filtering controls.
Context-window exfiltration	Sensitive details may remain visible across a session beyond their intended purpose.	Confidentiality, purpose limitation, data minimization, and privacy by design and default.	Require session isolation, memory limits, and clear controls for sensitive workflows.
RAG over-permissioning	AI may surface documents users are not authorized to access.	Least privilege, access governance, accountability, and human oversight.	Mandate IAM alignment, repository audits, and regular permission reviews before scaling AI.
Output logging and retention	Prompts and outputs can become unmanaged stores of regulated data.	Retention, deletion, auditability, records management, and data subject rights.	Set retention standards, protect AI logs, and include outputs in deletion workflows.

Across all five risks, the central issue is governance. Regulators expect organizations to understand how personal and sensitive data moves through AI systems, apply effective controls, and demonstrate accountability when those controls fail. The EU AI Act reinforces this expectation by emphasizing transparency, risk management, human oversight, and accountability across the full AI lifecycle.

AI does not create entirely new privacy principles; it exposes and amplifies existing governance gaps. Rather than building a separate AI compliance program, organizations should extend current privacy and security controls into AI workflows. A practical starting point is to ask:

Have we defined what data and identified the data sources that employees are allowed to use with AI systems?
Do AI applications retrieve only information users are authorized to access?
Are prompts, responses, and AI logs covered by retention and protection policies?
Can we explain and audit how data moves through our AI applications?

If the answer is yes, the organization has a strong foundation for responsible AI adoption. If not, these are the governance gaps to close before scaling AI across the enterprise.

Govern AI where your data moves

Organizations do not need to slow down AI adoption to manage risk. They need to extend the controls they already trust — data classification, access governance, monitoring, retention, storage and cross-functional review — into the AI workflows where sensitive information now moves.

Start with five practical actions:

1. Classify sensitive data: Know which data should never enter public or unapproved AI tools.

2. Lock down AI-connected knowledge sources: Apply least-privilege access before connecting internal repositories to AI assistants.

3. Define approved AI use: Make it clear which tools employees can use and what types of data those tools may process.

4. Monitor AI activity: Watch prompts, outputs, and usage patterns for sensitive data exposure or unusual activity.

5. Govern AI records: Set retention, storage, deletion, masking, and access rules for prompts, responses, logs, and generated content.

These steps do not require a new compliance function or a separate AI governance bureaucracy. They require consistently applying the same security and privacy fundamentals organizations already use to AI systems, AI users and AI-generated data.

Trustworthy AI starts with practical governance. The operating principle is straightforward: Govern AI at the points where data enters, moves, and is stored. Generative AI changes how information flows across the enterprise, but it does not change what leaders must manage: visibility, access, accountability, and control.

Start by mapping your AI data flows today. Organizations that reap the greatest benefits from AI will be those that understand where their data goes, define acceptable use and embed governance into everyday AI workflows rather than after-the-fact reviews. The next step is to start with the data flows you can see today, close the obvious gaps, and expand controls as AI adoption grows.

July 2026 Patch Tuesday

Tue, 14 Jul 2026 21:28:13 Z

Patch Tuesday Watch: What Led Up to July 2026

Adobe

Release date: June 30, 2026 (APSB26-68 — ColdFusion; same-day bulletin for Campaign Classic)

CVE count: 11 CVEs in ColdFusion, 1 in Campaign Classic (12 total)

Adobe's ColdFusion update resolved 11 vulnerabilities across ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier), including seven rated CVSS 10.0:

Fixed in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21.

KEV callout: CVE-2026-48282 was not flagged as exploited at release, but exploitation began within roughly two hours of a public technical writeup on July 2. CISA added it to KEV on July 7, with a federal remediation deadline of July 10 — already passed. Any internet-facing ColdFusion instance still unpatched should be treated as an active incident, not a routine patch item.

Campaign Classic's CVE-2026-48286 (CVSS 10.0, incorrect authorization → arbitrary code execution) affects on-premise ACC v7 builds 7.4.3 and earlier. Adobe-hosted instances were already patched; no exploitation has been reported for this one.

Apple

Release date: July 1, 2026 (iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2)

CVE count: 37 CVEs (26 in WebKit; 11 across kernel, WebRTC, Web Extensions, and other components)

Google Chrome

Release dates: June 24, 2026 (Chrome 149.0.7827.197) and July 8, 2026 (Chrome 150.0.7871.114/.115) CVE count: 10 CVEs (June 24) + 27 CVEs (July 8) = 37 CVEs across the two releases

The June 24 update resolved 10 vulnerabilities, the most severe being CVE-2026-13028 (CVSS 9.6, Critical) — a WebGL use-after-free enabling RCE, particularly on Android.

The July 8 update (Chrome 150) resolved 27 additional vulnerabilities: two Critical (CVE-2026-15112, CVE-2026-15129 — both use-after-free), 24 High-severity (largely use-after-free across Views, Extensions, Autofill, WebRTC, Codecs), and one Medium.

KEV callout: The prior Chrome zero-day, CVE-2026-11645 (V8 out-of-bounds read/write, exploited in the wild), was added to CISA's KEV catalog under BOD 26-04 with a June 23 deadline — already passed heading into this cycle. No new Chrome CVEs from the June 24 or July 8 releases have been confirmed as exploited so far.

Mozilla

Release dates: Most recent desktop security release was Firefox 152.0.4 (June 30, 2026, per MFSA 2026-62); subsequent MFSAs (2026-64 through 2026-66) cover Thunderbird 140.12.1 and Firefox for iOS 152.3/152.4 — minor and mobile-only updates

CVE count: No new desktop Firefox/Thunderbird CVE bulletin in the immediate week leading into Patch Tuesday

Patch Tuesday Summary

Microsoft's July 2026 Patch Tuesday resolves a massive 570 CVEs this month, the majority (509) of which are rated Important and 58 rated Critical, with three Moderate. From an impact perspective 249 Elevation of Privilege and 143 Remote Code Execution account for the bulk of the impact types, followed by 102 Information Disclosure. Two CVEs are confirmed exploited in the wild — a SharePoint elevation of privilege flaw (CVE-2026-56164) and an Active Directory Federation Services elevation of privilege flaw (CVE-2026-56155) — and one CVE, affecting Windows BitLocker (CVE-2026-50661), is publicly disclosed.

Adobe released 11 updates resolving 88 CVEs including 63 Critical, 22 Important, and three Moderate. Impact breakdown includes 51 Arbitrary Code Execution, 13 Security Feature Bypass, 12 Privilege Escalation, 7 Application Denial-of-Service, three Arbitrary File System Read, and two Memory Exposure vulnerabilities. Besides the pre-patch Tuesday ColdFusion release including a known exploit, the 11 Patch Tuesday updates did not include any known exploits or public disclosures.

Mozilla released Firefox 152.0.6 resolving two Critical CVEs. Both vulnerabilities (CVE-2026-15718 and CVE-2026-15719) have publicly disclosed exploit code available, however Mozilla is currently not aware of any active exploitation.

Google Chrome Desktop 150.0.7871.124/.125 has released for Windows and Mac. No CVEs were reported upon release, but given the massive number of vulnerabilities resolved in the past month and a half it would be best to ensure all Chrome installs are up to the latest release.

Microsoft’s exploited vulnerabilities

Microsoft resolved an Elevation of Privilege vulnerability in Microsoft SharePoint Server (CVE-2026-56164). The vulnerability is rated Moderate by Microsoft and has a CVSS score of 5.3, but has been actively exploited in the wild. An unauthorized attacker could elevate privileges over a network. The CVE attack vector is Network because it is remotely exploitable from the internet. Attack complexity is also classified as low. Microsoft has provided some mitigating factors that could help detect a possible attack, but a risk-based prioritization methodology warrants resolving this vulnerability as soon as possible.

Microsoft has resolved an Elevation of Privilege vulnerability in Active Directory Federation Services (CVE-2026-56155). The vulnerability is rated Important and has a CVSS score of 7.8, but has been actively exploited in the wild. The vulnerability could allow an attacker to elevate privileges locally to gain administrator privileges. Microsoft rates the vulnerability as Important, but a risk-based prioritization methodology warrants resolving this vulnerability as soon as possible.

Microsoft’s publicly disclosed vulnerabilities

Microsoft has resolved a Security Feature Bypass vulnerability in Windows Bitlocker (CVE-2026-50661). The vulnerability is rated Important by Microsoft and has a CVSS score of 6.1, but has been publicly disclosed. A successful attack could bypass the BitLocker Device Encryption feature on the system storage device allowing access to encrypted data. While the code maturity for this vulnerability is currently listed as unproven, the disclosure means information is available to point a threat actor down a path to exploitation. A risk-based prioritization approach warrants resolving this vulnerability as a priority this month.

Ivanti security advisories

Ivanti has released a security update for Ivanti Xtraction resolving two CVEs (one High and one Medium). More details and information about mitigations can be found in the July Security Advisory.

July update to-do list

Consider shifting to a more continuous remediation approach if you have not already done so. The continued increase in both CVE discovery and update frequency due to AI accelerated vulnerability discovery is going to continue to increase and regulatory pressure to resolve highest-risk exposures in a matter of days to hours will become the new normal.
Update your browsers! All of them. They are on a weekly basis at this point, but consider checking for and updating twice a week, if not daily, to reduce the exploit window for know exploited vulnerabilities.
Resolve or mitigate known exploited vulnerabilities in Microsoft SharePoint (CVE-2026-56164), the Windows OS (CVE-2026-56155), and Adobe ColdFusion (CVE-2026-48282) as soon as possible.

July 2026 Security Update

Tue, 14 Jul 2026 14:15:30 Z

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Xtraction.

It is important for customers to know:

We have no evidence of these vulnerabilities being exploited in the wild.
These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

Xtraction

How AI will affect vulnerability disclosures in our products

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Apple WWDC 2026 Announcements: How Ivanti Supports OS 27

Mon, 13 Jul 2026 14:25:14 Z

Apple Declarative Device Management (DDM) is now the standard for device management across Apple platforms. As part of this transition, Apple is retiring legacy software update controls in iOS 27, iPadOS 27, macOS Golden Gate, watchOS 27, visionOS 27, tvOS 27 and later releases. This is just one of several platform changes arriving this fall that could impact how your team manages and secures Apple devices.

The good news? Ivanti has supported Declarative Device Management for more than a year, giving customers a headstart on Apple's transition and the modern management capabilities that come with it. Here's what you need to know, what's changing and the steps you should take to prepare.

Apple Intelligence and Apple Foundation Models: WWDC 2026 AI announcements

WWDC 2026, Apple’s 37th Worldwide Developer’s Conference, introduced a rebuilt AI foundation developed in collaboration with Google’s Gemini technology. Apple now ships four models: Two run entirely on-device, including a new multi-modal model for text and images, and two run through Private Cloud Compute for more demanding tasks, with cryptographic guarantees that no data is stored or logged. That means AI that works offline, costs nothing per use and creates no data residency obligations. Apple has also opened a unified API to third-party models like Claude and Gemini, giving your development teams a single integration path rather than separate integrations for each provider.

Ivanti Neurons for MDM gives administrators the controls to allow or restrict them by device group, so the right capabilities reach the right people, without applying blanket policies across your entire organization.

Declarative device management in Apple OS 27

Legacy device management sent commands and hoped they stuck. Declarative device management (DDM) works differently: you express the desired state, and the device takes ownership of reaching and maintaining it, self-correcting without being asked.

This extends DDM to cover VPN, DNS, network relay, content filtering, certificates, app management and more, making it the primary management path rather than an optional layer.

IT teams still on legacy configuration profiles will start to feel the gaps when OS 27 lands. Ivanti Neurons for MDM has been implementing DDM ahead of each Apple release.

We’re ready, and we can help you understand what migrates automatically and what needs attention before OS 27 releases this fall.

