Ivanti Blog

5 Generative AI Security Risks Compliance Teams Need to Know

Mon, 27 Jul 2026 10:00:07 Z

Your employees aren't trying to create compliance incidents by using AI tools. They're trying to finish their work faster. According to a 2026 BCG survey, 74% of frontline employees now use generative AI every day or a few times a week. When an employee uses an enterprise AI assistant to summarize a customer contract before a meeting, another pastes application logs into a public generative AI tool to troubleshoot an issue, or a developer relies on an AI coding assistant connected to an internal knowledge base, each action moves organizational data into a new processing pipeline that traditional security and privacy programs were not designed to govern.

Unlike traditional applications, generative AI processes retrieve enterprise data, maintain context, create new content and may log interactions for improvement or audit purposes. Each of these stages introduces a potential exposure point and broadens your organization’s attack surface.

For data privacy and compliance teams, the use of generative AI in the workplace raises new questions they may not be able to easily answer during your next inquiry or audit such as: who authorized that AI tool to process this data, where did it go and how long was it retained? For CISOs and privacy officers, that gap between what employees do and what governance programs currently cover is where generative AI security risks arise. The issue is no longer whether to adopt AI, but whether organizations understand where their data goes once AI enters the workflow.

What are the security risks of generative AI?

Generative AI is more than another enterprise application. It changes how organizational data is accessed, interpreted, shared and retained. Generative AI systems interact with prompts, internal repositories, conversational context and generated outputs, creating new exposure points if those interactions are not properly governed.

Key security risks include:

Sensitive data leakage: Employees may unintentionally share confidential information, source code, customer records, or intellectual property with shadow AI tools that are not approved to process that data.
Prompt injection attacks: Malicious prompts or hidden instructions can manipulate AI behaviour, bypass safeguards, retrieve unauthorized information, or generate misleading responses.
Unauthorized data retrieval: If knowledge sources have broad or misconfigured permissions, AI applications may expose documents users should not be able to access.
Context and conversation leakage: Without session isolation and memory controls, sensitive information shared in one interaction may resurface later in the same conversation or influence future responses.
Weak logging and retention controls: Prompts and outputs can contain sensitive business or personal data. Without defined retention, masking and access controls, logs can become new repositories of regulated information.

These risks may look technical, but they are primarily governance challenges. Generative AI amplifies existing gaps in data classification, identity and access management, monitoring and information governance. Organizations that know where sensitive data resides, who can access it, and how it should be protected are better positioned to adopt AI securely.

How generative AI affects data privacy

Generative AI changes how organizations collect, process, store and share data. Unlike traditional applications with defined processing paths, generative AI systems interpret prompts, retrieve information from multiple sources, generate new content, and may retain interactions for monitoring, auditing, or service improvement. This expands how sensitive data moves through the enterprise.

Key privacy challenges include:

Greater exposure of personal and confidential data: Employees may include personal data, customer records, financial data, or intellectual property in prompts, potentially moving that data outside direct organizational control.
Expanded processing scope: AI applications often combine prompts with data from internal repositories and business systems, raising questions around purpose limitation, data minimization and access governance.
New retention obligations: Prompts, outputs and system logs may contain regulated or confidential data, requiring clear rules for retention, access and secure deletion.
Higher risk of unauthorized disclosure: Weak access controls, prompt injection, or overly broad retrieval mechanisms can expose information users were never intended to process.

Generative AI does not change the core principles of data privacy; it makes them harder to apply consistently. Data minimization, purpose limitation, transparency, security of processing and accountability must now extend across the full AI data lifecycle.

The five data-flow risks security risks introduced by gen AI

1. Training data leakage

When employees use public AI tools with confidential pricing, customer records, source code, or internal documents, sensitive data can leave the organization’s governed environment. Even if the provider does not use the data for training, the organization may lose visibility into how that information is processed, retained, or shared. The leadership question is simple: should this data have entered an AI system at all?

2. Prompt injection

Prompt injection allows malicious instructions hidden in prompts, documents, or web content to influence AI behaviour. For enterprises, the risk is that an AI assistant connected to internal knowledge sources may bypass intended safeguards, expose sensitive information, or generate misleading outputs. This requires AI-specific monitoring, testing and guardrails beyond traditional input validation.

3. Context-window exfiltration

AI systems retain conversational context to improve continuity, but that same memory can expose sensitive information beyond its intended use. For example, confidential HR, legal, or customer details shared for one task may resurface later in the same session. One must ensure session isolation, memory limits and clear controls for sensitive workflows.

4. RAG retrieval over-permissioning

Retrieval-Augmented Generation makes enterprise AI more useful by connecting models to internal knowledge sources. However, if permissions are broad or misconfigured, AI may surface documents users should not access — such as legal files, executive compensation data, or restricted HR records. Strong identity governance and repository audits are essential before scaling AI broadly.

5. Output logging and retention

AI prompts and responses may be stored in logs, monitoring systems, backups, or analytics platforms long after the original business purpose ends. If those records contain personal, customer, or regulated data, they become new governance obligations. Organizations should define retention, storage, access, masking and deletion rules for AI-generated content.

How organizations can ensure data privacy when using generative AI

Protecting privacy in generative AI is not about slowing innovation. It is about governing how data moves through prompts, retrieved knowledge, model outputs, conversational context, and AI-generated content.

Foundational practices include:

Classify data before AI use: Identify personal data, financial records, intellectual property, and regulated data before they enter AI systems. Give employees clear guidance on what can and cannot be shared.
Understand and manage cross-border data flows: Generative AI introduces additional cross-border data transfer risks that organisations must understand and assess before connecting data sources, knowledge repositories, or third-party AI services.
Enforce least-privilege access: Ensure AI applications retrieve only the information a user is already authorized to access, especially when connected to for example RAG-based knowledge repositories.
Govern prompts and outputs: Define policies for logging, monitoring, retention, storage, masking, access, and secure deletion of AI interactions.
Build privacy into AI design: Incorporate privacy by design and default, data minimization, masking, and human oversight during AI design and deployment — not after implementation.
Train employees on responsible AI use: Use awareness training and acceptable-use policies to reduce accidental exposure from well-intentioned AI usage.

Ultimately, technology alone cannot ensure AI privacy. Secure adoption requires governance across security, privacy, legal, compliance, and product teams. By understanding AI data flows and applying controls at every stage, organizations can use generative AI while protecting sensitive information, maintaining trust, and meeting regulatory obligations.

Regulatory overlay: GDPR, CCPA and the EU AI Act

Security incidents involving generative AI rarely remain just security incidents. Once personal data or confidential information is exposed, organizations must also consider their privacy and regulatory obligations. Rather than introducing entirely new compliance requirements, generative AI amplifies the need to apply existing privacy principles consistently across new AI-driven data flows.

The table below maps common gen AI risks to the obligations they are most likely to trigger.

Risk area	Business impact	Regulatory focus	Leadership action
Training data leakage	Sensitive data leaves governed environments and may be reused or retained externally.	Data minimization, lawful use, transparency, and vendor accountability.	Approve AI usage policies, restrict public tools, and validate provider controls.
Prompt injection	Malicious instructions can bypass safeguards and expose sensitive information.	Secure processing, access controls, risk management, and incident response.	Fund AI threat monitoring, testing, and prompt-filtering controls.
Context-window exfiltration	Sensitive details may remain visible across a session beyond their intended purpose.	Confidentiality, purpose limitation, data minimization, and privacy by design and default.	Require session isolation, memory limits, and clear controls for sensitive workflows.
RAG over-permissioning	AI may surface documents users are not authorized to access.	Least privilege, access governance, accountability, and human oversight.	Mandate IAM alignment, repository audits, and regular permission reviews before scaling AI.
Output logging and retention	Prompts and outputs can become unmanaged stores of regulated data.	Retention, deletion, auditability, records management, and data subject rights.	Set retention standards, protect AI logs, and include outputs in deletion workflows.

Across all five risks, the central issue is governance. Regulators expect organizations to understand how personal and sensitive data moves through AI systems, apply effective controls, and demonstrate accountability when those controls fail. The EU AI Act reinforces this expectation by emphasizing transparency, risk management, human oversight, and accountability across the full AI lifecycle.

AI does not create entirely new privacy principles; it exposes and amplifies existing governance gaps. Rather than building a separate AI compliance program, organizations should extend current privacy and security controls into AI workflows. A practical starting point is to ask:

Have we defined what data and identified the data sources that employees are allowed to use with AI systems?
Do AI applications retrieve only information users are authorized to access?
Are prompts, responses, and AI logs covered by retention and protection policies?
Can we explain and audit how data moves through our AI applications?

If the answer is yes, the organization has a strong foundation for responsible AI adoption. If not, these are the governance gaps to close before scaling AI across the enterprise.

Govern AI where your data moves

Organizations do not need to slow down AI adoption to manage risk. They need to extend the controls they already trust — data classification, access governance, monitoring, retention, storage and cross-functional review — into the AI workflows where sensitive information now moves.

Start with five practical actions:

1. Classify sensitive data: Know which data should never enter public or unapproved AI tools.

2. Lock down AI-connected knowledge sources: Apply least-privilege access before connecting internal repositories to AI assistants.

3. Define approved AI use: Make it clear which tools employees can use and what types of data those tools may process.

4. Monitor AI activity: Watch prompts, outputs, and usage patterns for sensitive data exposure or unusual activity.

5. Govern AI records: Set retention, storage, deletion, masking, and access rules for prompts, responses, logs, and generated content.

These steps do not require a new compliance function or a separate AI governance bureaucracy. They require consistently applying the same security and privacy fundamentals organizations already use to AI systems, AI users and AI-generated data.

Trustworthy AI starts with practical governance. The operating principle is straightforward: Govern AI at the points where data enters, moves, and is stored. Generative AI changes how information flows across the enterprise, but it does not change what leaders must manage: visibility, access, accountability, and control.

Start by mapping your AI data flows today. Organizations that reap the greatest benefits from AI will be those that understand where their data goes, define acceptable use and embed governance into everyday AI workflows rather than after-the-fact reviews. The next step is to start with the data flows you can see today, close the obvious gaps, and expand controls as AI adoption grows.

July 2026 Patch Tuesday

Tue, 14 Jul 2026 21:28:13 Z

Patch Tuesday Watch: What Led Up to July 2026

Adobe

Release date: June 30, 2026 (APSB26-68 — ColdFusion; same-day bulletin for Campaign Classic)

CVE count: 11 CVEs in ColdFusion, 1 in Campaign Classic (12 total)

Adobe's ColdFusion update resolved 11 vulnerabilities across ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier), including seven rated CVSS 10.0:

Fixed in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21.

KEV callout: CVE-2026-48282 was not flagged as exploited at release, but exploitation began within roughly two hours of a public technical writeup on July 2. CISA added it to KEV on July 7, with a federal remediation deadline of July 10 — already passed. Any internet-facing ColdFusion instance still unpatched should be treated as an active incident, not a routine patch item.

Campaign Classic's CVE-2026-48286 (CVSS 10.0, incorrect authorization → arbitrary code execution) affects on-premise ACC v7 builds 7.4.3 and earlier. Adobe-hosted instances were already patched; no exploitation has been reported for this one.

Apple

Release date: July 1, 2026 (iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2)

CVE count: 37 CVEs (26 in WebKit; 11 across kernel, WebRTC, Web Extensions, and other components)

Google Chrome

Release dates: June 24, 2026 (Chrome 149.0.7827.197) and July 8, 2026 (Chrome 150.0.7871.114/.115) CVE count: 10 CVEs (June 24) + 27 CVEs (July 8) = 37 CVEs across the two releases

The June 24 update resolved 10 vulnerabilities, the most severe being CVE-2026-13028 (CVSS 9.6, Critical) — a WebGL use-after-free enabling RCE, particularly on Android.

The July 8 update (Chrome 150) resolved 27 additional vulnerabilities: two Critical (CVE-2026-15112, CVE-2026-15129 — both use-after-free), 24 High-severity (largely use-after-free across Views, Extensions, Autofill, WebRTC, Codecs), and one Medium.

KEV callout: The prior Chrome zero-day, CVE-2026-11645 (V8 out-of-bounds read/write, exploited in the wild), was added to CISA's KEV catalog under BOD 26-04 with a June 23 deadline — already passed heading into this cycle. No new Chrome CVEs from the June 24 or July 8 releases have been confirmed as exploited so far.

Mozilla

Release dates: Most recent desktop security release was Firefox 152.0.4 (June 30, 2026, per MFSA 2026-62); subsequent MFSAs (2026-64 through 2026-66) cover Thunderbird 140.12.1 and Firefox for iOS 152.3/152.4 — minor and mobile-only updates

CVE count: No new desktop Firefox/Thunderbird CVE bulletin in the immediate week leading into Patch Tuesday

Patch Tuesday Summary

Microsoft's July 2026 Patch Tuesday resolves a massive 570 CVEs this month, the majority (509) of which are rated Important and 58 rated Critical, with three Moderate. From an impact perspective 249 Elevation of Privilege and 143 Remote Code Execution account for the bulk of the impact types, followed by 102 Information Disclosure. Two CVEs are confirmed exploited in the wild — a SharePoint elevation of privilege flaw (CVE-2026-56164) and an Active Directory Federation Services elevation of privilege flaw (CVE-2026-56155) — and one CVE, affecting Windows BitLocker (CVE-2026-50661), is publicly disclosed.

Adobe released 11 updates resolving 88 CVEs including 63 Critical, 22 Important, and three Moderate. Impact breakdown includes 51 Arbitrary Code Execution, 13 Security Feature Bypass, 12 Privilege Escalation, 7 Application Denial-of-Service, three Arbitrary File System Read, and two Memory Exposure vulnerabilities. Besides the pre-patch Tuesday ColdFusion release including a known exploit, the 11 Patch Tuesday updates did not include any known exploits or public disclosures.

Mozilla released Firefox 152.0.6 resolving two Critical CVEs. Both vulnerabilities (CVE-2026-15718 and CVE-2026-15719) have publicly disclosed exploit code available, however Mozilla is currently not aware of any active exploitation.

Google Chrome Desktop 150.0.7871.124/.125 has released for Windows and Mac. No CVEs were reported upon release, but given the massive number of vulnerabilities resolved in the past month and a half it would be best to ensure all Chrome installs are up to the latest release.

Microsoft’s exploited vulnerabilities

Microsoft resolved an Elevation of Privilege vulnerability in Microsoft SharePoint Server (CVE-2026-56164). The vulnerability is rated Moderate by Microsoft and has a CVSS score of 5.3, but has been actively exploited in the wild. An unauthorized attacker could elevate privileges over a network. The CVE attack vector is Network because it is remotely exploitable from the internet. Attack complexity is also classified as low. Microsoft has provided some mitigating factors that could help detect a possible attack, but a risk-based prioritization methodology warrants resolving this vulnerability as soon as possible.

Microsoft has resolved an Elevation of Privilege vulnerability in Active Directory Federation Services (CVE-2026-56155). The vulnerability is rated Important and has a CVSS score of 7.8, but has been actively exploited in the wild. The vulnerability could allow an attacker to elevate privileges locally to gain administrator privileges. Microsoft rates the vulnerability as Important, but a risk-based prioritization methodology warrants resolving this vulnerability as soon as possible.

Microsoft’s publicly disclosed vulnerabilities

Microsoft has resolved a Security Feature Bypass vulnerability in Windows Bitlocker (CVE-2026-50661). The vulnerability is rated Important by Microsoft and has a CVSS score of 6.1, but has been publicly disclosed. A successful attack could bypass the BitLocker Device Encryption feature on the system storage device allowing access to encrypted data. While the code maturity for this vulnerability is currently listed as unproven, the disclosure means information is available to point a threat actor down a path to exploitation. A risk-based prioritization approach warrants resolving this vulnerability as a priority this month.

Ivanti security advisories

Ivanti has released a security update for Ivanti Xtraction resolving two CVEs (one High and one Medium). More details and information about mitigations can be found in the July Security Advisory.

July update to-do list

Consider shifting to a more continuous remediation approach if you have not already done so. The continued increase in both CVE discovery and update frequency due to AI accelerated vulnerability discovery is going to continue to increase and regulatory pressure to resolve highest-risk exposures in a matter of days to hours will become the new normal.
Update your browsers! All of them. They are on a weekly basis at this point, but consider checking for and updating twice a week, if not daily, to reduce the exploit window for know exploited vulnerabilities.
Resolve or mitigate known exploited vulnerabilities in Microsoft SharePoint (CVE-2026-56164), the Windows OS (CVE-2026-56155), and Adobe ColdFusion (CVE-2026-48282) as soon as possible.

July 2026 Security Update

Tue, 14 Jul 2026 14:15:30 Z

Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and Ivanti uses leading technologies to proactively find and fix issues ––including integrating advanced LLMs into our Engineering and product security to enhance the capabilities of our teams.

Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Xtraction.

It is important for customers to know:

We have no evidence of these vulnerabilities being exploited in the wild.
These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

Xtraction

How AI will affect vulnerability disclosures in our products

Ivanti continues to explore, test, and implement leading technologies and processes in every stage of our product development. In recent months, our security team began a project to integrate multiple advanced LLM models into our product security processes.

This project has increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities, especially those that are difficult to identify with traditional tooling, such as SAST and DAST. We have already successfully identified vulnerabilities which traditional tools missed.

As these tools are integrated further into our processes and refined, we expect an increase in vulnerability disclosures. We will continue to share transparently what we have found and resolved to ensure the security of our products. If you are not already following our Security Blog or subscribed to receive alerts for updates on the products you own through the Ivanti Innovators Hub, we highly recommend you do so.

Importantly, we are committed to using AI responsibly in product security, including keeping a human in the loop to verify automated or agentic work. While this will result in an uptick in disclosures, we see this as a good thing, and an important part of ensuring our products keep pace with modern security requirements as they change.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Apple WWDC 2026 Announcements: How Ivanti Supports OS 27

Mon, 13 Jul 2026 14:25:14 Z

Apple Declarative Device Management (DDM) is now the standard for device management across Apple platforms. As part of this transition, Apple is retiring legacy software update controls in iOS 27, iPadOS 27, macOS Golden Gate, watchOS 27, visionOS 27, tvOS 27 and later releases. This is just one of several platform changes arriving this fall that could impact how your team manages and secures Apple devices.

The good news? Ivanti has supported Declarative Device Management for more than a year, giving customers a headstart on Apple's transition and the modern management capabilities that come with it. Here's what you need to know, what's changing and the steps you should take to prepare.

Apple Intelligence and Apple Foundation Models: WWDC 2026 AI announcements

WWDC 2026, Apple’s 37th Worldwide Developer’s Conference, introduced a rebuilt AI foundation developed in collaboration with Google’s Gemini technology. Apple now ships four models: Two run entirely on-device, including a new multi-modal model for text and images, and two run through Private Cloud Compute for more demanding tasks, with cryptographic guarantees that no data is stored or logged. That means AI that works offline, costs nothing per use and creates no data residency obligations. Apple has also opened a unified API to third-party models like Claude and Gemini, giving your development teams a single integration path rather than separate integrations for each provider.

Ivanti Neurons for MDM gives administrators the controls to allow or restrict them by device group, so the right capabilities reach the right people, without applying blanket policies across your entire organization.

Declarative device management in Apple OS 27

Legacy device management sent commands and hoped they stuck. Declarative device management (DDM) works differently: you express the desired state, and the device takes ownership of reaching and maintaining it, self-correcting without being asked.

This extends DDM to cover VPN, DNS, network relay, content filtering, certificates, app management and more, making it the primary management path rather than an optional layer.

IT teams still on legacy configuration profiles will start to feel the gaps when OS 27 lands. Ivanti Neurons for MDM has been implementing DDM ahead of each Apple release.

We’re ready, and we can help you understand what migrates automatically and what needs attention before OS 27 releases this fall.

Apple OS 27 software update changes for enterprise IT

Apple OS 27 removes legacy software update management entirely, with no grace period. If your device groups don’t yet have a Software Update Enforcement configuration and a Software Update Settings configuration in Ivanti Neurons for MDM, create them now. Both are built on the declarative model and take minutes to set up. Once in place, your update enforcement carries forward into OS 27 and every release after it.

If you’re not sure where you stand, reach out to your Ivanti account team, and we’ll help you confirm your posture before fall.

Apple OS 27 security updates: hardware integrity and compliance

macOS 27 gives IT teams something genuinely new: the ability to verify hardware component integrity before a device goes back into circulation. When a Mac or iPhone comes back from an employee, Ivanti Neurons for MDM can now confirm whether any internal components (camera, Face ID, Touch ID, NFC) have been swapped outside an authorized service channel. For IT teams managing shared device programs or strict compliance requirements, this adds a verifiable checkpoint to the device lifecycle that previously required a manual inspection or an Apple Store visit.

App management updates in iOS 27 and macOS 27

OS 27 changes how apps are deployed, controlled and licensed in ways your IT team will notice immediately.

The most visible change is how permission prompts work. Today, employees are hit with a series of blind permission requests when they first open a managed app — camera, microphone, location — with no explanation of why the business needs them. Many deny instinctively, the app breaks, and IT gets a call.

In iOS 27 and iPadOS 27, IT can pre-declare the permissions a managed app requires as part of the MDM deployment. The employee sees one clear, prompt that provides the business context. One tap. Done.

macOS 27 also introduces native binary and application control at the OS level. IT declares which applications and executables are allowed to run on a managed Mac. When a denied binary is encountered, the OS terminates it immediately, with no prompt or warning to the user. What previously required a dedicated endpoint security product is now built into macOS and managed through Ivanti Neurons for MDM.

Apple is also introducing volume purchasing for App Store subscriptions this fall, a change that IT teams managing licenses through Apple Business Manager have been waiting for. Subscriptions have never been part of volume purchasing until now. Your team can purchase auto-renewable subscriptions in bulk and assign them to employees through MDM, the same way app licenses work today. Subscriptions follow the user across devices and renew under your organization’s account. Your employees won’t need personal payment methods or individual App Store credentials.

Faster support with enhanced diagnostic logging

Across iPhone, iPad, Mac and Apple TV, Ivanti Neurons for MDM can now trigger diagnostic log collection remotely from the console, routing logs directly to Apple’s support infrastructure without any involvement from the device user. For customers with an AppleCare Enterprise agreement, this creates a direct, fast-moving support channel between your fleet, Ivanti and Apple. Issues that previously took days to diagnose can now be resolved the same day.

macOS 27: the Most Management-Rich Release Yet

Content caching now reports health status directly to the MDM console, so you don’t discover a failed caching service when a fleet update slows to a crawl. Managed Migration Assistant preserves enrollment and device configuration when employees move to a new Mac. A unified declarative configuration replaces the overlapping stack of legacy profiles that’s accumulated over years of Apple releases — covering app management and privacy permissions in one place, with binary control included. Ivanti handles this consolidation for you.

What WWDC 2026 means for your Apple device management

OS 27 is the most management-significant Apple release in years. The shift to declarative management is complete; hardware integrity verification is real and on-device AI is now something IT either governs or doesn’t. The gap between teams that are prepared and teams that aren’t will show up quickly after the OS ships.

If you're evaluating your Apple device management strategy ahead of OS 27, reach out to your Ivanti representative. We’ll help you understand how Ivanti Neurons for MDM positions your organization for this release and the ones that follow. We can walk through your current configuration, identify what carries forward automatically and flag anything that needs attention before the fall. The earlier that conversation happens, the less you’ll have to scramble when the update lands.

From IT Asset Discovery to Automated Action: Closing the IT Operations Loop

Wed, 08 Jul 2026 14:00:02 Z

Organizations today invest heavily in discovery tools, expecting that increased visibility will solve their IT challenges. Yet when an incident hits, a patch fails or an audit looms, many teams must pause to reconcile spreadsheets, validate inventories and confirm ownership before they can act. Visibility alone doesn’t close the gap between insight and execution.

The real value of discovery appears when visibility is governed and connected directly to the systems that run your business — enabling action without delay. Modern organizations can't rely on static inventories or scheduled scans. They need discovery that works continuously, fuels automation and validates outcomes. This is how organizations move from simply knowing their environment to acting on insights with confidence.

Why teams can’t afford gaps in IT asset visibility

Hybrid IT complexity continues to rise. Ivanti’s 2025 State of Cybersecurity Report found that 55% of organizations struggle with siloed IT and security data, limiting their ability to gain complete visibility across their attack surface and cloud environments. These findings confirm the burden IT teams already feel. In 2025, nearly 60% of IT professionals reported they have too much manual work tied to SaaS and asset management, underscoring the need for automation-ready, always-current data. For many organizations, these IT visibility gaps translate into real business friction. IT teams spend hours reconciling asset records across spreadsheets and tools before they can even respond to an issue.

Traditional discovery methods often become operational bottlenecks rather than strategic enablers. Periodic scans generate large data bursts that strain networks and backend systems, forcing teams to limit scan frequency or scope. Between scans, asset data quickly becomes outdated, leading to delayed patching, missed compliance deadlines, incomplete lifecycle tracking, and growing software sprawl. As teams compensate with manual checks and approvals, discovery workflows begin to compete with other IT initiatives for time, bandwidth and attention — slowing progress across the organization.

Security teams struggle to prioritize exposures when asset ownership, usage or lifecycle state is unclear. Operations slow as approvals, audits and remediation efforts stall waiting for confirmation that data is up to date. Over time, this manual overhead increases operational risk, stretches already limited resources and diverts attention away from strategic initiatives. Continuous discovery helps close this gap, but only when it feeds platform-governed operational data into the systems teams rely on. That connection is what enables immediate, automated action.

What is continuous discovery?