Apple OS 27 software update changes for enterprise IT

Apple OS 27 removes legacy software update management entirely, with no grace period. If your device groups don’t yet have a Software Update Enforcement configuration and a Software Update Settings configuration in Ivanti Neurons for MDM, create them now. Both are built on the declarative model and take minutes to set up. Once in place, your update enforcement carries forward into OS 27 and every release after it.

If you’re not sure where you stand, reach out to your Ivanti account team, and we’ll help you confirm your posture before fall.

Apple OS 27 security updates: hardware integrity and compliance

macOS 27 gives IT teams something genuinely new: the ability to verify hardware component integrity before a device goes back into circulation. When a Mac or iPhone comes back from an employee, Ivanti Neurons for MDM can now confirm whether any internal components (camera, Face ID, Touch ID, NFC) have been swapped outside an authorized service channel. For IT teams managing shared device programs or strict compliance requirements, this adds a verifiable checkpoint to the device lifecycle that previously required a manual inspection or an Apple Store visit.

App management updates in iOS 27 and macOS 27

OS 27 changes how apps are deployed, controlled and licensed in ways your IT team will notice immediately.

The most visible change is how permission prompts work. Today, employees are hit with a series of blind permission requests when they first open a managed app — camera, microphone, location — with no explanation of why the business needs them. Many deny instinctively, the app breaks, and IT gets a call.

In iOS 27 and iPadOS 27, IT can pre-declare the permissions a managed app requires as part of the MDM deployment. The employee sees one clear, prompt that provides the business context. One tap. Done.

macOS 27 also introduces native binary and application control at the OS level. IT declares which applications and executables are allowed to run on a managed Mac. When a denied binary is encountered, the OS terminates it immediately, with no prompt or warning to the user. What previously required a dedicated endpoint security product is now built into macOS and managed through Ivanti Neurons for MDM.

Apple is also introducing volume purchasing for App Store subscriptions this fall, a change that IT teams managing licenses through Apple Business Manager have been waiting for. Subscriptions have never been part of volume purchasing until now. Your team can purchase auto-renewable subscriptions in bulk and assign them to employees through MDM, the same way app licenses work today. Subscriptions follow the user across devices and renew under your organization’s account. Your employees won’t need personal payment methods or individual App Store credentials.

Faster support with enhanced diagnostic logging

Across iPhone, iPad, Mac and Apple TV, Ivanti Neurons for MDM can now trigger diagnostic log collection remotely from the console, routing logs directly to Apple’s support infrastructure without any involvement from the device user. For customers with an AppleCare Enterprise agreement, this creates a direct, fast-moving support channel between your fleet, Ivanti and Apple. Issues that previously took days to diagnose can now be resolved the same day.

macOS 27: the Most Management-Rich Release Yet

Content caching now reports health status directly to the MDM console, so you don’t discover a failed caching service when a fleet update slows to a crawl. Managed Migration Assistant preserves enrollment and device configuration when employees move to a new Mac. A unified declarative configuration replaces the overlapping stack of legacy profiles that’s accumulated over years of Apple releases — covering app management and privacy permissions in one place, with binary control included. Ivanti handles this consolidation for you.

What WWDC 2026 means for your Apple device management

OS 27 is the most management-significant Apple release in years. The shift to declarative management is complete; hardware integrity verification is real and on-device AI is now something IT either governs or doesn’t. The gap between teams that are prepared and teams that aren’t will show up quickly after the OS ships.

If you're evaluating your Apple device management strategy ahead of OS 27, reach out to your Ivanti representative. We’ll help you understand how Ivanti Neurons for MDM positions your organization for this release and the ones that follow. We can walk through your current configuration, identify what carries forward automatically and flag anything that needs attention before the fall. The earlier that conversation happens, the less you’ll have to scramble when the update lands.

From IT Asset Discovery to Automated Action: Closing the IT Operations Loop

Wed, 08 Jul 2026 14:00:02 Z

Organizations today invest heavily in discovery tools, expecting that increased visibility will solve their IT challenges. Yet when an incident hits, a patch fails or an audit looms, many teams must pause to reconcile spreadsheets, validate inventories and confirm ownership before they can act. Visibility alone doesn’t close the gap between insight and execution.

The real value of discovery appears when visibility is governed and connected directly to the systems that run your business — enabling action without delay. Modern organizations can't rely on static inventories or scheduled scans. They need discovery that works continuously, fuels automation and validates outcomes. This is how organizations move from simply knowing their environment to acting on insights with confidence.

Why teams can’t afford gaps in IT asset visibility

Hybrid IT complexity continues to rise. Ivanti’s 2025 State of Cybersecurity Report found that 55% of organizations struggle with siloed IT and security data, limiting their ability to gain complete visibility across their attack surface and cloud environments. These findings confirm the burden IT teams already feel. In 2025, nearly 60% of IT professionals reported they have too much manual work tied to SaaS and asset management, underscoring the need for automation-ready, always-current data. For many organizations, these IT visibility gaps translate into real business friction. IT teams spend hours reconciling asset records across spreadsheets and tools before they can even respond to an issue.

Traditional discovery methods often become operational bottlenecks rather than strategic enablers. Periodic scans generate large data bursts that strain networks and backend systems, forcing teams to limit scan frequency or scope. Between scans, asset data quickly becomes outdated, leading to delayed patching, missed compliance deadlines, incomplete lifecycle tracking, and growing software sprawl. As teams compensate with manual checks and approvals, discovery workflows begin to compete with other IT initiatives for time, bandwidth and attention — slowing progress across the organization.

Security teams struggle to prioritize exposures when asset ownership, usage or lifecycle state is unclear. Operations slow as approvals, audits and remediation efforts stall waiting for confirmation that data is up to date. Over time, this manual overhead increases operational risk, stretches already limited resources and diverts attention away from strategic initiatives. Continuous discovery helps close this gap, but only when it feeds platform-governed operational data into the systems teams rely on. That connection is what enables immediate, automated action.

What is continuous discovery?

Continuous discovery is an IT practice in which an organization's assets — including devices, software, cloud workloads and identities — are automatically and persistently monitored for changes rather than captured through periodic or manual scans. This always-on approach enables IT teams to maintain a real-time, continuously updated view of what exists across their environment, how resources are configured and how they change over time.

Within the Ivanti Neurons Platform, asset and configuration data is governed as a shared system of record for IT and security operations. Unlike traditional discovery, which relies on periodic scans or scheduled updates, continuous discovery is an always-on approach within the Ivanti Neurons Platform for understanding your environment. It continuously observes changes across devices, cloud workloads, SaaS applications and identities as they appear, evolve or disappear. Instead of capturing occasional snapshots, it maintains an up-to-date operational view of what exists, how it is configured and how it connects to the rest of the environment, without waiting for the next scan cycle.

Turning continuous discovery into IT automation

Continuous discovery becomes operational when three things happen:

1. Discovery data flows into the Ivanti Neurons Platform. Asset and configuration state are governed as operational data and acted on by IT, security and compliance teams. Before actions are triggered, discovery signals are cleaned, normalized, and reconciled by the platform — ensuring automation and AI operate on consistent, trusted data rather than raw, conflicting inputs.

2. Actions trigger automatically based on live intelligence. When a new unmanaged device appears on the network, or a software package drifts from its compliance baseline, the platform immediately routes that signal to the right workflow.

3. Outcomes are verified, so teams confirm resolution rather than rediscover the same issue days later. Post-action confirmation uses live operational evidence to validate that changes took effect, so teams don't close tickets only to reopen the same issue days later.

When these elements work together, organizations stop chasing problems. They prevent them. This shift shows up in practical, operational ways:

Preventing exposure drift: teams automatically identify when new cloud resources or SaaS applications appear without assigned ownership or an established baseline configuration. Instead of discovering these issues during audits or incidents, IT and security teams address them early while risk is still low.
Avoiding recurring incidents: organizations reduce repeat outages and failed remediations by verifying post‑change asset state. When discovery confirms that a patch, configuration change or device update took effect, teams avoid reopening the same issue days later.
Reducing reactive firefighting: IT operations teams no longer spend hours reconciling asset data during incidents. With continuously updated asset context flowing into operational systems, response decisions happen faster and with fewer manual checks.
Catching inefficiencies before they become cost problems: usage signals tied to accurate asset records expose unused software, forgotten endpoints or aging hardware earlier in the lifecycle, allowing teams to act before waste accumulates and optimize IT spending.

Across industries, organizations that combine platform-governed operational data with automation and validation report fewer surprises, faster resolution and a measurable reduction in manual effort because issues are surfaced and addressed before they escalate into major disruptions.

Putting visibility to work with Autonomous Endpoint Management

Many organizations start with Autonomous Endpoint Management (AEM) because it turns visibility into immediate action. When endpoints operate on platform-governed asset and configuration data, teams can automate remediation, keep inventory aligned in real time and give security the context it needs to assess exposure.

When IT Service Management is part of your operations, this same operational data extends into ITSM and CMDB workflows and supports ITAM with accurate usage and entitlement insight. The result is faster execution with less guesswork — made sustainable at scale as discovery signals flow continuously through the platform and into automation.

Improving continuous discovery with delta-based asset updates

Many traditional discovery tools create network strain because they repeatedly transmit full asset datasets during each scan, forcing teams to sort through large volumes of unchanged information. The Ivanti Neurons Platform takes a more efficient approach through its discovery engine by transmitting only the delta — the specific changes since the last update.

These deltas surface the updates teams actually care about, such as new devices or cloud workloads appearing, software being installed or removed, ownership or configuration changes or usage signals that indicate unused assets. By highlighting only what has changed, teams avoid analyzing full payloads and can focus immediately on what needs attention, while keeping bandwidth usage and processing overhead low.

Continuous visibility becomes easier to maintain because bandwidth consumption stays low across all network types, including remote offices. This makes continuous discovery practical at scale and prevents performance degradation during peak activity periods. Delta-based updates also accelerate time to value by reducing processing overhead, allowing changes to appear in downstream systems almost immediately. This keeps operational asset inventories current and aligned without the delays caused by full data refreshes.

By transmitting only what has changed, organizations maintain near real-time accuracy without burdening endpoints, network infrastructure or backend processing. This approach supports consistent operations, improves reliability and ensures that continuous discovery enhances performance rather than constraining it.

Automating IT operations with real-time asset intelligence

When asset data is continuously updated and trusted at the platform level, teams stop waiting for audits, reports or manual reviews and start acting on changes as they occur. For IT Asset Management (ITAM) and compliance teams, this means fewer manual checks, more accurate records and actions driven by current asset state rather than outdated snapshots. For IT operations, it means less rework and faster response without added process overhead.

Platform-governed asset and configuration intelligence enables workflows such as:

Patching triggered by current asset context, reducing delays caused by outdated or incomplete inventories.
Automatic isolation of non‑compliant devices, helping teams address drift before it turns into compliance audit findings or risk exposure.
Real‑time updates to ownership, location, and lifecycle data, giving ITAM teams a reliable foundation for cost and lifecycle decisions.
Early identification of unused software, allowing license reclamation before renewal cycles lock in waste.
ITSM tickets that open and close with verified evidence, preventing repeated follow‑ups and recurring issues.

This is how teams move from reactive cleanup to predictable, continuous control.

Verifying IT automation outcomes with continuous discovery

Most operational delays happen after an action is taken, when teams need to confirm whether it actually worked. Continuous discovery supports closed-loop operations by validating changes in asset and configuration state, using live operational evidence rather than manual follow-ups.

Since this evidence is normalized and current, automation and AI can accurately distinguish real change from noise and improve recommendations over time. The result is a reliable feedback loop that reduces rework, strengthens operational control and allows IT and security teams to move forward with confidence.