Continuous discovery is an IT practice in which an organization's assets — including devices, software, cloud workloads and identities — are automatically and persistently monitored for changes rather than captured through periodic or manual scans. This always-on approach enables IT teams to maintain a real-time, continuously updated view of what exists across their environment, how resources are configured and how they change over time.

Within the Ivanti Neurons Platform, asset and configuration data is governed as a shared system of record for IT and security operations. Unlike traditional discovery, which relies on periodic scans or scheduled updates, continuous discovery is an always-on approach within the Ivanti Neurons Platform for understanding your environment. It continuously observes changes across devices, cloud workloads, SaaS applications and identities as they appear, evolve or disappear. Instead of capturing occasional snapshots, it maintains an up-to-date operational view of what exists, how it is configured and how it connects to the rest of the environment, without waiting for the next scan cycle.

Turning continuous discovery into IT automation

Continuous discovery becomes operational when three things happen:

1. Discovery data flows into the Ivanti Neurons Platform. Asset and configuration state are governed as operational data and acted on by IT, security and compliance teams. Before actions are triggered, discovery signals are cleaned, normalized, and reconciled by the platform — ensuring automation and AI operate on consistent, trusted data rather than raw, conflicting inputs.

2. Actions trigger automatically based on live intelligence. When a new unmanaged device appears on the network, or a software package drifts from its compliance baseline, the platform immediately routes that signal to the right workflow.

3. Outcomes are verified, so teams confirm resolution rather than rediscover the same issue days later. Post-action confirmation uses live operational evidence to validate that changes took effect, so teams don't close tickets only to reopen the same issue days later.

When these elements work together, organizations stop chasing problems. They prevent them. This shift shows up in practical, operational ways:

Preventing exposure drift: teams automatically identify when new cloud resources or SaaS applications appear without assigned ownership or an established baseline configuration. Instead of discovering these issues during audits or incidents, IT and security teams address them early while risk is still low.
Avoiding recurring incidents: organizations reduce repeat outages and failed remediations by verifying post‑change asset state. When discovery confirms that a patch, configuration change or device update took effect, teams avoid reopening the same issue days later.
Reducing reactive firefighting: IT operations teams no longer spend hours reconciling asset data during incidents. With continuously updated asset context flowing into operational systems, response decisions happen faster and with fewer manual checks.
Catching inefficiencies before they become cost problems: usage signals tied to accurate asset records expose unused software, forgotten endpoints or aging hardware earlier in the lifecycle, allowing teams to act before waste accumulates and optimize IT spending.

Across industries, organizations that combine platform-governed operational data with automation and validation report fewer surprises, faster resolution and a measurable reduction in manual effort because issues are surfaced and addressed before they escalate into major disruptions.

Putting visibility to work with Autonomous Endpoint Management

Many organizations start with Autonomous Endpoint Management (AEM) because it turns visibility into immediate action. When endpoints operate on platform-governed asset and configuration data, teams can automate remediation, keep inventory aligned in real time and give security the context it needs to assess exposure.

When IT Service Management is part of your operations, this same operational data extends into ITSM and CMDB workflows and supports ITAM with accurate usage and entitlement insight. The result is faster execution with less guesswork — made sustainable at scale as discovery signals flow continuously through the platform and into automation.

Improving continuous discovery with delta-based asset updates

Many traditional discovery tools create network strain because they repeatedly transmit full asset datasets during each scan, forcing teams to sort through large volumes of unchanged information. The Ivanti Neurons Platform takes a more efficient approach through its discovery engine by transmitting only the delta — the specific changes since the last update.

These deltas surface the updates teams actually care about, such as new devices or cloud workloads appearing, software being installed or removed, ownership or configuration changes or usage signals that indicate unused assets. By highlighting only what has changed, teams avoid analyzing full payloads and can focus immediately on what needs attention, while keeping bandwidth usage and processing overhead low.

Continuous visibility becomes easier to maintain because bandwidth consumption stays low across all network types, including remote offices. This makes continuous discovery practical at scale and prevents performance degradation during peak activity periods. Delta-based updates also accelerate time to value by reducing processing overhead, allowing changes to appear in downstream systems almost immediately. This keeps operational asset inventories current and aligned without the delays caused by full data refreshes.

By transmitting only what has changed, organizations maintain near real-time accuracy without burdening endpoints, network infrastructure or backend processing. This approach supports consistent operations, improves reliability and ensures that continuous discovery enhances performance rather than constraining it.

Automating IT operations with real-time asset intelligence

When asset data is continuously updated and trusted at the platform level, teams stop waiting for audits, reports or manual reviews and start acting on changes as they occur. For IT Asset Management (ITAM) and compliance teams, this means fewer manual checks, more accurate records and actions driven by current asset state rather than outdated snapshots. For IT operations, it means less rework and faster response without added process overhead.

Platform-governed asset and configuration intelligence enables workflows such as:

Patching triggered by current asset context, reducing delays caused by outdated or incomplete inventories.
Automatic isolation of non‑compliant devices, helping teams address drift before it turns into compliance audit findings or risk exposure.
Real‑time updates to ownership, location, and lifecycle data, giving ITAM teams a reliable foundation for cost and lifecycle decisions.
Early identification of unused software, allowing license reclamation before renewal cycles lock in waste.
ITSM tickets that open and close with verified evidence, preventing repeated follow‑ups and recurring issues.

This is how teams move from reactive cleanup to predictable, continuous control.

Verifying IT automation outcomes with continuous discovery

Most operational delays happen after an action is taken, when teams need to confirm whether it actually worked. Continuous discovery supports closed-loop operations by validating changes in asset and configuration state, using live operational evidence rather than manual follow-ups.

Since this evidence is normalized and current, automation and AI can accurately distinguish real change from noise and improve recommendations over time. The result is a reliable feedback loop that reduces rework, strengthens operational control and allows IT and security teams to move forward with confidence.

What closed-loop IT operations and automation deliver

Organizations that combine continuous discovery with automated action and validation reduce risk, avoid waste and improve efficiency.

Security responds faster because exposures are tied to real assets and owners.
IT operations shorten MTTR through accurate records and fewer manual steps.
ITAM prevents overspending by validating entitlement and usage data.
Compliance becomes easier because auditors receive complete and current evidence instead of ad-hoc reports.

The value of accurate, always-current operational data extends beyond automation. As this foundation matures, many organizations begin exploring more intuitive ways to interact with it — querying their IT environment in natural language instead of relying solely on predefined reports. These outcomes are realized when discovery becomes part of the operational fabric rather than a background task.

Start turning IT asset visibility into automated action

The organizations that move fastest and take on the least risk are those that treat visibility as an operational capability instead of a reporting function. When discovery is continuous, platform-governed and connected to automated action, IT and security teams stop reacting and start preventing.

Continuous, platform-governed discovery is what separates organizations that know they have a problem from those that never let it start. Schedule a demo to explore the Ivanti Neurons Platform and see continuous discovery in action.

How Agentic AI Enables Autonomous Threat Response at Machine Speed

Mon, 29 Jun 2026 14:00:02 Z

Why do 40% of alerts received by security teams today go completely uninvestigated? It’s not due to a lack of concern but instead caused by shortening attack windows and compounded by overwhelming tech sprawl.

Today’s security teams are operating in a threat landscape defined by escalating attacks, tighter budgets and mounting alert fatigue. Organizations process an average of 960 security alerts per day, and large enterprises handle more than 3,000 daily alerts across roughly 30 tools. That adds up to 36,000 potential threats a month that could slip through the cracks. The asymmetry is crushing when attackers need only one successful breach, while defenders must be right every time.

This critical gap for organizations is an architecture problem. The greatest challenge in threat response isn't what gets detected — it’s what happens next after that alert sounds.

The good news? Agentic AI changes that architecture. Not by replacing existing tools, but by closing the operational gap between detection and action.

The security speed problem

The tools you've deployed (SIEM, EDR, vulnerability scanners, SOAR platforms) are exceptional at detection. They surface the threats, catalog the risks and send the alerts. But detection without an effective response is just expensive documentation. The real bottleneck becomes fixing issues fast enough to matter, not simply knowing what’s wrong.

Learn More: Why Traditional Vulnerability Management is Breaking Under AI‑Driven Discovery

Traditional security operations follow a familiar sequence: an alert fires, an analyst investigates, a decision is made, remediation is scheduled, change is approved … and only then is action taken. Each step makes sense in isolation, but together they lock teams into human speed while threats move autonomously. By the time the investigation is complete, the adversary has already moved laterally. And by the time a patch is deployed, three more critical CVEs have been disclosed.

The timeline gap is stark. According to the 2025 Verizon Data Breach Investigations Report, organizations take a median of 32 days to remediate edge device vulnerabilities, while threat actors exploit those same vulnerabilities at or before public disclosure — effectively operating on a zero-day timeline. That gap is accelerating: Mandiant’s M-Trends 2026 Report reveals that the time between initial access and handoff to a secondary threat group has collapsed from more than eight hours in 2022 to just 22 seconds in 2025.

An effective security model requires detection to trigger immediate, intelligent action. Existing capabilities such as vulnerability assessment , endpoint management , patch deployment and access controls remain in place, but operate faster and with greater autonomy. The result is security operations that function at machine speed rather than human speed.

What agentic security actually looks like

In security, agentic AI refers to autonomous systems that execute end‑to‑end security workflows. They move from detection to decision to action without pausing for manual approval at every step.

Agentic AI should be operating across the attack surface, coordinating detection, decision and response as a single system.

Autonomous vulnerability remediation

When a critical CVE is disclosed, agents immediately assess exposure across the environment. They prioritize risk based on exploitability and business context, deploy patches to affected endpoints and verify remediation. All of this happens before an analyst opens a ticket. Human oversight remains in place, but the delay created by manual handoffs is removed.

Learn More: Risk‑Based Patch Prioritization Report

Intelligent threat response

When an endpoint exhibits suspicious behavior, agents correlate signals across EDR, network telemetry and asset inventory. Affected devices are isolated; active sessions are revoked; forensic evidence is captured and the SOC is alerted with full context. The threat is contained before it spreads, allowing analysts to investigate a neutralized incident rather than an active breach.

Continuous compliance posture

Agents continuously monitor endpoints and servers for configuration drift. When a device falls out of compliance, such as a disabled firewall, encryption turned off, or unauthorized software installed, remediation occurs automatically. The configuration is corrected; the event is logged and compliance is verified. Compliance becomes an ongoing state rather than a quarterly exercise.

Access risk mitigation

Agents detect anomalous access patterns, including unexpected geolocations, privilege escalation attempts and unusual data access. Suspicious sessions are terminated; multifactor authentication is enforced and access is reduced until verification is complete. Legitimate users continue working while lateral movement is stopped in real time.

These agents work across the existing security stack, including SIEM, EDR, vulnerability management , identity systems and patch management. Each tool becomes faster and more effective as part of a coordinated system. The aim isn't to replace security operations, but to allow them to operate at the speed adversaries already do.

Learn More: How Agentic AI is Transforming Infrastructure and Operations

From detection to action: the architecture of speed

The core shift enabled by agentic AI is decision‑making at the point of detection. Rather than separating sensing from action, security workflows are designed to assess risk and respond immediately as threats emerge.

When a critical vulnerability is identified, the agent doesn't surface a ticket for later review. It evaluates the same factors a security architect would consider:

Is the system internet facing?
What data does it access?
Is there a known exploit in the wild?
What's the business impact of patching versus delaying?

That decision is made in milliseconds rather than days. And delivering this outcome requires more than automation scripts but systems that can reason about context and consequences.

Business‑aware risk scoring

Not every critical vulnerability carries the same urgency. Agents evaluate exploitability, exposure and business impact together. A vulnerability on an internal test server is handled differently than the same issue on a customer‑facing production system. Prioritization happens automatically, and the rationale is clear and defensible.

Adaptive response thresholds

Agents learn from outcomes over time. When certain actions consistently produce false positives, thresholds adjust. When new attack patterns emerge, sensitivity increases. The system improves through use, rather than becoming more brittle as conditions change.

Context-preserving escalation

When an agent reaches the boundary of its autonomy, escalation includes reasoning, not just an alert. What was detected, what signals were evaluated, why the decision couldn't be completed autonomously and what action was recommended are all passed to the analyst. Human intervention focuses on decisions that matter, not triage.

Built-in auditability

Every action is recorded with full context, including the trigger, the data evaluated, the decision made and the outcome. Compliance is embedded directly into the workflow instead of reconstructed after the fact.

The impact on security teams is measurable. The 2025 SANS Detection & Response Survey revealed that 73% of organizations cite false positives as their top detection challenge, and 76% percent point to alert fatigue as a primary SOC concern. This isn't just an efficiency issue. When analysts spend most of their time sorting through noise, security programs remain reactive by design.

The result is a different operating reality. Detection leads to resolution. Alerts are addressed as they appear instead of accumulating in queues. Security teams spend less time responding to yesterday’s incidents and more time preventing the next one.

What changes in practice

When agentic AI is deployed in production security environments, the impact shows up less as isolated wins and more as structural change. Teams see consistent shifts in how workflows are structured, how quickly risk is reduced and where human effort is applied.

1. Time-to-action compresses dramatically

Detection and response collapse into a single motion. Vulnerabilities that once waited days for triage and scheduling are assessed, prioritized and remediated automatically when risk thresholds are met. Threats that previously moved laterally during investigation are contained at the point of detection. The measurable outcome is shorter dwell time and faster risk reduction, not just faster alerts.

2. Operational overhead declines

Routine security work that previously consumed analyst time, such as compliance drift remediation, patch coordination and access corrections, moves into continuous background execution. Reporting becomes a byproduct of normal operations rather than a periodic scramble. Security teams spend less time managing processes and more time applying judgment.

3. Response quality becomes more consistent

When decisions are made using the same contextual inputs every time, response behavior stabilizes. Similar risks are handled in similar ways, regardless of when they occur or who's on call. This consistency reduces variability, limits human error and makes outcomes easier to explain to auditors, executives and regulators.

4. Human attention shifts to higher-value work

Analysts are no longer pulled into every alert or minor configuration issue. They engage when escalation is warranted and when decisions materially affect business risk. The result is less alert fatigue, fewer false positives and more time spent on threat hunting, incident analysis and strategic improvement.

The business impact of this shift is reflected in industry data. According to IBM’s 2025 Cost of a Data Breach Report, organizations that use AI and automation extensively saved an average of $1.9 million per breach and reduced the breach lifecycle by eighty days. With the global average breach lifecycle at 241 days in 2025, the lowest in nine years, even incremental improvements in speed translate into meaningful risk and cost reduction.

The pattern is consistent. Security teams stop reacting to backlogs and begin operating at the pace of the threat itself.

Why moving slowly is the bigger risk

Caution around AI in security is understandable. Security systems touch critical infrastructure. Mistakes are highly visible, and the consequences of failure are real. Waiting for clearer use cases, stronger governance and proven controls can feel like the responsible choice.

The challenge is that the underlying risk environment has changed. Attackers already operate at machine speed, while most security programs still respond at human speed. Every week spent delaying meaningful autonomy widens that gap. Exposure accumulates quietly, not because detection fails, but because action can't keep pace.

Most organizations already have the necessary signals. SIEM, EDR, vulnerability management and patching systems generate high-quality detection and context. The constraint is execution. Alerts queue. Tickets wait. Decisions stall. Agentic AI addresses that constraint by collapsing the distance between detection and response. The longer that distance remains, the further security posture drifts from the reality of modern threats.

In practice, resistance to agentic security is organizational more often than technical. Ownership of AI‑driven outcomes may be unclear. Incentives may reward process adherence over risk reduction. Teams may view automation as a threat to relevance rather than an extension of capability.

Operationally, the opposite tends to be true. As autonomy increases, analyst work becomes more focused and more valuable. Threat hunting, incident analysis, adversary research and architectural improvement efforts expand. Manual triage, patch coordination and repetitive investigation recede. Human expertise is applied where judgment matters most.

Organizations that delay adopting agentic security aren't standing still. They're choosing to operate with a response model that can't match the pace of modern attacks. Over time, that mismatch becomes the dominant source of risk.

The shift is underway

Security operations are moving away from reactive models where detection creates backlogs; alerts generate work and response timelines stretch into days. Leading programs are reorganizing around proactive execution, where systems sense conditions, evaluate risk and act continuously. Autonomous agents absorb volume and variability. Human teams focus on strategy, investigation and improvement.

This shift reflects a change in how modern security must operate. Adversaries already automate reconnaissance, exploit development and lateral movement. Attacks progress without waiting for tickets to be triaged or approvals to be scheduled. Security programs that remain bound to human‑speed workflows struggle to close that gap.

What separates more effective organizations is the readiness to operate differently. They design for execution as well as detection. They govern autonomy deliberately. They measure outcomes instead of activity. Over time, this operating model compounds its advantage because response improves as systems learn and teams refocus.

The question facing security leaders is no longer whether autonomy belongs in security operations. It is whether their organization is prepared to run security at the pace the environment now requires.

Ready to close the security speed gap?

See how Ivanti Neurons for ITSM enables autonomous security workflows that move from detection to resolution with speed and control.

The Invisible IT Department: How to Deliver Friction-Free Experiences with Agentic AI

Thu, 18 Jun 2026 19:42:35 Z

Every enterprise has bought AI, but many are still waiting for their investment to pay off. Ivanti’s 2026 AI Maturity Report found that only 2% of organizations say they currently have no AI use at all. As the majority of organizations move beyond the AI experimentation stage, the real competitive differentiator is if that AI is providing continuous, business value at scale.

Companies deploy chatbots that users ignore. They implement agents nobody trusts and roll out "AI-powered" tools that employees end up working around or disregarding personal, shadow AI tools. The problem isn’t what AI can do. It’s what you’re asking users to do with it. Most organizations approach AI as a feature to deploy rather than an experience to design. They focus on what AI is capable of instead of what users actually need. The result is another shelfware solution that generates more frustration than value.

Digital experience is the missing link that separates successful AI deployments from failed ones. Organizations that prioritize the AI user experience can identify the implementation pitfalls that kill user trust and develop a practical framework for deploying agentic AI that delivers improvements without interruptions. AI and IT work at their best when they serve as invisible superpowers. Users don't notice the technology; they notice how effortlessly they accomplish their work.

The AI adoption paradox

MIT research suggests that roughly 95% of enterprise AI initiatives fail to deliver measurable ROI with most stalling in pilot mode rather than scaling into real business value.

How it happens: Leadership greenlights an AI initiative, IT deploys the technology, training sessions are scheduled, adoption metrics are tracked, and within six months...nobody is using it. The chatbot goes dark, the AI assistant sits idle, and your employees develop workarounds to avoid the very tools that were supposed to make their lives easier.

This isn't a failure of change management, but the result of failing to understand what users actually experience when you layer AI on top of all their other workplace technology.

Users don't want AI for AI's sake. They want their laptop to boot faster, applications that don't freeze mid-presentation, video calls that don't lag, and issues to resolve before they notice something wrong. When you force them to interact with an AI interface to get those things, you've already lost.

Read More: How Agentic AI for ITOps Unlocks Value at Scale

Why most AI implementations fail on user experience

Walk into any enterprise IT environment and you'll find the same pattern. The AI implementation checklist gets followed religiously:

Technology vendor selected
Platform deployed
Integrations configured
Users trained
Go-live achieved

But six months later, the reality sets in. A 2025 EY survey found that 64% of employees reported increased workloads despite AI deployments, while only 5% said they were maximizing AI to actually transform their work.

IT did everything right according to the playbook, but what went wrong is that the playbook was written by people selling AI, not people using it.

Consider the typical AI chatbot deployment meant to "empower self-service" and "reduce ticket volume." In practice, means employees who used to send a quick Slack message to IT now must:

Navigate to a separate portal
Figure out how to phrase their question in a way the bot understands
Parse through irrelevant knowledge articles the AI surfaces
Eventually give up and submit a ticket anyways, now irritated and fifteen minutes behind schedule

The ticket still gets created, and the problem still needs solving, but now there's friction where there wasn't before because you've added steps, not subtracted them.

This is the fundamental mistake: treating AI as an interface users engage with instead of infrastructure that works for them. The moment you ask users to change their behavior to accommodate your AI, you're building resistance, not adoption.

Digital experience: where AI proves its value

The organizations getting real value from AI have stopped asking, "How do we get users to adopt this AI tool?" and started asking, "How do we use AI to improve what users already do?" It's a subtle shift with massive implications.

In digital experience management, AI doesn't sit between the user and their work. It sits between the user and the chaos: i.e. the performance degradation, the application failures, the mysterious slowdowns, the issues that haven't surfaced yet but will in the next 30 minutes.

This is where agentic AI fundamentally changes what's possible. Traditional monitoring tools alert humans when something breaks. But agentic AI prevents the break before it happens. It's the difference between a smoke detector and a fire suppression system.

Traditional IT operations measure incident responses in hours or even days. Agentic AI with autonomous remediation is fundamentally changing this equation, shrinking mean time to resolution from hours to minutes or seconds by detecting patterns and executing fixes before problems escalate.

Here's what that looks like in practice:

Traditional IT Ops:

A user's laptop starts showing early signs of disk failure.
Traditional DX tools flag the issue and create a ticket.
An IT analyst would review the alert, assess severity, schedule maintenance, and eventually reach out to the user.
Total time to resolution: multiple days.
Impact on your organization: planned downtime, data migration, and productivity loss.

Agentic AI

With agentic AI, the pattern gets detected before the user notices anything wrong.
The agent autonomously triggers automated backup processes, provisions a replacement device, stages the user's applications and data, and schedules the swap during a low-activity period.
The user gets an email: "Your new laptop will be waiting at reception tomorrow morning. Your existing setup has been transferred."
No ticket created or escalation needed or interruption experienced.

It’s the same problem, but with a radically different experience.

Building a friction-free AI implementation framework

Achieving invisible AI requires rethinking how you deploy, measure, and scale digital experience initiatives. Organizations seeing real ROI from agentic AI follow a consistent pattern that prioritizes experience over features.

Start with pain, not possibility

The worst AI implementations begin with the question, "What can this AI do?" The best ones start with, "What's currently painful, repetitive, or needlessly slowing users down?

Map your digital experience pain points before you map AI capabilities:

Where do users wait the longest for issue resolution?
Which problems generate repeat tickets?
What performance degradations happen predictably but aren't caught proactively?
Where does IT spend the most time on tasks that don't require human judgment?

These are user experience problems that AI can eliminate, not just “AI use cases,” and the distinction matters. When you start with pain, you end up with solutions users want.

Deploy AI behind the experience

Users should never need to decide whether to engage with your AI because that's your job as the implementer. In practice, this looks like:

Autonomous agents that detect and resolve issues before help is needed vs. A bot that users need to ask for help.
Predictive insight engine that pushes solutions to users before they search vs. A self-service portal with AI-powered search.
Self-healing systems that execute recommendations automatically within approved guardrails vs. AI-powered recommendations users have to action.

The pattern is consistent, and it’s to reduce user decision points, eliminate extra steps, and remove the need for extensive AI literacy. Your agentic AI should require zero user training because users should never directly interact with it.

Measure user experience, not AI performance

Here’s where most implementations go sideways: they measure AI performance instead of user outcomes

If you're tracking the number of AI interactions, AI response time, model accuracy scores, or automation rate, you're measuring the wrong things.

Instead:

Track reduction in mean time to resolution for end-user issues. Ivanti’s 2026 AI Maturity Report found that 45% of IT workers say AI has made their work faster and better.
Track user-reported satisfaction with IT responsiveness.
Track the percentage of issues resolved before users notice.
Track time saved on repetitive requests.
Track reduction in ticket volume, not because you're deflecting issues but because you're preventing them.

The governance framework that enables AI autonomy

The thing that actually slows down most agentic AI deployments isn’t a technical problem — it’s getting stakeholders comfortable with AI acting without being asked permission first.

Autonomy Tier	Risk Level	Example Actions
Full Autonomy	Low	Cache clearing, service restarts, performance optimization, routine patching
Autonomy with Notification	Medium	User profile resets, application reinstalls, driver updates
Human Approval Required	High	Major configuration changes, data migrations, infrastructure modifications
Human-Led, AI-Assisted	Critical	Security incident response, compliance decisions, budget approvals

The key is recognizing that "high-risk" shrinks over time as AI agents prove reliability and as your monitoring detects patterns you didn't initially anticipate. Organizations that treat AI governance as static end up with AI that can't do enough to matter. The ones that treat governance as dynamic end up with AI that continuously expands its impact while maintaining safety.

What success looks like

Organizations implementing AI-powered service experiences are seeing meaningful satisfaction gains. PwC research found that leading implementations have achieved 10-15% NPS improvements alongside operational efficiencies.

The conversation around AI changes. Users stop talking about IT as something that gets in their way and start not talking about IT at all, which is precisely the point. IT becomes infrastructure: invisible, reliable and present only when intentionally needed.

Your service desk sees the shift first, like:

Ticket volume drops not because you're deflecting issues but because you're preventing them
Escalations decrease because AI catches and resolves problems at progressively earlier stages
Analyst time reallocates from reactive firefighting to proactive system improvement
Mean time to resolution compresses because remediation often happens faster than detection did under the old model

For end users, the experience is simpler: things work, applications are responsive, systems are available, and slowdowns don't cascade into failures. And the mysterious performance issues their colleagues complain about somehow don't happen to them, not because they're lucky, but because AI agents are continuously optimizing their experience in ways they never see.

This is the real adoption metric is when users stop thinking about IT. Not because they're ignoring it, but because there's nothing to think about.

The real choice: invisible AI or ignored AI

Every organization will deploy AI in digital experience management. The question isn't whether, but how, and more importantly, whether users will actually benefit or just have another tool foisted on them.