What closed-loop IT operations and automation deliver

Organizations that combine continuous discovery with automated action and validation reduce risk, avoid waste and improve efficiency.

Security responds faster because exposures are tied to real assets and owners.
IT operations shorten MTTR through accurate records and fewer manual steps.
ITAM prevents overspending by validating entitlement and usage data.
Compliance becomes easier because auditors receive complete and current evidence instead of ad-hoc reports.

The value of accurate, always-current operational data extends beyond automation. As this foundation matures, many organizations begin exploring more intuitive ways to interact with it — querying their IT environment in natural language instead of relying solely on predefined reports. These outcomes are realized when discovery becomes part of the operational fabric rather than a background task.

Start turning IT asset visibility into automated action

The organizations that move fastest and take on the least risk are those that treat visibility as an operational capability instead of a reporting function. When discovery is continuous, platform-governed and connected to automated action, IT and security teams stop reacting and start preventing.

Continuous, platform-governed discovery is what separates organizations that know they have a problem from those that never let it start. Schedule a demo to explore the Ivanti Neurons Platform and see continuous discovery in action.

How Agentic AI Enables Autonomous Threat Response at Machine Speed

Mon, 29 Jun 2026 14:00:02 Z

Why do 40% of alerts received by security teams today go completely uninvestigated? It’s not due to a lack of concern but instead caused by shortening attack windows and compounded by overwhelming tech sprawl.

Today’s security teams are operating in a threat landscape defined by escalating attacks, tighter budgets and mounting alert fatigue. Organizations process an average of 960 security alerts per day, and large enterprises handle more than 3,000 daily alerts across roughly 30 tools. That adds up to 36,000 potential threats a month that could slip through the cracks. The asymmetry is crushing when attackers need only one successful breach, while defenders must be right every time.

This critical gap for organizations is an architecture problem. The greatest challenge in threat response isn't what gets detected — it’s what happens next after that alert sounds.

The good news? Agentic AI changes that architecture. Not by replacing existing tools, but by closing the operational gap between detection and action.

The security speed problem

The tools you've deployed (SIEM, EDR, vulnerability scanners, SOAR platforms) are exceptional at detection. They surface the threats, catalog the risks and send the alerts. But detection without an effective response is just expensive documentation. The real bottleneck becomes fixing issues fast enough to matter, not simply knowing what’s wrong.

Learn More: Why Traditional Vulnerability Management is Breaking Under AI‑Driven Discovery

Traditional security operations follow a familiar sequence: an alert fires, an analyst investigates, a decision is made, remediation is scheduled, change is approved … and only then is action taken. Each step makes sense in isolation, but together they lock teams into human speed while threats move autonomously. By the time the investigation is complete, the adversary has already moved laterally. And by the time a patch is deployed, three more critical CVEs have been disclosed.

The timeline gap is stark. According to the 2025 Verizon Data Breach Investigations Report, organizations take a median of 32 days to remediate edge device vulnerabilities, while threat actors exploit those same vulnerabilities at or before public disclosure — effectively operating on a zero-day timeline. That gap is accelerating: Mandiant’s M-Trends 2026 Report reveals that the time between initial access and handoff to a secondary threat group has collapsed from more than eight hours in 2022 to just 22 seconds in 2025.

An effective security model requires detection to trigger immediate, intelligent action. Existing capabilities such as vulnerability assessment , endpoint management , patch deployment and access controls remain in place, but operate faster and with greater autonomy. The result is security operations that function at machine speed rather than human speed.

What agentic security actually looks like

In security, agentic AI refers to autonomous systems that execute end‑to‑end security workflows. They move from detection to decision to action without pausing for manual approval at every step.

Agentic AI should be operating across the attack surface, coordinating detection, decision and response as a single system.

Autonomous vulnerability remediation

When a critical CVE is disclosed, agents immediately assess exposure across the environment. They prioritize risk based on exploitability and business context, deploy patches to affected endpoints and verify remediation. All of this happens before an analyst opens a ticket. Human oversight remains in place, but the delay created by manual handoffs is removed.

Learn More: Risk‑Based Patch Prioritization Report

Intelligent threat response

When an endpoint exhibits suspicious behavior, agents correlate signals across EDR, network telemetry and asset inventory. Affected devices are isolated; active sessions are revoked; forensic evidence is captured and the SOC is alerted with full context. The threat is contained before it spreads, allowing analysts to investigate a neutralized incident rather than an active breach.

Continuous compliance posture

Agents continuously monitor endpoints and servers for configuration drift. When a device falls out of compliance, such as a disabled firewall, encryption turned off, or unauthorized software installed, remediation occurs automatically. The configuration is corrected; the event is logged and compliance is verified. Compliance becomes an ongoing state rather than a quarterly exercise.

Access risk mitigation

Agents detect anomalous access patterns, including unexpected geolocations, privilege escalation attempts and unusual data access. Suspicious sessions are terminated; multifactor authentication is enforced and access is reduced until verification is complete. Legitimate users continue working while lateral movement is stopped in real time.

These agents work across the existing security stack, including SIEM, EDR, vulnerability management , identity systems and patch management. Each tool becomes faster and more effective as part of a coordinated system. The aim isn't to replace security operations, but to allow them to operate at the speed adversaries already do.

Learn More: How Agentic AI is Transforming Infrastructure and Operations

From detection to action: the architecture of speed

The core shift enabled by agentic AI is decision‑making at the point of detection. Rather than separating sensing from action, security workflows are designed to assess risk and respond immediately as threats emerge.

When a critical vulnerability is identified, the agent doesn't surface a ticket for later review. It evaluates the same factors a security architect would consider:

Is the system internet facing?
What data does it access?
Is there a known exploit in the wild?
What's the business impact of patching versus delaying?

That decision is made in milliseconds rather than days. And delivering this outcome requires more than automation scripts but systems that can reason about context and consequences.

Business‑aware risk scoring

Not every critical vulnerability carries the same urgency. Agents evaluate exploitability, exposure and business impact together. A vulnerability on an internal test server is handled differently than the same issue on a customer‑facing production system. Prioritization happens automatically, and the rationale is clear and defensible.

Adaptive response thresholds

Agents learn from outcomes over time. When certain actions consistently produce false positives, thresholds adjust. When new attack patterns emerge, sensitivity increases. The system improves through use, rather than becoming more brittle as conditions change.

Context-preserving escalation

When an agent reaches the boundary of its autonomy, escalation includes reasoning, not just an alert. What was detected, what signals were evaluated, why the decision couldn't be completed autonomously and what action was recommended are all passed to the analyst. Human intervention focuses on decisions that matter, not triage.

Built-in auditability

Every action is recorded with full context, including the trigger, the data evaluated, the decision made and the outcome. Compliance is embedded directly into the workflow instead of reconstructed after the fact.

The impact on security teams is measurable. The 2025 SANS Detection & Response Survey revealed that 73% of organizations cite false positives as their top detection challenge, and 76% percent point to alert fatigue as a primary SOC concern. This isn't just an efficiency issue. When analysts spend most of their time sorting through noise, security programs remain reactive by design.

The result is a different operating reality. Detection leads to resolution. Alerts are addressed as they appear instead of accumulating in queues. Security teams spend less time responding to yesterday’s incidents and more time preventing the next one.

What changes in practice

When agentic AI is deployed in production security environments, the impact shows up less as isolated wins and more as structural change. Teams see consistent shifts in how workflows are structured, how quickly risk is reduced and where human effort is applied.

1. Time-to-action compresses dramatically

Detection and response collapse into a single motion. Vulnerabilities that once waited days for triage and scheduling are assessed, prioritized and remediated automatically when risk thresholds are met. Threats that previously moved laterally during investigation are contained at the point of detection. The measurable outcome is shorter dwell time and faster risk reduction, not just faster alerts.

2. Operational overhead declines

Routine security work that previously consumed analyst time, such as compliance drift remediation, patch coordination and access corrections, moves into continuous background execution. Reporting becomes a byproduct of normal operations rather than a periodic scramble. Security teams spend less time managing processes and more time applying judgment.

3. Response quality becomes more consistent

When decisions are made using the same contextual inputs every time, response behavior stabilizes. Similar risks are handled in similar ways, regardless of when they occur or who's on call. This consistency reduces variability, limits human error and makes outcomes easier to explain to auditors, executives and regulators.

4. Human attention shifts to higher-value work

Analysts are no longer pulled into every alert or minor configuration issue. They engage when escalation is warranted and when decisions materially affect business risk. The result is less alert fatigue, fewer false positives and more time spent on threat hunting, incident analysis and strategic improvement.

The business impact of this shift is reflected in industry data. According to IBM’s 2025 Cost of a Data Breach Report, organizations that use AI and automation extensively saved an average of $1.9 million per breach and reduced the breach lifecycle by eighty days. With the global average breach lifecycle at 241 days in 2025, the lowest in nine years, even incremental improvements in speed translate into meaningful risk and cost reduction.

The pattern is consistent. Security teams stop reacting to backlogs and begin operating at the pace of the threat itself.

Why moving slowly is the bigger risk

Caution around AI in security is understandable. Security systems touch critical infrastructure. Mistakes are highly visible, and the consequences of failure are real. Waiting for clearer use cases, stronger governance and proven controls can feel like the responsible choice.

The challenge is that the underlying risk environment has changed. Attackers already operate at machine speed, while most security programs still respond at human speed. Every week spent delaying meaningful autonomy widens that gap. Exposure accumulates quietly, not because detection fails, but because action can't keep pace.

Most organizations already have the necessary signals. SIEM, EDR, vulnerability management and patching systems generate high-quality detection and context. The constraint is execution. Alerts queue. Tickets wait. Decisions stall. Agentic AI addresses that constraint by collapsing the distance between detection and response. The longer that distance remains, the further security posture drifts from the reality of modern threats.

In practice, resistance to agentic security is organizational more often than technical. Ownership of AI‑driven outcomes may be unclear. Incentives may reward process adherence over risk reduction. Teams may view automation as a threat to relevance rather than an extension of capability.

Operationally, the opposite tends to be true. As autonomy increases, analyst work becomes more focused and more valuable. Threat hunting, incident analysis, adversary research and architectural improvement efforts expand. Manual triage, patch coordination and repetitive investigation recede. Human expertise is applied where judgment matters most.

Organizations that delay adopting agentic security aren't standing still. They're choosing to operate with a response model that can't match the pace of modern attacks. Over time, that mismatch becomes the dominant source of risk.

The shift is underway

Security operations are moving away from reactive models where detection creates backlogs; alerts generate work and response timelines stretch into days. Leading programs are reorganizing around proactive execution, where systems sense conditions, evaluate risk and act continuously. Autonomous agents absorb volume and variability. Human teams focus on strategy, investigation and improvement.

This shift reflects a change in how modern security must operate. Adversaries already automate reconnaissance, exploit development and lateral movement. Attacks progress without waiting for tickets to be triaged or approvals to be scheduled. Security programs that remain bound to human‑speed workflows struggle to close that gap.

What separates more effective organizations is the readiness to operate differently. They design for execution as well as detection. They govern autonomy deliberately. They measure outcomes instead of activity. Over time, this operating model compounds its advantage because response improves as systems learn and teams refocus.

The question facing security leaders is no longer whether autonomy belongs in security operations. It is whether their organization is prepared to run security at the pace the environment now requires.

Ready to close the security speed gap?

See how Ivanti Neurons for ITSM enables autonomous security workflows that move from detection to resolution with speed and control.

The Invisible IT Department: How to Deliver Friction-Free Experiences with Agentic AI

Thu, 18 Jun 2026 19:42:35 Z

Every enterprise has bought AI, but many are still waiting for their investment to pay off. Ivanti’s 2026 AI Maturity Report found that only 2% of organizations say they currently have no AI use at all. As the majority of organizations move beyond the AI experimentation stage, the real competitive differentiator is if that AI is providing continuous, business value at scale.