This requires fundamentally rethinking how you implement, measure, and scale AI initiatives. Get this right, and you transform how your organization perceives IT, to competitive advantage instead of cost center, to proactive enablement instead of reactive firefighting, to invisible infrastructure that just works instead of necessary overhead.

The best AI, like the best IT, is the kind you never see. Users don't experience your technology, but they experience the absence of problems. And that's precisely the point.

Ready to improve your digital experience with agentic AI?

Discover how Ivanti Neurons for ITSM deploys agentic AI that works behind the scenes, predicting issues, resolving problems autonomously, and optimizing experiences before users notice anything wrong.

Shadow IT and Discovery AI Blind Spots: What Legacy Tools Miss

Mon, 15 Jun 2026 13:32:02 Z

Ask three teams what assets exist in your environment, and you’ll get three different answers. Most organizations don’t lack tools. They lack agreement on what actually exists in their environment. Asset, endpoint and cloud data exist — but it’s fragmented, stale and trusted differently by teams across every department and function.

The reason for this disconnect? In the AI era, environments are changing faster than legacy discovery is built to handle. Cloud workloads spin up and disappear in minutes, often provisioned automatically for testing, scaling or short-term projects. But the gap is now widened even more by AI services, copilots, APIs and embedded models — as well as browser-based tools and automation workflows — that teams adopt without going through standard IT provisioning.

By the time traditional discovery tools scan the environment, these resources may already be gone or they may never appear in the systems IT relies on as a single source of truth — leaving no record, no owner and no shared operational context. Meanwhile, SaaS adoption continues to rise across every department, remote devices rarely touch the corporate network, and identities, integrations and data flows now matter just as much as devices. Yet many organizations still rely on discovery approaches built for a world of static endpoints and predictable perimeters.

The result is partial visibility at best and growing blind spots everywhere else.

In 2026, the visibility gap is now a chasm — and the data is clear. According to Ivanti’s autonomous endpoint management research, 45% of IT professionals report lacking sufficient data about shadow IT, and 38% say they have insufficient data about devices accessing the network. This problem is amplified in cloud environments.

According to 2025 research from SecPod revealed that 67% of organizations struggle with blind spots across their cloud asset inventories, reinforcing that even organizations with modern IT and security tools still operate with incomplete visibility.

These blind spots create more than gaps in inventory. When teams can't agree on which assets are real, active or decommissioned, IT and security work on conflicting timelines. Incident response slows. Exposure prioritization breaks down. Security teams chase alerts without context. IT leaders burn hours reconciling spreadsheets instead of reducing risk.

What makes this especially costly is not just missing data, but delayed action. When teams can’t trust what exists in their environment, every response slows down: incidents take longer to resolve, audits require manual reconciliation, and risk decisions are made with incomplete context. Visibility gaps don’t just increase exposure; they consume time, attention, and operational confidence across IT and security.

Across Ivanti’s experience working with large hybrid enterprises, a clear pattern has emerged. Visibility gaps rarely exist because teams fail to deploy discovery, but because those tools were never designed to share or reconcile data at the speed modern environments demand.

Legacy tools are not simply outdated. They're fundamentally incompatible with the speed and complexity of modern IT.

Where legacy tools fall behind

The limitations of legacy discovery tools fall into five categories, each compounding the others:

Fragmented visibility

According to Ivanti’s 2025 Securing the Borderless Digital Landscape Report, every 2 in 5 edge devices are currently outside of IT management and oversite. Today, nearly every organization has unauthorized cloud accounts, yet traditional discovery solutions don’t reflect this reality. Most point tools capture only one slice of the environment, but they rarely reconcile them into a shared operational view. For IT directors, this fragmentation means juggling multiple dashboards during outages and audits. For CIOs, it means wasted spend and delayed decisions. When no team trusts the data enough to act confidently, the entire organization slows down.

Dependence on agents

Agent-based discovery still plays an important role in modern IT, especially for collecting rich telemetry from managed endpoints. The problem arises when discovery becomes agent-based only. In hybrid environments, many assets cannot support an agent. Temporary cloud workloads may exist for minutes or hours. SaaS applications and managed services do not allow agent deployment at all. Contractor devices, personal endpoints and unmanaged systems often fall outside corporate control policies.

As a result, these assets never appear in inventories that rely exclusively on agent-based collection. The flaw isn't with agents themselves; it's with relying on a single collection method that can't account for the full scope of modern environments.

This structural limitation directly contributes to the visibility gaps organizations continue to face. According to 2025 research from Trend Micro, nearly 3 in 4 organizations have experienced security incidents caused by unknown or unmanaged assets. These figures demonstrate how agent-only discovery consistently leaves significant areas of the environment unmonitored.

Ivanti’s 2025 Digital Employee Experience Report found that 27% of office workers regularly use unauthorized tools and applications, often out of frustration with employer-provided technology. This behavior expands the attack surface faster than traditional discovery methods can respond.

Risk and exposure blind spots

When parts of the environment remain unseen, organizations lose the ability to maintain consistent security controls. Unmonitored devices, unrecognized cloud resources and unsanctioned SaaS services often bypass patching, configuration baselines and policy enforcement. These blind spots open pathways for attackers to exploit misconfigurations, unpatched workloads or forgotten assets.

Slow, point-in-time scanning

Periodic scans cannot keep up with cloud velocity or SaaS churn. SecPod found that only 42% of organizations have real-time monitoring, leaving large windows where misconfigurations go undetected. High‑profile incidents involving exposed cloud storage buckets, unsecured API endpoints and misconfigured access controls continue to show how short‑lived or poorly tracked resources can introduce risk long before teams are aware they exist.

Manual reconciliation

Data from spreadsheets, ITSM, CMDBs and disconnected tools rarely align. According to 2025 cybersecurity research by Bedrock Security, 82% of organizations report visibility gaps across their asset landscape, driven by fragmented data sources and inconsistent ownership. These blind spots make it difficult to normalize and reconcile cloud, SaaS and on-premises inventories, leaving security and IT teams unsure whether their asset data is complete or accurate.

These limitations slow operations, weaken security and create persistent blind spots across the entire estate — the exact issues that legacy discovery tools were never designed to solve.

A platform-governed visibility model for a modern world

Simply scanning more often or deploying another point solution won't close the visibility gap. Today's environment demands a fundamentally different approach.

Modern environments require a shift from periodic discovery to continuous, shared intelligence that multiple teams can trust. A platform-governed visibility model establishes a shared system of record for asset and configuration data across IT and security — one that continuously normalizes, reconciles and distributes trusted operational context.

Active and passive discovery work together to surface managed devices, unmanaged endpoints, cloud workloads, SaaS apps, remote assets and the identities connected to them. In practice, this requires a shared operational data foundation that can govern asset and configuration intelligence across systems, so teams are working from the same views rather than fragmented or conflicting records.

Core platform data and system of record

The Ivanti Neurons Platform serves as the authoritative operational data layer for IT and security, governing assets, endpoints and configuration state through a continuously updated system of record. This platform-governed operational data layer maintains a continuously updated view of asset and device inventory, support context and relationships, and software estate information.

A continuous discovery engine continuously ingests signals from across the environment and normalizes, deduplicates, and reconciles them into clean, consistent operational data. This governed data foundation is what automation and AI rely on to act safely and accurately, ensuring decisions are based on current operational reality rather than fragmented or conflicting inputs.

When execution systems consume this platform governed data, teams can act with confidence across IT and security. Where IT service management is in scope, this same operational data can extend into ITSM and CMDB workflows, while also supporting ITAM use cases such as lifecycle tracking and software entitlement management.

Normalize and reconcile continuously

A unified intelligence layer cleans, deduplicates, and correlates records and usage signals from every source, creating a shared, continuously updated asset dataset suitable for operational audit needs.

Map exposures to real assets

Exposure aggregation links vulnerabilities and misconfigurations to the exact devices, users and service owners affected — improving vulnerability prioritization and accelerating remediation.

Turn visibility into action

As environments continue to evolve faster than traditional tools can respond, organizations must rethink how visibility is achieved and shared. The path forward does not begin by replacing every tool, but by establishing a trusted visibility foundation that integrates with existing systems and enables better decisions everywhere else.

This live, platform-governed visibility foundation enables Autonomous Endpoint Management. Powered by the Ivanti Neurons Platform, it acts with confidence — triggering remediation, patching, configuration enforcement and self-healing based on verified operational state.

For organizations constrained by legacy discovery approaches, this means:

Shifting from periodic snapshots to continuous intelligence.
Moving from isolated tools to shared context.
Replacing manual reconciliation with automated trust.

Modern, platform‑governed discovery doesn’t just improve visibility. It creates conditions for action — where insight can reliably trigger remediation, automation and verification instead of stalling in dashboards.

Ready to eliminate blind spots for good? Explore how the Ivanti Neurons Platform establishes trusted asset and configuration visibility and enables autonomous endpoint management, exposure management and ITSM workflows to act on governed operational data across hybrid environments.

How Agentic AI is Transforming Infrastructure and Operations

Thu, 11 Jun 2026 13:35:04 Z

Infrastructure and Operations (I&O) teams have long operated under a familiar paradox: the faster the business scales, the more pressure I&O absorbs. Every new application deployment, every endpoint added, and every cloud workload spun up generates more complexity, more risk and more tickets.

The traditional responses to this pressure — more headcount, more tooling, more scripts, more APIs — have delivered incremental relief at best. Yet, the core structural problem, the underlying architecture of reactive operations, has remained stubbornly intact. Until now.

Agentic AI reinvents that architecture entirely.

AI in IT and Operations (I&O) has transcended the assist-and-suggest phase. Autonomous agents capable of reasoning, planning, executing and learning are now operational and not just future roadmap items. Organizations that are intentionally deploying agentic AI are already seeing significant benefits. Our 2026 AI Maturity research report found that 57% of IT organizations are using agentic AI for several important IT workflows, with 17% relying on it for extensive end-to-end processes. This deployment is leading to a compression of resolution times from hours to minutes and the deflection of thousands of manual tickets per quarter.

Moreover, 89% of organizations that have scaled AI to a broad or business-critical level reported that AI frequently helps their teams detect issues before end users are even aware, compared to 43% in the early experimentation stage. This shift is changing I&O from a reactive to a proactive and intelligent posture.

The question that remains is how quickly can your organization make the transition to implementing agentic AI in your I&O environment at scale?

Learn More: Transform IT with Agentic AI: the Dawn of Accelerated, Autonomous Service

Why we’ve reached the ceiling of traditional automation

To understand the significance of Agentic AI, it helps to appreciate what came before it and why it was never enough.

Traditional automation in I&O has been enormously valuable. Runbooks codified institutional knowledge. Scripts standardized repetitive processes. Robotic Process Automation (RPA) bots handle structured rules-based workflows. These tools reduced manual effort at the margins and allowed teams to do more with the same headcount. But they were always fundamentally brittle — dependent on explicit instructions, incapable of adapting to novel situations and unable to act without a human hand at the wheel.

Consider a classic scenario: a patch deployment fails on a subset of endpoints at 2 AM. A rule-based automation might log the failure and create a ticket. A more complex script might attempt a retry. But neither can diagnose whether the failure stems from a conflicting application, a corrupted agent, a network segmentation issue or a policy configuration drift. Neither can adapt its remediation strategy in real time. Neither can communicate context to the service desk, update the CMDB or escalate intelligently based on the criticality of the affected assets. A human engineer gets paged. The cycle continues.

This is the ceiling of traditional automation: it executes instructions, but it doesn't think. It automates tasks, but it can't orchestrate outcomes. And as infrastructure environments have grown exponentially more complex — spanning on-premises, multi-cloud, edge and hybrid architectures — the gap between what rule-based automation can handle and what I&O teams need has widened into a chasm.

Agentic AI is the answer to filling that gap.

What agentic AI means for I&O

Agentic AI systems can independently set goals, develop plans to achieve them, take multi-step actions across tools and systems, evaluate outcomes, and adjust their approach — all without requiring human intervention at each step. Unlike a chatbot that answers a question, or a script that executes a predefined workflow, an agentic system is goal-driven and adaptive. It operates across the full lifecycle of a task, from identification through resolution.

In the I&O context, this means an autonomous agent can do what previously required either a skilled engineer or a complex, fragile chain of automation scripts: correlate signals from disparate monitoring systems, identify the root cause of an incident, execute the appropriate remediation, verify that the fix worked, update the relevant records, and close the loop — all in the time it'd take a human to open a ticket.

The shift isn't just operational; it's philosophical. We move from a model where humans initiate action and automation executes it, to a model where intelligent agents start, execute, and verify action — and humans provide oversight and governance. For I&O leaders, this isn't a threat to the team. It's the greatest force multiplier your team has ever had.

Agentic AI powers I&O at scale

The service desk ticket queue is the most visible symptom of an I&O function under strain. Password resets, software installs, access provisioning, connectivity troubleshooting — these high-volume, low-complexity requests consume a huge share of analyst time and drive up operational costs. They're also deeply frustrating for employees who need resolution now, not after a 48-hour SLA window.