Companies deploy chatbots that users ignore. They implement agents nobody trusts and roll out "AI-powered" tools that employees end up working around or disregarding personal, shadow AI tools. The problem isn’t what AI can do. It’s what you’re asking users to do with it. Most organizations approach AI as a feature to deploy rather than an experience to design. They focus on what AI is capable of instead of what users actually need. The result is another shelfware solution that generates more frustration than value.

Digital experience is the missing link that separates successful AI deployments from failed ones. Organizations that prioritize the AI user experience can identify the implementation pitfalls that kill user trust and develop a practical framework for deploying agentic AI that delivers improvements without interruptions. AI and IT work at their best when they serve as invisible superpowers. Users don't notice the technology; they notice how effortlessly they accomplish their work.

The AI adoption paradox

MIT research suggests that roughly 95% of enterprise AI initiatives fail to deliver measurable ROI with most stalling in pilot mode rather than scaling into real business value.

How it happens: Leadership greenlights an AI initiative, IT deploys the technology, training sessions are scheduled, adoption metrics are tracked, and within six months...nobody is using it. The chatbot goes dark, the AI assistant sits idle, and your employees develop workarounds to avoid the very tools that were supposed to make their lives easier.

This isn't a failure of change management, but the result of failing to understand what users actually experience when you layer AI on top of all their other workplace technology.

Users don't want AI for AI's sake. They want their laptop to boot faster, applications that don't freeze mid-presentation, video calls that don't lag, and issues to resolve before they notice something wrong. When you force them to interact with an AI interface to get those things, you've already lost.

Read More: How Agentic AI for ITOps Unlocks Value at Scale

Why most AI implementations fail on user experience

Walk into any enterprise IT environment and you'll find the same pattern. The AI implementation checklist gets followed religiously:

Technology vendor selected
Platform deployed
Integrations configured
Users trained
Go-live achieved

But six months later, the reality sets in. A 2025 EY survey found that 64% of employees reported increased workloads despite AI deployments, while only 5% said they were maximizing AI to actually transform their work.

IT did everything right according to the playbook, but what went wrong is that the playbook was written by people selling AI, not people using it.

Consider the typical AI chatbot deployment meant to "empower self-service" and "reduce ticket volume." In practice, means employees who used to send a quick Slack message to IT now must:

Navigate to a separate portal
Figure out how to phrase their question in a way the bot understands
Parse through irrelevant knowledge articles the AI surfaces
Eventually give up and submit a ticket anyways, now irritated and fifteen minutes behind schedule

The ticket still gets created, and the problem still needs solving, but now there's friction where there wasn't before because you've added steps, not subtracted them.

This is the fundamental mistake: treating AI as an interface users engage with instead of infrastructure that works for them. The moment you ask users to change their behavior to accommodate your AI, you're building resistance, not adoption.

Digital experience: where AI proves its value

The organizations getting real value from AI have stopped asking, "How do we get users to adopt this AI tool?" and started asking, "How do we use AI to improve what users already do?" It's a subtle shift with massive implications.

In digital experience management, AI doesn't sit between the user and their work. It sits between the user and the chaos: i.e. the performance degradation, the application failures, the mysterious slowdowns, the issues that haven't surfaced yet but will in the next 30 minutes.

This is where agentic AI fundamentally changes what's possible. Traditional monitoring tools alert humans when something breaks. But agentic AI prevents the break before it happens. It's the difference between a smoke detector and a fire suppression system.

Traditional IT operations measure incident responses in hours or even days. Agentic AI with autonomous remediation is fundamentally changing this equation, shrinking mean time to resolution from hours to minutes or seconds by detecting patterns and executing fixes before problems escalate.

Here's what that looks like in practice:

Traditional IT Ops:

A user's laptop starts showing early signs of disk failure.
Traditional DX tools flag the issue and create a ticket.
An IT analyst would review the alert, assess severity, schedule maintenance, and eventually reach out to the user.
Total time to resolution: multiple days.
Impact on your organization: planned downtime, data migration, and productivity loss.

Agentic AI

With agentic AI, the pattern gets detected before the user notices anything wrong.
The agent autonomously triggers automated backup processes, provisions a replacement device, stages the user's applications and data, and schedules the swap during a low-activity period.
The user gets an email: "Your new laptop will be waiting at reception tomorrow morning. Your existing setup has been transferred."
No ticket created or escalation needed or interruption experienced.

It’s the same problem, but with a radically different experience.

Building a friction-free AI implementation framework

Achieving invisible AI requires rethinking how you deploy, measure, and scale digital experience initiatives. Organizations seeing real ROI from agentic AI follow a consistent pattern that prioritizes experience over features.

Start with pain, not possibility

The worst AI implementations begin with the question, "What can this AI do?" The best ones start with, "What's currently painful, repetitive, or needlessly slowing users down?

Map your digital experience pain points before you map AI capabilities:

Where do users wait the longest for issue resolution?
Which problems generate repeat tickets?
What performance degradations happen predictably but aren't caught proactively?
Where does IT spend the most time on tasks that don't require human judgment?

These are user experience problems that AI can eliminate, not just “AI use cases,” and the distinction matters. When you start with pain, you end up with solutions users want.

Deploy AI behind the experience

Users should never need to decide whether to engage with your AI because that's your job as the implementer. In practice, this looks like:

Autonomous agents that detect and resolve issues before help is needed vs. A bot that users need to ask for help.
Predictive insight engine that pushes solutions to users before they search vs. A self-service portal with AI-powered search.
Self-healing systems that execute recommendations automatically within approved guardrails vs. AI-powered recommendations users have to action.

The pattern is consistent, and it’s to reduce user decision points, eliminate extra steps, and remove the need for extensive AI literacy. Your agentic AI should require zero user training because users should never directly interact with it.

Measure user experience, not AI performance

Here’s where most implementations go sideways: they measure AI performance instead of user outcomes

If you're tracking the number of AI interactions, AI response time, model accuracy scores, or automation rate, you're measuring the wrong things.

Instead:

Track reduction in mean time to resolution for end-user issues. Ivanti’s 2026 AI Maturity Report found that 45% of IT workers say AI has made their work faster and better.
Track user-reported satisfaction with IT responsiveness.
Track the percentage of issues resolved before users notice.
Track time saved on repetitive requests.
Track reduction in ticket volume, not because you're deflecting issues but because you're preventing them.

The governance framework that enables AI autonomy

The thing that actually slows down most agentic AI deployments isn’t a technical problem — it’s getting stakeholders comfortable with AI acting without being asked permission first.

Autonomy Tier	Risk Level	Example Actions
Full Autonomy	Low	Cache clearing, service restarts, performance optimization, routine patching
Autonomy with Notification	Medium	User profile resets, application reinstalls, driver updates
Human Approval Required	High	Major configuration changes, data migrations, infrastructure modifications
Human-Led, AI-Assisted	Critical	Security incident response, compliance decisions, budget approvals

The key is recognizing that "high-risk" shrinks over time as AI agents prove reliability and as your monitoring detects patterns you didn't initially anticipate. Organizations that treat AI governance as static end up with AI that can't do enough to matter. The ones that treat governance as dynamic end up with AI that continuously expands its impact while maintaining safety.

What success looks like

Organizations implementing AI-powered service experiences are seeing meaningful satisfaction gains. PwC research found that leading implementations have achieved 10-15% NPS improvements alongside operational efficiencies.

The conversation around AI changes. Users stop talking about IT as something that gets in their way and start not talking about IT at all, which is precisely the point. IT becomes infrastructure: invisible, reliable and present only when intentionally needed.

Your service desk sees the shift first, like:

Ticket volume drops not because you're deflecting issues but because you're preventing them
Escalations decrease because AI catches and resolves problems at progressively earlier stages
Analyst time reallocates from reactive firefighting to proactive system improvement
Mean time to resolution compresses because remediation often happens faster than detection did under the old model

For end users, the experience is simpler: things work, applications are responsive, systems are available, and slowdowns don't cascade into failures. And the mysterious performance issues their colleagues complain about somehow don't happen to them, not because they're lucky, but because AI agents are continuously optimizing their experience in ways they never see.

This is the real adoption metric is when users stop thinking about IT. Not because they're ignoring it, but because there's nothing to think about.

The real choice: invisible AI or ignored AI

Every organization will deploy AI in digital experience management. The question isn't whether, but how, and more importantly, whether users will actually benefit or just have another tool foisted on them.

This requires fundamentally rethinking how you implement, measure, and scale AI initiatives. Get this right, and you transform how your organization perceives IT, to competitive advantage instead of cost center, to proactive enablement instead of reactive firefighting, to invisible infrastructure that just works instead of necessary overhead.

The best AI, like the best IT, is the kind you never see. Users don't experience your technology, but they experience the absence of problems. And that's precisely the point.

Ready to improve your digital experience with agentic AI?

Discover how Ivanti Neurons for ITSM deploys agentic AI that works behind the scenes, predicting issues, resolving problems autonomously, and optimizing experiences before users notice anything wrong.

Shadow IT and Discovery AI Blind Spots: What Legacy Tools Miss

Mon, 15 Jun 2026 13:32:02 Z

Ask three teams what assets exist in your environment, and you’ll get three different answers. Most organizations don’t lack tools. They lack agreement on what actually exists in their environment. Asset, endpoint and cloud data exist — but it’s fragmented, stale and trusted differently by teams across every department and function.

The reason for this disconnect? In the AI era, environments are changing faster than legacy discovery is built to handle. Cloud workloads spin up and disappear in minutes, often provisioned automatically for testing, scaling or short-term projects. But the gap is now widened even more by AI services, copilots, APIs and embedded models — as well as browser-based tools and automation workflows — that teams adopt without going through standard IT provisioning.

By the time traditional discovery tools scan the environment, these resources may already be gone or they may never appear in the systems IT relies on as a single source of truth — leaving no record, no owner and no shared operational context. Meanwhile, SaaS adoption continues to rise across every department, remote devices rarely touch the corporate network, and identities, integrations and data flows now matter just as much as devices. Yet many organizations still rely on discovery approaches built for a world of static endpoints and predictable perimeters.

The result is partial visibility at best and growing blind spots everywhere else.

In 2026, the visibility gap is now a chasm — and the data is clear. According to Ivanti’s autonomous endpoint management research, 45% of IT professionals report lacking sufficient data about shadow IT, and 38% say they have insufficient data about devices accessing the network. This problem is amplified in cloud environments.

According to 2025 research from SecPod revealed that 67% of organizations struggle with blind spots across their cloud asset inventories, reinforcing that even organizations with modern IT and security tools still operate with incomplete visibility.

These blind spots create more than gaps in inventory. When teams can't agree on which assets are real, active or decommissioned, IT and security work on conflicting timelines. Incident response slows. Exposure prioritization breaks down. Security teams chase alerts without context. IT leaders burn hours reconciling spreadsheets instead of reducing risk.

What makes this especially costly is not just missing data, but delayed action. When teams can’t trust what exists in their environment, every response slows down: incidents take longer to resolve, audits require manual reconciliation, and risk decisions are made with incomplete context. Visibility gaps don’t just increase exposure; they consume time, attention, and operational confidence across IT and security.

Across Ivanti’s experience working with large hybrid enterprises, a clear pattern has emerged. Visibility gaps rarely exist because teams fail to deploy discovery, but because those tools were never designed to share or reconcile data at the speed modern environments demand.

Legacy tools are not simply outdated. They're fundamentally incompatible with the speed and complexity of modern IT.