Learn More: Ticket Taker to Team Leader: Managing an Agentic IT Workforce

Eliminating the tyranny of the ticket queue

Agentic AI eliminates the queue as a bottleneck. Imagine having a conversational AI agent, like Ivanti Neurons AI Self Service Agent that not only retrieves an answer from a knowledge base — it validates identity, checks compliance policy, executes the provisioning workflow, confirms the change in the system of record, and notifies the requestor, all within minutes. The ticket never reaches a human analyst. The analyst's time is reclaimed for work that requires human judgment.

Now imagine giving an analyst more time to handle complex tasks. An agentic AI digital teammate, that works alongside a human agent to assist with proactive insights, advises about the best way to resolve the issue, and automates with intelligent actions.

Organizations deploying Agentic AI across their service desk consistently report significant reductions in ticket volume — often within the first year of deployment and compounding further as the system matures and learns. That's not automation in the traditional sense. That's intelligent orchestration at scale.

Proactive remediation before users feel the impact

The most expensive incidents in I&O are the ones that could have been prevented. Disk capacity that wasn't observed until it hit 100%. Certificate expirations that weren't tracked until services dropped. Software vulnerabilities that weren't patched until they were exploited. These failures were almost always predictable in retrospect — the signals were there. The problem was that no one was watching everything, all the time.

Autonomous Endpoint Management with agentic AI continuously monitors telemetry across endpoints, networks, applications and cloud infrastructure. The agents detect anomalies, correlate weak signals and begin remediation before an issue surfaces as an outage or a security incident. A disk trending toward capacity gets expanded. An expiring certificate gets renewed. A vulnerable endpoint gets patched during its next maintenance window, before exploitation becomes a risk.

This shift from reactive to proactive is the highest-value capability Agentic AI brings to I&O. It doesn't just reduce the cost of incidents — it prevents the incidents, the downtime, the business disruption and the reputational damage that accompany them. For I&O leaders, this shift redefines what operational success looks like. It moves the measure from mean time to resolution — a reactive metric — to mean time to prevention: how often your environment detects and corrects before business impacts occurs.

Scaling without scaling headcount

Enterprise IT environments are growing faster than IT budgets. The ratio of endpoints to engineers continues to widen. Cloud workloads multiply. Security requirements intensify. In this environment, the traditional lever of "hire more people" is neither financially sustainable nor operationally sufficient — the talent market simply can't supply the volume of skilled engineers required.

Agentic AI redefines the scaling equation. An autonomous agent doesn't have standard working hours, cognitive bandwidth limits or onboarding timelines. It can handle hundreds of concurrent tasks across thousands of endpoints without degradation in performance or quality. As the environment grows, the agent scales with it — not linearly, but exponentially. One well-configured autonomous agent can cover the workload previously distributed across multiple junior analysts, freeing senior engineers to focus on architecture, innovation and strategic initiatives rather than routine remediation.

This isn't about replacing people. It's about enabling them to operate at the level their skills deserve.

The system of record as the foundation for success

Deploying Agentic AI effectively requires more than a capable AI engine. It requires a trusted, comprehensive foundation of data — and that foundation is your system of record built into the Ivanti Neurons foundation, which contains an authoritative source of data including device intelligence, vulnerabilities and exposures, software inventory and service management information. A system of record that knows what assets exist, who owns them and are they compliant.

A system of record in the I&O context is the authoritative source of truth for your IT environment: every hardware and software asset, every configuration, every relationship, every policy, every change. It's the intelligence layer that enables an autonomous agent to make decisions with confidence. Without it, an agent operating in your environment is guessing. With it, it's reasoning from fact.

The most effective system of record for agentic AI in I&O brings together several critical elements. Configuration Management Database (CMDB) data must be accurate, current, and enriched — not the stale, manually updated repository that most organizations have inherited, but a dynamically maintained record of your actual environment. IT Asset Management (ITAM) to manage assets from creation to disposal and ensure accurate ownership is maintained.

Service management workflows must be fully integrated, so agents can create, update and resolve tickets as part of their execution flow. Identity and access data must be accessible, enabling agents to make policy-compliant decisions about provisioning and entitlement. And telemetry streams from monitoring, vulnerability and performance tools must flow into a unified context that agents can query in real time.

When these elements are in place, autonomous agents operate with precision. They know which assets are critical and which aren't. They know which changes require approval and which fall within defined automation boundaries. They know the history of an asset — previous failures, pending patches, installed software, active vulnerabilities — and they apply that context to every decision.

Organizations that attempt to deploy Agentic AI without investing in their system of record typically find that their agents produce inconsistent results or require constant human correction. The AI is only as intelligent as the data it has access to. Investing in data quality and integration isn't a prerequisite that can be deferred — it's the work that determines whether Agentic AI delivers transformative value or marginal improvement.

Business value: beyond efficiency metrics

The operational benefits of Agentic AI in I&O are compelling on their own terms. Faster resolution times. Lower ticket volumes. Reduced mean time to detect and remediate. These are metrics that resonate with I&O leaders and that justify the investment on a pure cost-efficiency basis.

But the business value extends well beyond the service desk dashboard.

When I&O teams are freed from reactive, repetitive work, they redirect their capacity toward the initiatives that drive competitive differentiation: accelerating application deployment, hardening security posture, enabling digital transformation programs and building the resilient, scalable infrastructure the business needs to grow. The I&O function evolves from a cost center absorbing operational noise into a strategic enabler shaping business outcomes.

Employee experience is an often-underappreciated dimension of this value. When employees receive instant, intelligent responses to their requests instead of days-long ticket queues, their productivity increases and their frustration with IT decreases. In a world where employee experience is a competitive differentiator for talent acquisition and retention, a frictionless, responsive IT function is a genuine business asset.

Agentic AI also delivers meaningful risk reduction. In an environment where a single ransomware incident can cost millions in downtime and remediation, and where regulatory penalties for security non-compliance are accelerating, proactive vulnerability management and automated policy enforcement provide quantifiable risk mitigation that resonates far beyond the IT organization at the board level and in the CFO's office.

Finally, agentic AI compounds in value over time. Every interaction, every resolution, every escalation decision generates data that improves the agent's future performance. Unlike static automation that degrades as environments change, agentic systems adapt and improve — delivering increasing returns on the initial investment.

The path forward

Infrastructure and operations are undergoing a pivotal transformation. The systems we oversee today are more intricate, widespread and vital to business success than ever before in the realm of enterprise IT. Demands on I&O are at an all-time high. However, the conventional operating model, which relies on reactive manual interventions and fragile rule-driven automation, has reached its maximum potential.

Agentic AI offers a fundamentally better model: one where intelligent, autonomous agents handle the high-volume, time-sensitive and increasingly complex work of infrastructure management — continuously, accurately and at scale — while your engineers focus on the strategic work that makes your organization more competitive and resilient.

Organizations investing in this capability today aren't simply improving their IT operations. They're building an I&O function capable of meeting the demands of the next decade of enterprise technology. We believe that's the standard every I&O leader should be building toward — and that Agentic AI is the most powerful tool available to get there.

Explore how Ivanti's Agentic AI capabilities are helping I&O teams transform their operations in Navigating the Shift to Agentic AI in IT Service Management.

June 2026 Patch Tuesday

Tue, 09 Jun 2026 21:27:02 Z

Source: Graph generated using Claude (Anthropic) on June 9, 2026, based on author-designed prompts and dataset by Chris Goettl.

You may have seen or heard a reference to the Patch Apocalypse, if not, you can dig into some more details here. The graph above shows a sample of several of the top vendor applications in all our environments. You can see a trailing twelve-month history of the number of CVEs resolved each month in these applications. Prior to February 2026, the scariest thing each month was the OS updates. Microsoft, Apple, Android, Linux flavors of every kind. This was the foundation that organizations built their monthly maintenance around and really focused on Patch Tuesday as the starting point of that monthly maintenance.

Looking at the three dotted lines on the graph you can see February was the first month when that blue line representing the Microsoft Windows OS started to see some competition. This was the first attribution of CVEs discovered by AI tools. In April, the second dotted line, we witnessed the announcement of Project Glasswing and a significant spike in CVEs discovered.

Fast forward to June Patch Tuesday and we see a massive green line next to a massive blue line. This is Google Chrome and Microsoft Edge (Chromium) which released a pair of updates already in June resolving over 500 CVEs in total including a zero-day exploit (CVE-2026-11645). Today, we are in the Patch Apocalypse. The Patch Apocalypse is now.

This is not intended to be a scare tactic. It is meant to outline the challenge that many organizations were anticipating, but the new generation of LLMs has accelerated significantly in the first half of 2026.

There are going to be more CVEs resolved by vendors at a faster and more continuous pace than we have ever seen previously. Unfortunately, this will also include more zero-day and n-day exploits than previously seen as well. The window from release from a vendor to exploitation had already shortened to 5 days as of 2023 threat intelligence data.

Many vendors have been acknowledging the need to utilize AI tools in their security research to identify and resolve security flaws in their products. Oracle recently announced their move to include the CSPU or monthly security update, which June will be the second instance of that new release cadence. Google Chrome had already moved to a weekly cadence back in 2023. Mozilla has typically released one to two security releases each month and is now tracking a nearly weekly cadence now as well.

Ivanti is tracking a 30-40% increase in patches released each month across the vendors supported in our Patch Catalog and we anticipate this to continue to accelerate for a while until we reach a new stable threshold, but the expectation is that this is not a spike. It is the new normal.

With that we return to the regularly scheduled June 2026 Patch Tuesday for a point in time update. Microsoft has resolved 198 CVEs, Google Chrome resolved 74 including the zero-day exploit (CVE-2026-11645), and Adobe resolved 123 CVEs across 11 updates.

I feel a bit desensitized at this point, but need to call it out that this is the largest CVE count resolved by Microsoft in a single Patch Tuesday. October 2025 was the previous high at 175 CVEs resolved. It seems inconsequential compared to CVE compared to the Chrome and Edge CVE count of 429 in the June 3, 2026 update from the prior week.

Expanding the conversation to the continuous release challenge: Based on Ivanti’s Patch Catalog, a quick tally of security related updates between May and June Patch Tuesday’s included 89 updates resolving 513 CVEs (Chrome and Edge are de-duplicated in this count). These updates should be included in your upcoming maintenance if you don’t have a continuous update approach in place today.

These releases include multiple releases for all major browsers (Chrome, Firefox, Edge, Opera, etc), PDF editors and viewers (Foxit, Adobe, Nitro), development tools (Node.js, VSCodium, Docker), common utilities and apps (Notepad++, PuTTY, PyCharm, Wireshark, Splunk UF), productivity and telecommunications apps (Teams, Zoom) and more.

Microsoft’s publicly disclosed vulnerabilities

Microsoft resolved a Security Feature Bypass Vulnerability in Windows Bitlocker (CVE-2026-50507). The vulnerability is rated Important by Microsoft and has a CVSS v3.1 score of 6.8, but has been publicly disclosed. The CVE lists exploit code maturity as Proof-of-Concept which puts this at a higher risk of exploitation. An attacker with physical access could use this vulnerability to bypass a security feature gaining access to encrypted data.

Microsoft resolved a Denial-of-Service Vulnerability in HTTP.sys (CVE-2026-49160). The vulnerability is rated Important by Microsoft and has a CVSS v3.1 score of 7.5, but has been publicly disclosed. The CVE lists exploit code maturity as unproven meaning to sample code was disclosed at the time this was released. An unauthorized attacker could take advantage of uncontrolled resource consumption in HTTP/2 to cause a denial of service over a network.

Microsoft resolved an Elevation of Privilege Vulnerability in Windows Collaborative Translation Framework (CVE-2026-45586). The vulnerability is rated Important by Microsoft and has a CVSS v3.1 score of 7.8, but has been publicly disclosed. The CVE lists exploit code maturity as unproven meaning to sample code was disclosed at the time this was released. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges on the target system.

Ivanti security advisories

Ivanti has released two security updates for June. The updates affect Ivanti Endpoint Manager Mobile and Ivanti Sentry and resolve a total of four CVEs. More details and information about mitigations can be found in the June Security Advisory.

Third-party vulnerabilities

Adobe released 11 updates resolving 123 CVEs. Adobe has prioritized the ColdFusion update as the highest priority.

Google Chrome resolved 74 CVEs in the latest Chrome update including a zero-day exploit (CVE-2026-11645). This comes on the heels of the largest Chrome release on June 3 that resolved 429 CVEs. Microsoft Edge also needs to be updated to resolve these CVEs.

June update to-do list

Google Chrome and Microsoft Edge are the top priority this month to resolve 500+ CVEs resolved in the past week and a zero-day exploit (CVE-2026-11645).
The Windows OS update is the next highest priority as it resolves over 110+ CVEs depending on edition.

June 2026 Security Update

Tue, 09 Jun 2026 14:06:32 Z

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) and Ivanti Sentry.