Where legacy tools fall behind

The limitations of legacy discovery tools fall into five categories, each compounding the others:

Fragmented visibility

According to Ivanti’s 2025 Securing the Borderless Digital Landscape Report, every 2 in 5 edge devices are currently outside of IT management and oversite. Today, nearly every organization has unauthorized cloud accounts, yet traditional discovery solutions don’t reflect this reality. Most point tools capture only one slice of the environment, but they rarely reconcile them into a shared operational view. For IT directors, this fragmentation means juggling multiple dashboards during outages and audits. For CIOs, it means wasted spend and delayed decisions. When no team trusts the data enough to act confidently, the entire organization slows down.

Dependence on agents

Agent-based discovery still plays an important role in modern IT, especially for collecting rich telemetry from managed endpoints. The problem arises when discovery becomes agent-based only. In hybrid environments, many assets cannot support an agent. Temporary cloud workloads may exist for minutes or hours. SaaS applications and managed services do not allow agent deployment at all. Contractor devices, personal endpoints and unmanaged systems often fall outside corporate control policies.

As a result, these assets never appear in inventories that rely exclusively on agent-based collection. The flaw isn't with agents themselves; it's with relying on a single collection method that can't account for the full scope of modern environments.

This structural limitation directly contributes to the visibility gaps organizations continue to face. According to 2025 research from Trend Micro, nearly 3 in 4 organizations have experienced security incidents caused by unknown or unmanaged assets. These figures demonstrate how agent-only discovery consistently leaves significant areas of the environment unmonitored.

Ivanti’s 2025 Digital Employee Experience Report found that 27% of office workers regularly use unauthorized tools and applications, often out of frustration with employer-provided technology. This behavior expands the attack surface faster than traditional discovery methods can respond.

Risk and exposure blind spots

When parts of the environment remain unseen, organizations lose the ability to maintain consistent security controls. Unmonitored devices, unrecognized cloud resources and unsanctioned SaaS services often bypass patching, configuration baselines and policy enforcement. These blind spots open pathways for attackers to exploit misconfigurations, unpatched workloads or forgotten assets.

Slow, point-in-time scanning

Periodic scans cannot keep up with cloud velocity or SaaS churn. SecPod found that only 42% of organizations have real-time monitoring, leaving large windows where misconfigurations go undetected. High‑profile incidents involving exposed cloud storage buckets, unsecured API endpoints and misconfigured access controls continue to show how short‑lived or poorly tracked resources can introduce risk long before teams are aware they exist.

Manual reconciliation

Data from spreadsheets, ITSM, CMDBs and disconnected tools rarely align. According to 2025 cybersecurity research by Bedrock Security, 82% of organizations report visibility gaps across their asset landscape, driven by fragmented data sources and inconsistent ownership. These blind spots make it difficult to normalize and reconcile cloud, SaaS and on-premises inventories, leaving security and IT teams unsure whether their asset data is complete or accurate.

These limitations slow operations, weaken security and create persistent blind spots across the entire estate — the exact issues that legacy discovery tools were never designed to solve.

A platform-governed visibility model for a modern world

Simply scanning more often or deploying another point solution won't close the visibility gap. Today's environment demands a fundamentally different approach.

Modern environments require a shift from periodic discovery to continuous, shared intelligence that multiple teams can trust. A platform-governed visibility model establishes a shared system of record for asset and configuration data across IT and security — one that continuously normalizes, reconciles and distributes trusted operational context.

Active and passive discovery work together to surface managed devices, unmanaged endpoints, cloud workloads, SaaS apps, remote assets and the identities connected to them. In practice, this requires a shared operational data foundation that can govern asset and configuration intelligence across systems, so teams are working from the same views rather than fragmented or conflicting records.

Core platform data and system of record

The Ivanti Neurons Platform serves as the authoritative operational data layer for IT and security, governing assets, endpoints and configuration state through a continuously updated system of record. This platform-governed operational data layer maintains a continuously updated view of asset and device inventory, support context and relationships, and software estate information.

A continuous discovery engine continuously ingests signals from across the environment and normalizes, deduplicates, and reconciles them into clean, consistent operational data. This governed data foundation is what automation and AI rely on to act safely and accurately, ensuring decisions are based on current operational reality rather than fragmented or conflicting inputs.

When execution systems consume this platform governed data, teams can act with confidence across IT and security. Where IT service management is in scope, this same operational data can extend into ITSM and CMDB workflows, while also supporting ITAM use cases such as lifecycle tracking and software entitlement management.

Normalize and reconcile continuously

A unified intelligence layer cleans, deduplicates, and correlates records and usage signals from every source, creating a shared, continuously updated asset dataset suitable for operational audit needs.

Map exposures to real assets

Exposure aggregation links vulnerabilities and misconfigurations to the exact devices, users and service owners affected — improving vulnerability prioritization and accelerating remediation.

Turn visibility into action

As environments continue to evolve faster than traditional tools can respond, organizations must rethink how visibility is achieved and shared. The path forward does not begin by replacing every tool, but by establishing a trusted visibility foundation that integrates with existing systems and enables better decisions everywhere else.

This live, platform-governed visibility foundation enables Autonomous Endpoint Management. Powered by the Ivanti Neurons Platform, it acts with confidence — triggering remediation, patching, configuration enforcement and self-healing based on verified operational state.

For organizations constrained by legacy discovery approaches, this means:

Shifting from periodic snapshots to continuous intelligence.
Moving from isolated tools to shared context.
Replacing manual reconciliation with automated trust.

Modern, platform‑governed discovery doesn’t just improve visibility. It creates conditions for action — where insight can reliably trigger remediation, automation and verification instead of stalling in dashboards.

Ready to eliminate blind spots for good? Explore how the Ivanti Neurons Platform establishes trusted asset and configuration visibility and enables autonomous endpoint management, exposure management and ITSM workflows to act on governed operational data across hybrid environments.

How Agentic AI is Transforming Infrastructure and Operations

Thu, 11 Jun 2026 13:35:04 Z

Infrastructure and Operations (I&O) teams have long operated under a familiar paradox: the faster the business scales, the more pressure I&O absorbs. Every new application deployment, every endpoint added, and every cloud workload spun up generates more complexity, more risk and more tickets.

The traditional responses to this pressure — more headcount, more tooling, more scripts, more APIs — have delivered incremental relief at best. Yet, the core structural problem, the underlying architecture of reactive operations, has remained stubbornly intact. Until now.

Agentic AI reinvents that architecture entirely.

AI in IT and Operations (I&O) has transcended the assist-and-suggest phase. Autonomous agents capable of reasoning, planning, executing and learning are now operational and not just future roadmap items. Organizations that are intentionally deploying agentic AI are already seeing significant benefits. Our 2026 AI Maturity research report found that 57% of IT organizations are using agentic AI for several important IT workflows, with 17% relying on it for extensive end-to-end processes. This deployment is leading to a compression of resolution times from hours to minutes and the deflection of thousands of manual tickets per quarter.

Moreover, 89% of organizations that have scaled AI to a broad or business-critical level reported that AI frequently helps their teams detect issues before end users are even aware, compared to 43% in the early experimentation stage. This shift is changing I&O from a reactive to a proactive and intelligent posture.

The question that remains is how quickly can your organization make the transition to implementing agentic AI in your I&O environment at scale?

Learn More: Transform IT with Agentic AI: the Dawn of Accelerated, Autonomous Service

Why we’ve reached the ceiling of traditional automation

To understand the significance of Agentic AI, it helps to appreciate what came before it and why it was never enough.

Traditional automation in I&O has been enormously valuable. Runbooks codified institutional knowledge. Scripts standardized repetitive processes. Robotic Process Automation (RPA) bots handle structured rules-based workflows. These tools reduced manual effort at the margins and allowed teams to do more with the same headcount. But they were always fundamentally brittle — dependent on explicit instructions, incapable of adapting to novel situations and unable to act without a human hand at the wheel.

Consider a classic scenario: a patch deployment fails on a subset of endpoints at 2 AM. A rule-based automation might log the failure and create a ticket. A more complex script might attempt a retry. But neither can diagnose whether the failure stems from a conflicting application, a corrupted agent, a network segmentation issue or a policy configuration drift. Neither can adapt its remediation strategy in real time. Neither can communicate context to the service desk, update the CMDB or escalate intelligently based on the criticality of the affected assets. A human engineer gets paged. The cycle continues.

This is the ceiling of traditional automation: it executes instructions, but it doesn't think. It automates tasks, but it can't orchestrate outcomes. And as infrastructure environments have grown exponentially more complex — spanning on-premises, multi-cloud, edge and hybrid architectures — the gap between what rule-based automation can handle and what I&O teams need has widened into a chasm.

Agentic AI is the answer to filling that gap.

What agentic AI means for I&O

Agentic AI systems can independently set goals, develop plans to achieve them, take multi-step actions across tools and systems, evaluate outcomes, and adjust their approach — all without requiring human intervention at each step. Unlike a chatbot that answers a question, or a script that executes a predefined workflow, an agentic system is goal-driven and adaptive. It operates across the full lifecycle of a task, from identification through resolution.

In the I&O context, this means an autonomous agent can do what previously required either a skilled engineer or a complex, fragile chain of automation scripts: correlate signals from disparate monitoring systems, identify the root cause of an incident, execute the appropriate remediation, verify that the fix worked, update the relevant records, and close the loop — all in the time it'd take a human to open a ticket.

The shift isn't just operational; it's philosophical. We move from a model where humans initiate action and automation executes it, to a model where intelligent agents start, execute, and verify action — and humans provide oversight and governance. For I&O leaders, this isn't a threat to the team. It's the greatest force multiplier your team has ever had.

Agentic AI powers I&O at scale

The service desk ticket queue is the most visible symptom of an I&O function under strain. Password resets, software installs, access provisioning, connectivity troubleshooting — these high-volume, low-complexity requests consume a huge share of analyst time and drive up operational costs. They're also deeply frustrating for employees who need resolution now, not after a 48-hour SLA window.

Learn More: Ticket Taker to Team Leader: Managing an Agentic IT Workforce

Eliminating the tyranny of the ticket queue

Agentic AI eliminates the queue as a bottleneck. Imagine having a conversational AI agent, like Ivanti Neurons AI Self Service Agent that not only retrieves an answer from a knowledge base — it validates identity, checks compliance policy, executes the provisioning workflow, confirms the change in the system of record, and notifies the requestor, all within minutes. The ticket never reaches a human analyst. The analyst's time is reclaimed for work that requires human judgment.

Now imagine giving an analyst more time to handle complex tasks. An agentic AI digital teammate, that works alongside a human agent to assist with proactive insights, advises about the best way to resolve the issue, and automates with intelligent actions.

Organizations deploying Agentic AI across their service desk consistently report significant reductions in ticket volume — often within the first year of deployment and compounding further as the system matures and learns. That's not automation in the traditional sense. That's intelligent orchestration at scale.

Proactive remediation before users feel the impact

The most expensive incidents in I&O are the ones that could have been prevented. Disk capacity that wasn't observed until it hit 100%. Certificate expirations that weren't tracked until services dropped. Software vulnerabilities that weren't patched until they were exploited. These failures were almost always predictable in retrospect — the signals were there. The problem was that no one was watching everything, all the time.

Autonomous Endpoint Management with agentic AI continuously monitors telemetry across endpoints, networks, applications and cloud infrastructure. The agents detect anomalies, correlate weak signals and begin remediation before an issue surfaces as an outage or a security incident. A disk trending toward capacity gets expanded. An expiring certificate gets renewed. A vulnerable endpoint gets patched during its next maintenance window, before exploitation becomes a risk.

This shift from reactive to proactive is the highest-value capability Agentic AI brings to I&O. It doesn't just reduce the cost of incidents — it prevents the incidents, the downtime, the business disruption and the reputational damage that accompany them. For I&O leaders, this shift redefines what operational success looks like. It moves the measure from mean time to resolution — a reactive metric — to mean time to prevention: how often your environment detects and corrects before business impacts occurs.