It is important for customers to know:

We have no evidence of these vulnerabilities being exploited in the wild.
These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

How AI will affect vulnerability disclosures in our products

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

June 2026 Ivanti Neurons for ITSM Security Update

Mon, 01 Jun 2026 14:00:44 Z

In today’s rapidly evolving technology and threat landscape, responsible transparency should be a cornerstone of any product security program. As part of our ongoing product security program, we continually assess, investigate, and address vulnerabilities. When an issue is found, we communicate relevant information as quickly and responsibly as possible.

To this end, we are issuing an important security update addressing vulnerabilities in Ivanti Neurons for ITSM (cloud and on-premises). Customers should review the Security Advisory for more information and version specific details.

Customers using the on-premises Ivanti Neurons for ITSM solution should review the Security advisory and apply fix as soon as possible.

At the time of this publication, we are not aware of any customers being exploited through the vulnerability disclosed today.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Customers and partners with questions about their environment or remediation steps can contact Ivanti Support. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

To Up-Level Your Security Maturity, Rethink Your Vulnerability Remediation Capabilities

Thu, 28 May 2026 14:00:05 Z

Security teams are drowning in vulnerabilities. We’re talking tens of thousands of findings per quarter. Hundreds of thousands at larger organizations. Today's IT environments have no boundaries and span across every OS platform. Managing and securing that estate in a linear fashion is no longer viable, and neither is a vulnerability remediation process that treats every fix as a simple, low-impact task.

Risk-based prioritization helps cut through that noise by introducing threat context and business context into the vulnerability remediation process. That was a meaningful step forward. But many organizations that have adopted risk-based prioritization are still missing SLAs, still generating friction with IT and still watching exceptions pile up faster than remediations.

Knowing what to fix first is only part of the equation.

The harder part, and the part many programs still lack, is understanding what the real-world impact of that fix will be. More importantly, how to accelerate remediation from once a month to a continuous process, while balancing risk vs. impact.

This is operationally balanced remediation: the practice of weighing the real-world impact of a fix before committing to it. It is the critical missing piece in many vulnerability remediation programs and one of the clearest markers of exposure management maturity. Ivanti's Exposure Management Maturity Model identifies it as one of six core capabilities that separate mature security programs from reactive ones.

What is operationally balanced remediation?

The maturity model defines it simply: the ability to fix or mitigate exposures in a way that's both effective and practical. Security urgency balanced against IT realities like system uptime, patch testing and business continuity.

In practice, it comes down to one equation: security risk plus real-world impact equals an informed remediation decision. Identifying exposures has no value if you can't remediate them. And remediation that creates unplanned downtime, breaks production systems or triggers rollbacks hasn't reduced risk. It's shifted it.

The vulnerability remediation maturity journey: from reactive to strategic

Phase 1: traditional vulnerability management (the scan-and-patch era)

This is where vulnerability remediation started for many organizations, and where many still sit. Prioritization is CVSS-driven and first-in-first-out. Your scanner tells you "You have 10,000 CVEs" with no context about which ones matter.

Exceptions go undocumented. Vulnerability scanning and remediation workflows live in separate tools with minimal integration.

The result is reactive mode: chasing the latest high-profile disclosure instead of addressing what poses the greatest risk to the environment.

Phase 2: risk-based vulnerability prioritization (adding context)

Risk-based prioritization introduced two better questions: "Is this vulnerability actively being exploited?" And "How critical is the asset it affects?" Combining severity with threat intelligence and asset criticality gave security teams a sharper focus for their vulnerability remediation efforts. AI-driven vulnerability intelligence and patch reliability scoring have accelerated this process further by reducing the manual analysis burden that once forced security teams to make prioritization calls with incomplete data.

But there’s still a missing piece. Risk-based prioritization tells security what to fix. It says nothing about what IT needs to keep running. Collaboration between the two teams still often happens case by case, and the impact of remediation on IT operations remains an afterthought or more often an anchor holding organizations back from accelerating remediation activities.

Phase 3: the missing piece — operationally balanced remediation

For organizations that have developed the maturity to understand the real-world risks of an exposure, the next question they ask is: "What will the impact of this fix be on the systems we need to keep running, and can we afford to leave it exposed?"

When vulnerability remediation is forced without considering downstream effects, the result is downtime, resistance from IT and a growing backlog of exceptions that undermine the very security goals driving the urgency.

Ivanti's 2026 State of Cybersecurity Report found that 48% of security professionals say IT teams don't respond urgently to cybersecurity concerns, while 40% believe IT lacks an understanding of their organization’s risk tolerance. That's what happens when security and IT operate with different priorities and no shared way to resolve them.

The most mature programs address this not just through process alignment, but through automation that removes the manual handoffs where friction accumulates. Automated self-healing capabilities can detect, diagnose, and remediate endpoint and cyberhygiene issues proactively. This reduces the volume of vulnerabilities requiring manual triage in the first place. When remediation is built into how endpoints operate rather than bolted on after the fact, the gap between security urgency and IT capacity shrinks on its own.

The maturity indicator here is clear: shared KPIs between security and IT, documented exception processes and a vulnerability remediation tracking system that accounts for both risk reduction and business continuity. Achieving this continuously requires IT and security to operate from shared data and shared workflows.

When asset visibility, exposure aggregation, risk-based prioritization, and remediation run on a unified platform, the alignment that Phase 3 demands becomes a structural property of the system rather than a hard-won cultural achievement.

How operationally balanced remediation differs from risk-based prioritization

The simplest way to see the progression is through the questions each approach can answer.

Approach	Questions It Answers	What It Misses
Traditional VM	How many vulnerabilities exist?	Context and prioritization
Risk-based prioritization	Which vulnerabilities pose the greatest risk?	Operational feasibility and impact
Operationally balanced remediation	Which vulnerabilities should we fix first, given both security risk and operational constraints? How can automation ensure those fixes execute efficiently and without disruption?	Most comprehensive approach

This approach adds a layer of context to vulnerability remediation management: patch testing requirements, system dependencies, maintenance windows, potential downtime and rollback capabilities. These determine whether a fix holds — or creates new problems that require rollback.

Why operationally balanced remediation is central to exposure management

The maturity model identifies six core capabilities: asset visibility, asset importance, real-world vulnerability assessment, business-driven vulnerability prioritization, operationally balanced remediation and data/workflow integration.

Of these, operationally balanced remediation is the execution layer that makes the rest actionable.

Without it, exposure management stays theoretical. You can build perfect asset inventories, score every vulnerability with precision and produce dashboards that look impressive.

But if the vulnerability remediation process remains separate, it creates friction between security and IT, known risks accumulate, patches are delayed and the metrics on those dashboards stop reflecting actual risk posture.

The maturity progression runs from ad hoc prioritization (Phase 1) through case-by-case collaboration (Phase 2) to shared KPI-driven remediation (Phase 3) and finally audited retrospectives with a continuous improvement loop (Phase 4). Not every organization needs to reach Phase 4 across every capability. But getting from ad-hoc to shared, KPI-driven remediation is where the real gains happen.

The business case: balancing security and operational goals

Hidden costs of remediation without operational context

When vulnerability remediation is driven purely by security urgency, costs pile up in ways that stay invisible until they become systemic.

Unplanned downtime is the most obvious cost: critical business systems taken offline without proper impact assessment. But the downstream effects are just as damaging.

IT teams build workarounds when security mandates are impractical to execute, creating shadow processes that increase risk instead of reducing it. Exception fatigue sets in when exceptions outnumber compliant cases, rendering SLAs meaningless. And trust between security and IT erodes when each side views the other as either reckless or obstructionist.

Ivanti's research confirms how widespread this friction is. Thirty-nine percent of cybersecurity professionals say they struggle to prioritize risk remediation and patch deployment, and 35% report difficulty maintaining patch compliance.

Meanwhile, only 60% use business impact analysis to inform risk prioritization, and just 51% use a cybersecurity exposure score or risk-based index.

Many still rely on process metrics like mean time to remediate or percentage of exposures remediated, which can look positive in isolation but reveal little about whether the vulnerability remediation process is actually improving risk posture.

The ROI of operationally balanced automated vulnerability remediation

When organizations make this shift, the results show up fast. Shared KPIs drive realistic remediation timelines, which in turn improve SLA compliance. Median time to remediate drops when deployment barriers are expected rather than discovered mid-rollout.

Fixes stick because they account for system dependencies and maintenance windows rather than creating new problems that require rollback. Ring deployment is a good example: patches roll out to progressively larger groups, validated at each stage before expanding. That's what makes balanced remediation practical.

Combined with automated workflows that handle the correlation, triage and deployment orchestration, these mechanisms turn balanced remediation from a concept into a continuously operating system. When the platform handles the operational complexity, security teams spend less time managing the remediation process and more time validating outcomes.

Organizations at Phase 3 or Phase 4 maturity in Ivanti’s model track vulnerability remediation with metrics that reflect both security and operational outcomes:

SLA broken out by known exploited vs traditional severities
Median time to remediate (MTTR) for exploited vulnerabilities
Percentage of exception requests reviewed jointly by security and IT
Reduction in repeat exceptions over time

The strategic value extends further. When vulnerability remediation management accounts for what IT needs to keep running, security stops being perceived as a blocker and starts functioning as a business enabler. That shift is what unlocks sustained investment and executive support for exposure management.

From prioritization to execution: close the gap

Risk-based vulnerability prioritization was a necessary evolution. But it solved only half the problem. Knowing what to fix first has limited value if the act of fixing it creates downtime, resistance or a growing pile of undocumented exceptions.

Operationally balanced remediation closes the gap by getting security and IT working from the same playbook. That shows up in shared KPIs, clearly defined exceptions, and maintenance windows that protect business continuity. It also means automating remediation workflows that can spot and avoid potential downtime before it becomes a problem.

With prioritization, insight generation, and orchestration, remediation can keep pace with the environment instead of falling behind it. And with a unified platform that connects endpoint and security data, teams aren’t fighting silos—they’re moving in sync.

For a deeper look at how to benchmark your organization’s current maturity and build a targeted plan for growth, see Ivanti's Exposure Management Maturity Model.

Transform IT with Agentic AI: the Dawn of Accelerated, Autonomous Service

Tue, 19 May 2026 14:49:37 Z

The IT service management (ITSM) industry stands at a real inflection point. For decades, service desks have operated on a fundamentally reactive model — employees face problems, submit tickets and wait for human analysts to diagnose, triage and resolve their issues. Automation improved throughput within that model, but it never challenged the model itself.

The inflection point: why ITSM will never be the same

Agentic AI changes the equation entirely. Rather than simply accelerating the speed at which humans process requests, agentic systems understand intent, pull contextual information, choose an action path, execute across enterprise tools and confirm outcomes without waiting for a human to press "approve" on each step. We're witnessing the transition from IT service management to IT service autonomy, and the implications for every CIO, CISO and IT leader are profound.

The numbers reinforce the urgency. Gartner predicts that by the end of 2026, roughly 40% of enterprise applications will embed task-specific AI agents, up from less than 5% in 2025. Gartner research also predicts that 70% of enterprises will deploy agentic AI agents to simultaneously operate their IT infrastructure by 2029 — compared to less than 5% today.

These aren't incremental shifts. They represent a wholesale reinvention of how technology organizations deliver, secure and optimize services.

From scripted bots to autonomous agents: the evolution of intelligence in ITSM

Understanding where the industry is heading requires understanding where it has been. The evolution of AI in ITSM follows a clear arc that moves from deterministic scripted logic toward truly autonomous reasoning.

Phase one: rule-based automation

The earliest wave of ITSM automation involved scripted workflows — if a ticket matched certain keywords, it was routed to a predefined queue; if an asset fell out of compliance, a remediation script fired automatically. These automations deliver measurable efficiency gains by eliminating costly manual processes and making operations more compliant and secure. However, they remained brittle. Every new situation required a new rule, and the system could never handle ambiguity or learn from its own outcomes.

Phase two: AI-assisted service management

The arrival of machine learning and generative AI introduced a more adaptive layer. AI began classifying tickets automatically, summarizing incidents for analysts and generating knowledge articles from historical resolution data. Approximately 40% of organizations have now embraced AI to facilitate more efficient ticket resolutions.

Chatbots and virtual assistants have brought consumer-grade conversational interfaces into the enterprise, enabling employees to interact with IT support through natural language rather than structured forms. These abilities represented a meaningful leap, but the AI still operated primarily as an assistant. The AI is augmenting human decision-making rather than replacing it.

Phase three: Agentic AI and autonomous workflows

This is where the industry stands today, at the threshold of a third and far more transformative phase. Agentic AI systems don't wait for instructions. They observe, reason, plan and act.

In ITSM terms, an agentic system can detect an anomaly on an endpoint, correlate it with known vulnerability patterns, start a healing sequence, update the Configuration Management Database (CMDB) and close the resulting ticket — all before the affected employee notices a problem. Gartner has formalized this trajectory, predicting that by 2028, at least 15% of day-to-day work decisions will be made autonomously through agentic AI, up from 0% in 2024, and that 33% of enterprise software applications will include agentic AI by that same year.