Scaling without scaling headcount

Enterprise IT environments are growing faster than IT budgets. The ratio of endpoints to engineers continues to widen. Cloud workloads multiply. Security requirements intensify. In this environment, the traditional lever of "hire more people" is neither financially sustainable nor operationally sufficient — the talent market simply can't supply the volume of skilled engineers required.

Agentic AI redefines the scaling equation. An autonomous agent doesn't have standard working hours, cognitive bandwidth limits or onboarding timelines. It can handle hundreds of concurrent tasks across thousands of endpoints without degradation in performance or quality. As the environment grows, the agent scales with it — not linearly, but exponentially. One well-configured autonomous agent can cover the workload previously distributed across multiple junior analysts, freeing senior engineers to focus on architecture, innovation and strategic initiatives rather than routine remediation.

This isn't about replacing people. It's about enabling them to operate at the level their skills deserve.

The system of record as the foundation for success

Deploying Agentic AI effectively requires more than a capable AI engine. It requires a trusted, comprehensive foundation of data — and that foundation is your system of record built into the Ivanti Neurons foundation, which contains an authoritative source of data including device intelligence, vulnerabilities and exposures, software inventory and service management information. A system of record that knows what assets exist, who owns them and are they compliant.

A system of record in the I&O context is the authoritative source of truth for your IT environment: every hardware and software asset, every configuration, every relationship, every policy, every change. It's the intelligence layer that enables an autonomous agent to make decisions with confidence. Without it, an agent operating in your environment is guessing. With it, it's reasoning from fact.

The most effective system of record for agentic AI in I&O brings together several critical elements. Configuration Management Database (CMDB) data must be accurate, current, and enriched — not the stale, manually updated repository that most organizations have inherited, but a dynamically maintained record of your actual environment. IT Asset Management (ITAM) to manage assets from creation to disposal and ensure accurate ownership is maintained.

Service management workflows must be fully integrated, so agents can create, update and resolve tickets as part of their execution flow. Identity and access data must be accessible, enabling agents to make policy-compliant decisions about provisioning and entitlement. And telemetry streams from monitoring, vulnerability and performance tools must flow into a unified context that agents can query in real time.

When these elements are in place, autonomous agents operate with precision. They know which assets are critical and which aren't. They know which changes require approval and which fall within defined automation boundaries. They know the history of an asset — previous failures, pending patches, installed software, active vulnerabilities — and they apply that context to every decision.

Organizations that attempt to deploy Agentic AI without investing in their system of record typically find that their agents produce inconsistent results or require constant human correction. The AI is only as intelligent as the data it has access to. Investing in data quality and integration isn't a prerequisite that can be deferred — it's the work that determines whether Agentic AI delivers transformative value or marginal improvement.

Business value: beyond efficiency metrics

The operational benefits of Agentic AI in I&O are compelling on their own terms. Faster resolution times. Lower ticket volumes. Reduced mean time to detect and remediate. These are metrics that resonate with I&O leaders and that justify the investment on a pure cost-efficiency basis.

But the business value extends well beyond the service desk dashboard.

When I&O teams are freed from reactive, repetitive work, they redirect their capacity toward the initiatives that drive competitive differentiation: accelerating application deployment, hardening security posture, enabling digital transformation programs and building the resilient, scalable infrastructure the business needs to grow. The I&O function evolves from a cost center absorbing operational noise into a strategic enabler shaping business outcomes.

Employee experience is an often-underappreciated dimension of this value. When employees receive instant, intelligent responses to their requests instead of days-long ticket queues, their productivity increases and their frustration with IT decreases. In a world where employee experience is a competitive differentiator for talent acquisition and retention, a frictionless, responsive IT function is a genuine business asset.

Agentic AI also delivers meaningful risk reduction. In an environment where a single ransomware incident can cost millions in downtime and remediation, and where regulatory penalties for security non-compliance are accelerating, proactive vulnerability management and automated policy enforcement provide quantifiable risk mitigation that resonates far beyond the IT organization at the board level and in the CFO's office.

Finally, agentic AI compounds in value over time. Every interaction, every resolution, every escalation decision generates data that improves the agent's future performance. Unlike static automation that degrades as environments change, agentic systems adapt and improve — delivering increasing returns on the initial investment.

The path forward

Infrastructure and operations are undergoing a pivotal transformation. The systems we oversee today are more intricate, widespread and vital to business success than ever before in the realm of enterprise IT. Demands on I&O are at an all-time high. However, the conventional operating model, which relies on reactive manual interventions and fragile rule-driven automation, has reached its maximum potential.

Agentic AI offers a fundamentally better model: one where intelligent, autonomous agents handle the high-volume, time-sensitive and increasingly complex work of infrastructure management — continuously, accurately and at scale — while your engineers focus on the strategic work that makes your organization more competitive and resilient.

Organizations investing in this capability today aren't simply improving their IT operations. They're building an I&O function capable of meeting the demands of the next decade of enterprise technology. We believe that's the standard every I&O leader should be building toward — and that Agentic AI is the most powerful tool available to get there.

Explore how Ivanti's Agentic AI capabilities are helping I&O teams transform their operations in Navigating the Shift to Agentic AI in IT Service Management.

June 2026 Patch Tuesday

Tue, 09 Jun 2026 21:27:02 Z

Source: Graph generated using Claude (Anthropic) on June 9, 2026, based on author-designed prompts and dataset by Chris Goettl.

You may have seen or heard a reference to the Patch Apocalypse, if not, you can dig into some more details here. The graph above shows a sample of several of the top vendor applications in all our environments. You can see a trailing twelve-month history of the number of CVEs resolved each month in these applications. Prior to February 2026, the scariest thing each month was the OS updates. Microsoft, Apple, Android, Linux flavors of every kind. This was the foundation that organizations built their monthly maintenance around and really focused on Patch Tuesday as the starting point of that monthly maintenance.

Looking at the three dotted lines on the graph you can see February was the first month when that blue line representing the Microsoft Windows OS started to see some competition. This was the first attribution of CVEs discovered by AI tools. In April, the second dotted line, we witnessed the announcement of Project Glasswing and a significant spike in CVEs discovered.

Fast forward to June Patch Tuesday and we see a massive green line next to a massive blue line. This is Google Chrome and Microsoft Edge (Chromium) which released a pair of updates already in June resolving over 500 CVEs in total including a zero-day exploit (CVE-2026-11645). Today, we are in the Patch Apocalypse. The Patch Apocalypse is now.

This is not intended to be a scare tactic. It is meant to outline the challenge that many organizations were anticipating, but the new generation of LLMs has accelerated significantly in the first half of 2026.

There are going to be more CVEs resolved by vendors at a faster and more continuous pace than we have ever seen previously. Unfortunately, this will also include more zero-day and n-day exploits than previously seen as well. The window from release from a vendor to exploitation had already shortened to 5 days as of 2023 threat intelligence data.

Many vendors have been acknowledging the need to utilize AI tools in their security research to identify and resolve security flaws in their products. Oracle recently announced their move to include the CSPU or monthly security update, which June will be the second instance of that new release cadence. Google Chrome had already moved to a weekly cadence back in 2023. Mozilla has typically released one to two security releases each month and is now tracking a nearly weekly cadence now as well.

Ivanti is tracking a 30-40% increase in patches released each month across the vendors supported in our Patch Catalog and we anticipate this to continue to accelerate for a while until we reach a new stable threshold, but the expectation is that this is not a spike. It is the new normal.

With that we return to the regularly scheduled June 2026 Patch Tuesday for a point in time update. Microsoft has resolved 198 CVEs, Google Chrome resolved 74 including the zero-day exploit (CVE-2026-11645), and Adobe resolved 123 CVEs across 11 updates.

I feel a bit desensitized at this point, but need to call it out that this is the largest CVE count resolved by Microsoft in a single Patch Tuesday. October 2025 was the previous high at 175 CVEs resolved. It seems inconsequential compared to CVE compared to the Chrome and Edge CVE count of 429 in the June 3, 2026 update from the prior week.

Expanding the conversation to the continuous release challenge: Based on Ivanti’s Patch Catalog, a quick tally of security related updates between May and June Patch Tuesday’s included 89 updates resolving 513 CVEs (Chrome and Edge are de-duplicated in this count). These updates should be included in your upcoming maintenance if you don’t have a continuous update approach in place today.

These releases include multiple releases for all major browsers (Chrome, Firefox, Edge, Opera, etc), PDF editors and viewers (Foxit, Adobe, Nitro), development tools (Node.js, VSCodium, Docker), common utilities and apps (Notepad++, PuTTY, PyCharm, Wireshark, Splunk UF), productivity and telecommunications apps (Teams, Zoom) and more.

Microsoft’s publicly disclosed vulnerabilities

Microsoft resolved a Security Feature Bypass Vulnerability in Windows Bitlocker (CVE-2026-50507). The vulnerability is rated Important by Microsoft and has a CVSS v3.1 score of 6.8, but has been publicly disclosed. The CVE lists exploit code maturity as Proof-of-Concept which puts this at a higher risk of exploitation. An attacker with physical access could use this vulnerability to bypass a security feature gaining access to encrypted data.

Microsoft resolved a Denial-of-Service Vulnerability in HTTP.sys (CVE-2026-49160). The vulnerability is rated Important by Microsoft and has a CVSS v3.1 score of 7.5, but has been publicly disclosed. The CVE lists exploit code maturity as unproven meaning to sample code was disclosed at the time this was released. An unauthorized attacker could take advantage of uncontrolled resource consumption in HTTP/2 to cause a denial of service over a network.

Microsoft resolved an Elevation of Privilege Vulnerability in Windows Collaborative Translation Framework (CVE-2026-45586). The vulnerability is rated Important by Microsoft and has a CVSS v3.1 score of 7.8, but has been publicly disclosed. The CVE lists exploit code maturity as unproven meaning to sample code was disclosed at the time this was released. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges on the target system.

Ivanti security advisories

Ivanti has released two security updates for June. The updates affect Ivanti Endpoint Manager Mobile and Ivanti Sentry and resolve a total of four CVEs. More details and information about mitigations can be found in the June Security Advisory.

Third-party vulnerabilities

Adobe released 11 updates resolving 123 CVEs. Adobe has prioritized the ColdFusion update as the highest priority.

Google Chrome resolved 74 CVEs in the latest Chrome update including a zero-day exploit (CVE-2026-11645). This comes on the heels of the largest Chrome release on June 3 that resolved 429 CVEs. Microsoft Edge also needs to be updated to resolve these CVEs.

June update to-do list

Google Chrome and Microsoft Edge are the top priority this month to resolve 500+ CVEs resolved in the past week and a zero-day exploit (CVE-2026-11645).
The Windows OS update is the next highest priority as it resolves over 110+ CVEs depending on edition.

June 2026 Security Update

Tue, 09 Jun 2026 14:06:32 Z

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) and Ivanti Sentry.

It is important for customers to know:

We have no evidence of these vulnerabilities being exploited in the wild.
These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

How AI will affect vulnerability disclosures in our products

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

June 2026 Ivanti Neurons for ITSM Security Update

Mon, 01 Jun 2026 14:00:44 Z

In today’s rapidly evolving technology and threat landscape, responsible transparency should be a cornerstone of any product security program. As part of our ongoing product security program, we continually assess, investigate, and address vulnerabilities. When an issue is found, we communicate relevant information as quickly and responsibly as possible.

To this end, we are issuing an important security update addressing vulnerabilities in Ivanti Neurons for ITSM (cloud and on-premises). Customers should review the Security Advisory for more information and version specific details.

Customers using the on-premises Ivanti Neurons for ITSM solution should review the Security advisory and apply fix as soon as possible.

At the time of this publication, we are not aware of any customers being exploited through the vulnerability disclosed today.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Customers and partners with questions about their environment or remediation steps can contact Ivanti Support. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

To Up-Level Your Security Maturity, Rethink Your Vulnerability Remediation Capabilities

Thu, 28 May 2026 14:00:05 Z

Security teams are drowning in vulnerabilities. We’re talking tens of thousands of findings per quarter. Hundreds of thousands at larger organizations. Today's IT environments have no boundaries and span across every OS platform. Managing and securing that estate in a linear fashion is no longer viable, and neither is a vulnerability remediation process that treats every fix as a simple, low-impact task.

Risk-based prioritization helps cut through that noise by introducing threat context and business context into the vulnerability remediation process. That was a meaningful step forward. But many organizations that have adopted risk-based prioritization are still missing SLAs, still generating friction with IT and still watching exceptions pile up faster than remediations.

Knowing what to fix first is only part of the equation.

The harder part, and the part many programs still lack, is understanding what the real-world impact of that fix will be. More importantly, how to accelerate remediation from once a month to a continuous process, while balancing risk vs. impact.

This is operationally balanced remediation: the practice of weighing the real-world impact of a fix before committing to it. It is the critical missing piece in many vulnerability remediation programs and one of the clearest markers of exposure management maturity. Ivanti's Exposure Management Maturity Model identifies it as one of six core capabilities that separate mature security programs from reactive ones.

What is operationally balanced remediation?

The maturity model defines it simply: the ability to fix or mitigate exposures in a way that's both effective and practical. Security urgency balanced against IT realities like system uptime, patch testing and business continuity.

In practice, it comes down to one equation: security risk plus real-world impact equals an informed remediation decision. Identifying exposures has no value if you can't remediate them. And remediation that creates unplanned downtime, breaks production systems or triggers rollbacks hasn't reduced risk. It's shifted it.

The vulnerability remediation maturity journey: from reactive to strategic

Phase 1: traditional vulnerability management (the scan-and-patch era)

This is where vulnerability remediation started for many organizations, and where many still sit. Prioritization is CVSS-driven and first-in-first-out. Your scanner tells you "You have 10,000 CVEs" with no context about which ones matter.

Exceptions go undocumented. Vulnerability scanning and remediation workflows live in separate tools with minimal integration.

The result is reactive mode: chasing the latest high-profile disclosure instead of addressing what poses the greatest risk to the environment.

Phase 2: risk-based vulnerability prioritization (adding context)

Risk-based prioritization introduced two better questions: "Is this vulnerability actively being exploited?" And "How critical is the asset it affects?" Combining severity with threat intelligence and asset criticality gave security teams a sharper focus for their vulnerability remediation efforts. AI-driven vulnerability intelligence and patch reliability scoring have accelerated this process further by reducing the manual analysis burden that once forced security teams to make prioritization calls with incomplete data.

But there’s still a missing piece. Risk-based prioritization tells security what to fix. It says nothing about what IT needs to keep running. Collaboration between the two teams still often happens case by case, and the impact of remediation on IT operations remains an afterthought or more often an anchor holding organizations back from accelerating remediation activities.

Phase 3: the missing piece — operationally balanced remediation

For organizations that have developed the maturity to understand the real-world risks of an exposure, the next question they ask is: "What will the impact of this fix be on the systems we need to keep running, and can we afford to leave it exposed?"

When vulnerability remediation is forced without considering downstream effects, the result is downtime, resistance from IT and a growing backlog of exceptions that undermine the very security goals driving the urgency.

Ivanti's 2026 State of Cybersecurity Report found that 48% of security professionals say IT teams don't respond urgently to cybersecurity concerns, while 40% believe IT lacks an understanding of their organization’s risk tolerance. That's what happens when security and IT operate with different priorities and no shared way to resolve them.

The most mature programs address this not just through process alignment, but through automation that removes the manual handoffs where friction accumulates. Automated self-healing capabilities can detect, diagnose, and remediate endpoint and cyberhygiene issues proactively. This reduces the volume of vulnerabilities requiring manual triage in the first place. When remediation is built into how endpoints operate rather than bolted on after the fact, the gap between security urgency and IT capacity shrinks on its own.

The maturity indicator here is clear: shared KPIs between security and IT, documented exception processes and a vulnerability remediation tracking system that accounts for both risk reduction and business continuity. Achieving this continuously requires IT and security to operate from shared data and shared workflows.

When asset visibility, exposure aggregation, risk-based prioritization, and remediation run on a unified platform, the alignment that Phase 3 demands becomes a structural property of the system rather than a hard-won cultural achievement.

How operationally balanced remediation differs from risk-based prioritization

The simplest way to see the progression is through the questions each approach can answer.

Approach	Questions It Answers	What It Misses
Traditional VM	How many vulnerabilities exist?	Context and prioritization
Risk-based prioritization	Which vulnerabilities pose the greatest risk?	Operational feasibility and impact
Operationally balanced remediation	Which vulnerabilities should we fix first, given both security risk and operational constraints? How can automation ensure those fixes execute efficiently and without disruption?	Most comprehensive approach

This approach adds a layer of context to vulnerability remediation management: patch testing requirements, system dependencies, maintenance windows, potential downtime and rollback capabilities. These determine whether a fix holds — or creates new problems that require rollback.

Why operationally balanced remediation is central to exposure management

The maturity model identifies six core capabilities: asset visibility, asset importance, real-world vulnerability assessment, business-driven vulnerability prioritization, operationally balanced remediation and data/workflow integration.

Of these, operationally balanced remediation is the execution layer that makes the rest actionable.

Without it, exposure management stays theoretical. You can build perfect asset inventories, score every vulnerability with precision and produce dashboards that look impressive.

But if the vulnerability remediation process remains separate, it creates friction between security and IT, known risks accumulate, patches are delayed and the metrics on those dashboards stop reflecting actual risk posture.

The maturity progression runs from ad hoc prioritization (Phase 1) through case-by-case collaboration (Phase 2) to shared KPI-driven remediation (Phase 3) and finally audited retrospectives with a continuous improvement loop (Phase 4). Not every organization needs to reach Phase 4 across every capability. But getting from ad-hoc to shared, KPI-driven remediation is where the real gains happen.

The business case: balancing security and operational goals

Hidden costs of remediation without operational context

When vulnerability remediation is driven purely by security urgency, costs pile up in ways that stay invisible until they become systemic.

Unplanned downtime is the most obvious cost: critical business systems taken offline without proper impact assessment. But the downstream effects are just as damaging.

IT teams build workarounds when security mandates are impractical to execute, creating shadow processes that increase risk instead of reducing it. Exception fatigue sets in when exceptions outnumber compliant cases, rendering SLAs meaningless. And trust between security and IT erodes when each side views the other as either reckless or obstructionist.

Ivanti's research confirms how widespread this friction is. Thirty-nine percent of cybersecurity professionals say they struggle to prioritize risk remediation and patch deployment, and 35% report difficulty maintaining patch compliance.

Meanwhile, only 60% use business impact analysis to inform risk prioritization, and just 51% use a cybersecurity exposure score or risk-based index.

Many still rely on process metrics like mean time to remediate or percentage of exposures remediated, which can look positive in isolation but reveal little about whether the vulnerability remediation process is actually improving risk posture.

The ROI of operationally balanced automated vulnerability remediation

When organizations make this shift, the results show up fast. Shared KPIs drive realistic remediation timelines, which in turn improve SLA compliance. Median time to remediate drops when deployment barriers are expected rather than discovered mid-rollout.

Fixes stick because they account for system dependencies and maintenance windows rather than creating new problems that require rollback. Ring deployment is a good example: patches roll out to progressively larger groups, validated at each stage before expanding. That's what makes balanced remediation practical.

Combined with automated workflows that handle the correlation, triage and deployment orchestration, these mechanisms turn balanced remediation from a concept into a continuously operating system. When the platform handles the operational complexity, security teams spend less time managing the remediation process and more time validating outcomes.

Organizations at Phase 3 or Phase 4 maturity in Ivanti’s model track vulnerability remediation with metrics that reflect both security and operational outcomes:

SLA broken out by known exploited vs traditional severities
Median time to remediate (MTTR) for exploited vulnerabilities
Percentage of exception requests reviewed jointly by security and IT
Reduction in repeat exceptions over time

The strategic value extends further. When vulnerability remediation management accounts for what IT needs to keep running, security stops being perceived as a blocker and starts functioning as a business enabler. That shift is what unlocks sustained investment and executive support for exposure management.

From prioritization to execution: close the gap

Risk-based vulnerability prioritization was a necessary evolution. But it solved only half the problem. Knowing what to fix first has limited value if the act of fixing it creates downtime, resistance or a growing pile of undocumented exceptions.

Operationally balanced remediation closes the gap by getting security and IT working from the same playbook. That shows up in shared KPIs, clearly defined exceptions, and maintenance windows that protect business continuity. It also means automating remediation workflows that can spot and avoid potential downtime before it becomes a problem.

With prioritization, insight generation, and orchestration, remediation can keep pace with the environment instead of falling behind it. And with a unified platform that connects endpoint and security data, teams aren’t fighting silos—they’re moving in sync.

For a deeper look at how to benchmark your organization’s current maturity and build a targeted plan for growth, see Ivanti's Exposure Management Maturity Model.

Transform IT with Agentic AI: the Dawn of Accelerated, Autonomous Service

Tue, 19 May 2026 14:49:37 Z

The IT service management (ITSM) industry stands at a real inflection point. For decades, service desks have operated on a fundamentally reactive model — employees face problems, submit tickets and wait for human analysts to diagnose, triage and resolve their issues. Automation improved throughput within that model, but it never challenged the model itself.

The inflection point: why ITSM will never be the same

Agentic AI changes the equation entirely. Rather than simply accelerating the speed at which humans process requests, agentic systems understand intent, pull contextual information, choose an action path, execute across enterprise tools and confirm outcomes without waiting for a human to press "approve" on each step. We're witnessing the transition from IT service management to IT service autonomy, and the implications for every CIO, CISO and IT leader are profound.

The numbers reinforce the urgency. Gartner predicts that by the end of 2026, roughly 40% of enterprise applications will embed task-specific AI agents, up from less than 5% in 2025. Gartner research also predicts that 70% of enterprises will deploy agentic AI agents to simultaneously operate their IT infrastructure by 2029 — compared to less than 5% today.

These aren't incremental shifts. They represent a wholesale reinvention of how technology organizations deliver, secure and optimize services.

From scripted bots to autonomous agents: the evolution of intelligence in ITSM

Understanding where the industry is heading requires understanding where it has been. The evolution of AI in ITSM follows a clear arc that moves from deterministic scripted logic toward truly autonomous reasoning.

Phase one: rule-based automation

The earliest wave of ITSM automation involved scripted workflows — if a ticket matched certain keywords, it was routed to a predefined queue; if an asset fell out of compliance, a remediation script fired automatically. These automations deliver measurable efficiency gains by eliminating costly manual processes and making operations more compliant and secure. However, they remained brittle. Every new situation required a new rule, and the system could never handle ambiguity or learn from its own outcomes.

Phase two: AI-assisted service management

The arrival of machine learning and generative AI introduced a more adaptive layer. AI began classifying tickets automatically, summarizing incidents for analysts and generating knowledge articles from historical resolution data. Approximately 40% of organizations have now embraced AI to facilitate more efficient ticket resolutions.

Chatbots and virtual assistants have brought consumer-grade conversational interfaces into the enterprise, enabling employees to interact with IT support through natural language rather than structured forms. These abilities represented a meaningful leap, but the AI still operated primarily as an assistant. The AI is augmenting human decision-making rather than replacing it.

Phase three: Agentic AI and autonomous workflows

This is where the industry stands today, at the threshold of a third and far more transformative phase. Agentic AI systems don't wait for instructions. They observe, reason, plan and act.

In ITSM terms, an agentic system can detect an anomaly on an endpoint, correlate it with known vulnerability patterns, start a healing sequence, update the Configuration Management Database (CMDB) and close the resulting ticket — all before the affected employee notices a problem. Gartner has formalized this trajectory, predicting that by 2028, at least 15% of day-to-day work decisions will be made autonomously through agentic AI, up from 0% in 2024, and that 33% of enterprise software applications will include agentic AI by that same year.

The critical distinction is agency. Earlier AI tools responded to prompts. Agentic systems pursue goals. They maintain memory across interactions, reason about the best path to an outcome and execute multi-step workflows across integrated enterprise systems. This is the architectural leap that transforms ITSM from a discipline centered on processing requests to one centered on delivering outcomes.

The anatomy of agentic ITSM: persona-based and task-based intelligence

As agentic AI matures, its application in ITSM is coalescing around two complementary architectures: persona-based agents and task-based agents. Together, they form what many industry observers are calling the "conversational front door" to IT — a unified, intelligent interface that replaces fragmented portals, forms and phone trees with natural, adaptive interactions.

Persona-based agents

Persona-based agents are designed around the needs of specific user roles. A self-service agent, for example, serves as the first point of contact for employees. Rather than forcing users to navigate a service catalog and complete structured forms, a conversational self-service agent uses adaptive intent understanding and guided data capture to translate a natural language request into a fully structured, actionable ticket. The result is dramatically reduced friction for employees and significantly improved data quality for service teams. The impact of this approach is substantial — organizations deploying AI-powered virtual support agents have reported 50% to 70% reductions in call volumes alongside employee adoption rates of 80% to 85%.

Service-desk agents

By contrast, a service desk agent augments the live analyst. It provides context-aware guidance during ticket handling, accelerates triage and classification and offers real-time coaching that elevates less experienced analysts to the proficiency of seasoned veterans.

AI-driven incident summarization saves analysts significant time by automatically distilling complex ticket histories into actionable briefs. The analyst remains in the loop, but the loop is tighter, faster and more informed.

Task-based agents

Task-based agents handle discrete operational functions, such as knowledge search, incident creation, service request fulfillment, summarization and Q&A. These agents operate within an agentic framework that includes goal definition, environmental modelling, memory, reasoning and action execution. The interoperability standards appearing around Agent-to-Agent (A2A) and Model Context Protocol (MCP) communication are particularly significant. They signal an industry moving toward multi-agent ecosystems where specialized agents collaborate to resolve complex, cross-domain issues — what some analysts are calling "agent squads."

Gartner's own roadmap confirms this trajectory. By 2027, one-third of agentic AI implementations are expected to combine agents with different skills to manage complex tasks within application and data environments. The implication for ITSM is clear: the future service desk isn't a single monolithic system but an orchestrated ensemble of specialized agents, each contributing domain-specific intelligence to a unified service experience.

Self-Healing, self-securing, self-serving: the 3 pillars of autonomous IT

The strategic promise of agentic AI in ITSM rests on three interconnected capabilities that, taken together, define what truly autonomous service delivery looks like in practice.

Self-healing

Self-healing represents the most visible departure from traditional reactive support. Through anomaly detection and automated diagnosis, modern platforms can identify endpoint and security issues before they affect users. Cloud-based bots powered by hyper-automation don't just alert IT staff to problems — they actively resolve previously unreported or ignored issues, proactively expediting detection, resolving incidents automatically and freeing IT to focus on innovation. The industry trajectory here's unmistakable. As organizations mature their self-healing capabilities, the volume of human-touched tickets will decline steadily, and the service desk's role will shift from resolution to governance and continuous improvement.

Self-securing

Self-securing addresses the reality that cybersecurity and IT operations can no longer operate in silos. AI-driven visibility across devices, organizational structures and digital experiences enhances security posture by proactively identifying potential vulnerabilities based on social trends and vulnerability scoring.

Maintaining a consistently reconciled software inventory helps identify exposures before they become breach opportunities. The convergence of ITSM and security operations is accelerating as agentic AI provides the connective tissue between threat detection, vulnerability management and remediation workflows.

Organizations that unify IT and security through an AI-driven platform are positioned to deliver what the industry increasingly describes as "invisible but inescapable security" — protection that operates continuously without creating friction for end users.

Self-service is being reimagined from the ground up. Traditional self-service portals suffered from low adoption because they imposed the system's logic on the user rather than adapting to the user's intent. Conversational AI inverts this dynamic.

Employees interact through natural language, and the system handles the complexity of routing, classification and fulfillment behind the scenes. AI-powered virtual assistants deliver exceptional experiences by increasing productivity and satisfaction, bringing the ease of consumer virtual assistants into the workplace while maximizing adoption and reducing call volumes. Looking ahead, self-service will evolve further as voice automation, mobile-first interfaces and proactive notifications create an omnichannel support experience that meets employees wherever they work — at a desk, on the factory floor or on the road.

The strategic implications: what this means for IT leadership

The rise of agentic AI in ITSM carries implications that extend well beyond the service desk. For CIOs and IT leaders, several strategic themes demand attention.

The shift from cost center to value center

When routine incidents resolve themselves and AI handles first-line triage, the service desk is no longer defined by ticket volume and average handle time. Instead, IT teams are liberated to focus on strategic initiatives — digital transformation, employee experience innovation and business process automation. The question for IT leaders is no longer, "How do we handle more tickets faster?" But, "How do we redeploy the capacity that autonomous service creates?"

The imperative of governance and trust

The same Gartner research that forecasts explosive growth in agentic AI also sounds a note of caution: Over 40% of agentic AI projects may be canceled by the end of 2027 if costs, value clarity or risk controls prove inadequate. Successful implementations will demand built-in compliance, visibility rules and policy adherence from day one. AI governance isn't a bolt-on problem — it's a foundational design requirement. Organizations that embed guardrails, approval workflows and auditability into their agentic architectures will realize sustainable value; those that treat governance as an afterthought will face costly reversals.

The convergence of IT and security operations

Data silos between IT and security teams have long weakened organizational resilience. Agentic AI platforms that unify service management, endpoint management and exposure management create a system of record — enabling coordinated, intelligent response across traditionally separate domains. This convergence isn't just a technology play; it requires organizational alignment, shared metrics and a cultural commitment to breaking down functional barriers.

The employee experience as competitive advantage

The ability to measure and quantify the digital employee experience — across devices, service management, security and applications — through AI-driven sentiment analysis transforms employee experience from an abstract aspiration into a data-driven discipline. Organizations that provide seamless, consumer-grade IT experiences will attract and retain talent more effectively than those that treat IT support as a back-office function. The Digital Employee Experience (DEX) score is emerging as a critical KPI, offering service desk analysts the visibility to deliver personalized, empathetic support at scale.

Enterprise service management beyond IT

Perhaps the most underappreciated implication of agentic AI is its potential to extend intelligent service delivery beyond IT into HR, facilities, finance and other business departments. When the underlying platform supports no-code, workflow design and pre-built integrations with external systems, patterns proven in IT service management become templates for enterprise-wide transformation. Business departments that still rely on ad hoc emails, dated spreadsheets or paper documents stand to benefit enormously from the same agentic capabilities reshaping IT.

The autonomous service imperative

The transformation of IT service management through agentic AI isn't a distant possibility — it's an active, accelerating reality. The organizations that thrive will be those that recognize this shift for what it is: not just a technology upgrade, but a fundamental reimagining of how services are designed, delivered and experienced across the enterprise.

The human role will shift, not disappear. Agentic AI won't eliminate IT professionals — it'll elevate them. Analysts will transition from ticket processors to AI supervisors, governance architects and experience designers. The most valuable IT professionals of the next decade will be those who can design, train and govern autonomous systems rather than operate them manually.

The path forward demands a clear-eyed strategy. Start with the automation foundation — intelligent workflows, AI-assisted classification and self-service interfaces that reduce friction and improve data quality. Build toward autonomous capabilities — self-healing endpoints, self-securing environments and conversational agents that resolve issues end–to-end. And invest in the governance, culture and talent development that'll sustain autonomous operations at enterprise scale.

The question for IT leaders is no longer whether agentic AI will reshape service management. The question is how quickly and how strategically your organization can operationalize it. The era of autonomous service has begun, and the competitive advantage belongs to those who move decisively — not to those who wait for certainty that'll never arrive.

May 2026 Patch Tuesday

Tue, 12 May 2026 21:52:21 Z

Continuing the Patch Apocalypse this month we are already seeing some more aggressive shifts in updates from many vendors.

Oracle announced a new release cadence starting in May 2026 to address the acceleration of vulnerability detection introduced by Mythos and other AI security models. Monthly Critical Security Patch Update (CSPUs) will fill in the two-month gap between their quarterly Critical Patch Update (CPU).

Mozilla had been working with AI models prior to Mythos which led to 22 security-sensitive bugs being resolved in Firefox 148. They announced continued collaboration with Anthropic to apply an early version of Mythos to Firefox and released Firefox 150 resolving 271 vulnerabilities identified during the evaluation. Since Firefox 150.0.0 released, they have been on a more aggressive weekly cadence for security updates including the release of Firefox 150.0.3 on May Patch Tuesday resolving between three to five CVEs in each release.

Apple is another early participant in Project Glasswing and has seen a recent spike in the number of exposures resolved. They typically average around 20 CVEs per iOS security update. For their most recent update on May 11, there is a spike of over 70 CVEs resolved. across the 11 Apple updates. While there are not actively exploited vulnerabilities, there are a lot of updates to manage.

Microsoft resolved 118 CVEs in the May 12, 2026 Patch Tuesday update. There are no exploited or publicly disclosed vulnerabilities this month, but the updates resolve 16 Critical CVEs, 105 Important, 5 Moderate, and 1 Low. Office is likely the higher risk this month with four Critical RCE vulnerabilities resolved in this update, but the OS, as usual, has a lot of CVEs being resolved.

Third-party vulnerabilities (Leading up to and including Patch Tuesday)

Adobe resolved 52 CVEs in their Patch Tuesday update that included 10 bulletins. Adobe Commerce is the clear priority — it's the only Priority Two update this month, with 10 Critical CVEs including two at CVSS 8.7, and several DoS vulnerabilities that require no admin privileges to exploit.

Apple released updates for their platforms on May 11 resolving between 25 and 52 CVEs across all platforms. The release did not include any exploited or publicly disclosed vulnerabilities, but is notably larger than average.

Google released Chrome 148 on May 5 resolving 127 CVEs including three Critical ratings. Google has been on a weekly cadence for Chrome updates for a while now, but the May 5 update is far larger than average for Chrome (possibly the largest CVE count resolved in a single update). Another Chrome release is expected on or shortly after Patch Tuesday.

Mozilla has been on a steady weekly release scheduled for Firefox since the release of Firefox 150. Mozilla made some headlines with the 271 CVEs resolved in Firefox 150.0.0 and has been averaging three to five CVEs resolved each week since. The release of Firefox 150.0.3 on Patch Tuesday is the latest release, which resolved five CVEs all with a High rating.

Ivanti security advisories

Ivanti has released four security updates for May Patch Tuesday. The updates affects Ivanti Secure Access Client, Ivanti Xtraction, Ivanti Virtual Traffic Manager, and Ivanti Endpoint Manager and resolves seven CVEs. More details and information about mitigations can be found in the May Security Advisory.

In addition, Ivanti released a Security Update for Ivanti Endpoint Manager Mobile (EPMM) on May 7 which resolved five CVEs including CVE-2025-6973. At the time of disclosure, Ivanti was aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation. More details and information about mitigations can be found in the May 2026 EPMM Security Update Advisory.

May update to-do list

Third-party update cadence is accelerating. Ensure you are prioritizing more frequent update schedules for priority applications such as browsers, productivity apps, and telecommunications apps.
Microsoft and Apple both released updates across pretty much every platform. No exploits, but there are a lot of vulnerabilities to remediate.