The critical distinction is agency. Earlier AI tools responded to prompts. Agentic systems pursue goals. They maintain memory across interactions, reason about the best path to an outcome and execute multi-step workflows across integrated enterprise systems. This is the architectural leap that transforms ITSM from a discipline centered on processing requests to one centered on delivering outcomes.

The anatomy of agentic ITSM: persona-based and task-based intelligence

As agentic AI matures, its application in ITSM is coalescing around two complementary architectures: persona-based agents and task-based agents. Together, they form what many industry observers are calling the "conversational front door" to IT — a unified, intelligent interface that replaces fragmented portals, forms and phone trees with natural, adaptive interactions.

Persona-based agents

Persona-based agents are designed around the needs of specific user roles. A self-service agent, for example, serves as the first point of contact for employees. Rather than forcing users to navigate a service catalog and complete structured forms, a conversational self-service agent uses adaptive intent understanding and guided data capture to translate a natural language request into a fully structured, actionable ticket. The result is dramatically reduced friction for employees and significantly improved data quality for service teams. The impact of this approach is substantial — organizations deploying AI-powered virtual support agents have reported 50% to 70% reductions in call volumes alongside employee adoption rates of 80% to 85%.

Service-desk agents

By contrast, a service desk agent augments the live analyst. It provides context-aware guidance during ticket handling, accelerates triage and classification and offers real-time coaching that elevates less experienced analysts to the proficiency of seasoned veterans.

AI-driven incident summarization saves analysts significant time by automatically distilling complex ticket histories into actionable briefs. The analyst remains in the loop, but the loop is tighter, faster and more informed.

Task-based agents

Task-based agents handle discrete operational functions, such as knowledge search, incident creation, service request fulfillment, summarization and Q&A. These agents operate within an agentic framework that includes goal definition, environmental modelling, memory, reasoning and action execution. The interoperability standards appearing around Agent-to-Agent (A2A) and Model Context Protocol (MCP) communication are particularly significant. They signal an industry moving toward multi-agent ecosystems where specialized agents collaborate to resolve complex, cross-domain issues — what some analysts are calling "agent squads."

Gartner's own roadmap confirms this trajectory. By 2027, one-third of agentic AI implementations are expected to combine agents with different skills to manage complex tasks within application and data environments. The implication for ITSM is clear: the future service desk isn't a single monolithic system but an orchestrated ensemble of specialized agents, each contributing domain-specific intelligence to a unified service experience.

Self-Healing, self-securing, self-serving: the 3 pillars of autonomous IT

The strategic promise of agentic AI in ITSM rests on three interconnected capabilities that, taken together, define what truly autonomous service delivery looks like in practice.

Self-healing

Self-healing represents the most visible departure from traditional reactive support. Through anomaly detection and automated diagnosis, modern platforms can identify endpoint and security issues before they affect users. Cloud-based bots powered by hyper-automation don't just alert IT staff to problems — they actively resolve previously unreported or ignored issues, proactively expediting detection, resolving incidents automatically and freeing IT to focus on innovation. The industry trajectory here's unmistakable. As organizations mature their self-healing capabilities, the volume of human-touched tickets will decline steadily, and the service desk's role will shift from resolution to governance and continuous improvement.

Self-securing

Self-securing addresses the reality that cybersecurity and IT operations can no longer operate in silos. AI-driven visibility across devices, organizational structures and digital experiences enhances security posture by proactively identifying potential vulnerabilities based on social trends and vulnerability scoring.

Maintaining a consistently reconciled software inventory helps identify exposures before they become breach opportunities. The convergence of ITSM and security operations is accelerating as agentic AI provides the connective tissue between threat detection, vulnerability management and remediation workflows.

Organizations that unify IT and security through an AI-driven platform are positioned to deliver what the industry increasingly describes as "invisible but inescapable security" — protection that operates continuously without creating friction for end users.

Self-service is being reimagined from the ground up. Traditional self-service portals suffered from low adoption because they imposed the system's logic on the user rather than adapting to the user's intent. Conversational AI inverts this dynamic.

Employees interact through natural language, and the system handles the complexity of routing, classification and fulfillment behind the scenes. AI-powered virtual assistants deliver exceptional experiences by increasing productivity and satisfaction, bringing the ease of consumer virtual assistants into the workplace while maximizing adoption and reducing call volumes. Looking ahead, self-service will evolve further as voice automation, mobile-first interfaces and proactive notifications create an omnichannel support experience that meets employees wherever they work — at a desk, on the factory floor or on the road.

The strategic implications: what this means for IT leadership

The rise of agentic AI in ITSM carries implications that extend well beyond the service desk. For CIOs and IT leaders, several strategic themes demand attention.

The shift from cost center to value center

When routine incidents resolve themselves and AI handles first-line triage, the service desk is no longer defined by ticket volume and average handle time. Instead, IT teams are liberated to focus on strategic initiatives — digital transformation, employee experience innovation and business process automation. The question for IT leaders is no longer, "How do we handle more tickets faster?" But, "How do we redeploy the capacity that autonomous service creates?"

The imperative of governance and trust

The same Gartner research that forecasts explosive growth in agentic AI also sounds a note of caution: Over 40% of agentic AI projects may be canceled by the end of 2027 if costs, value clarity or risk controls prove inadequate. Successful implementations will demand built-in compliance, visibility rules and policy adherence from day one. AI governance isn't a bolt-on problem — it's a foundational design requirement. Organizations that embed guardrails, approval workflows and auditability into their agentic architectures will realize sustainable value; those that treat governance as an afterthought will face costly reversals.

The convergence of IT and security operations

Data silos between IT and security teams have long weakened organizational resilience. Agentic AI platforms that unify service management, endpoint management and exposure management create a system of record — enabling coordinated, intelligent response across traditionally separate domains. This convergence isn't just a technology play; it requires organizational alignment, shared metrics and a cultural commitment to breaking down functional barriers.

The employee experience as competitive advantage

The ability to measure and quantify the digital employee experience — across devices, service management, security and applications — through AI-driven sentiment analysis transforms employee experience from an abstract aspiration into a data-driven discipline. Organizations that provide seamless, consumer-grade IT experiences will attract and retain talent more effectively than those that treat IT support as a back-office function. The Digital Employee Experience (DEX) score is emerging as a critical KPI, offering service desk analysts the visibility to deliver personalized, empathetic support at scale.

Enterprise service management beyond IT

Perhaps the most underappreciated implication of agentic AI is its potential to extend intelligent service delivery beyond IT into HR, facilities, finance and other business departments. When the underlying platform supports no-code, workflow design and pre-built integrations with external systems, patterns proven in IT service management become templates for enterprise-wide transformation. Business departments that still rely on ad hoc emails, dated spreadsheets or paper documents stand to benefit enormously from the same agentic capabilities reshaping IT.

The autonomous service imperative

The transformation of IT service management through agentic AI isn't a distant possibility — it's an active, accelerating reality. The organizations that thrive will be those that recognize this shift for what it is: not just a technology upgrade, but a fundamental reimagining of how services are designed, delivered and experienced across the enterprise.

The human role will shift, not disappear. Agentic AI won't eliminate IT professionals — it'll elevate them. Analysts will transition from ticket processors to AI supervisors, governance architects and experience designers. The most valuable IT professionals of the next decade will be those who can design, train and govern autonomous systems rather than operate them manually.

The path forward demands a clear-eyed strategy. Start with the automation foundation — intelligent workflows, AI-assisted classification and self-service interfaces that reduce friction and improve data quality. Build toward autonomous capabilities — self-healing endpoints, self-securing environments and conversational agents that resolve issues end–to-end. And invest in the governance, culture and talent development that'll sustain autonomous operations at enterprise scale.

The question for IT leaders is no longer whether agentic AI will reshape service management. The question is how quickly and how strategically your organization can operationalize it. The era of autonomous service has begun, and the competitive advantage belongs to those who move decisively — not to those who wait for certainty that'll never arrive.

May 2026 Patch Tuesday

Tue, 12 May 2026 21:52:21 Z

Continuing the Patch Apocalypse this month we are already seeing some more aggressive shifts in updates from many vendors.

Oracle announced a new release cadence starting in May 2026 to address the acceleration of vulnerability detection introduced by Mythos and other AI security models. Monthly Critical Security Patch Update (CSPUs) will fill in the two-month gap between their quarterly Critical Patch Update (CPU).

Mozilla had been working with AI models prior to Mythos which led to 22 security-sensitive bugs being resolved in Firefox 148. They announced continued collaboration with Anthropic to apply an early version of Mythos to Firefox and released Firefox 150 resolving 271 vulnerabilities identified during the evaluation. Since Firefox 150.0.0 released, they have been on a more aggressive weekly cadence for security updates including the release of Firefox 150.0.3 on May Patch Tuesday resolving between three to five CVEs in each release.

Apple is another early participant in Project Glasswing and has seen a recent spike in the number of exposures resolved. They typically average around 20 CVEs per iOS security update. For their most recent update on May 11, there is a spike of over 70 CVEs resolved. across the 11 Apple updates. While there are not actively exploited vulnerabilities, there are a lot of updates to manage.

Microsoft resolved 118 CVEs in the May 12, 2026 Patch Tuesday update. There are no exploited or publicly disclosed vulnerabilities this month, but the updates resolve 16 Critical CVEs, 105 Important, 5 Moderate, and 1 Low. Office is likely the higher risk this month with four Critical RCE vulnerabilities resolved in this update, but the OS, as usual, has a lot of CVEs being resolved.

Third-party vulnerabilities (Leading up to and including Patch Tuesday)

Adobe resolved 52 CVEs in their Patch Tuesday update that included 10 bulletins. Adobe Commerce is the clear priority — it's the only Priority Two update this month, with 10 Critical CVEs including two at CVSS 8.7, and several DoS vulnerabilities that require no admin privileges to exploit.

Apple released updates for their platforms on May 11 resolving between 25 and 52 CVEs across all platforms. The release did not include any exploited or publicly disclosed vulnerabilities, but is notably larger than average.

Google released Chrome 148 on May 5 resolving 127 CVEs including three Critical ratings. Google has been on a weekly cadence for Chrome updates for a while now, but the May 5 update is far larger than average for Chrome (possibly the largest CVE count resolved in a single update). Another Chrome release is expected on or shortly after Patch Tuesday.

Mozilla has been on a steady weekly release scheduled for Firefox since the release of Firefox 150. Mozilla made some headlines with the 271 CVEs resolved in Firefox 150.0.0 and has been averaging three to five CVEs resolved each week since. The release of Firefox 150.0.3 on Patch Tuesday is the latest release, which resolved five CVEs all with a High rating.

Ivanti security advisories

Ivanti has released four security updates for May Patch Tuesday. The updates affects Ivanti Secure Access Client, Ivanti Xtraction, Ivanti Virtual Traffic Manager, and Ivanti Endpoint Manager and resolves seven CVEs. More details and information about mitigations can be found in the May Security Advisory.

In addition, Ivanti released a Security Update for Ivanti Endpoint Manager Mobile (EPMM) on May 7 which resolved five CVEs including CVE-2025-6973. At the time of disclosure, Ivanti was aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation. More details and information about mitigations can be found in the May 2026 EPMM Security Update Advisory.

May update to-do list

Third-party update cadence is accelerating. Ensure you are prioritizing more frequent update schedules for priority applications such as browsers, productivity apps, and telecommunications apps.
Microsoft and Apple both released updates across pretty much every platform. No exploits, but there are a lot of vulnerabilities to remediate.

The Messy Truth About AI Data Management (And What to Do About It)

Tue, 12 May 2026 16:23:42 Z

Data will always be unclean. It's just a matter of degree.

I internalized that on day one of my master's program in data science, when a professor warned us that roughly 80% of our time would go to preprocessing and cleaning, not building models.

Years later, as Principal Product Manager for AI, ML and Analytics at Ivanti, I've found the guidance holds up remarkably well in practice.

As my team and I work to bring AI out of the lab and into production for IT and security teams, AI data management matters more than ever. Ivanti’s 2025 Technology at Work Report found that 42% of office workers use generative AI tools at work, up 16 points in a single year. Among IT professionals, adoption reached 74%.

The appetite is there. So is the hesitation. Many IT leaders know their data isn’t clean, their systems are fragmented, and their governance hasn’t caught up. The good news: you don't need perfect data to adopt AI.

You need a clear data management for AI strategy built around what you already have.

Why IT data is never perfect

In enterprise IT, data quality issues aren't anomalies. They're the baseline reality of AI and data management. Tickets get categorized inconsistently. Asset inventories are incomplete. Critical information lives in silos across systems. And unstructured text in support tickets and survey responses defies neat categorization.

Ivanti's research confirms how deep this goes. Our 2026 Autonomous Endpoint Management Advantage Report found that 89% of IT professionals say siloed data negatively impacts operations, with 39% saying silos cause inefficient resource use.

Our Tech at Work Report tells a similar story:

38% of IT professionals cite tech complexity as a significant barrier to effective operations, up four points year over year.
Nearly half (46%) say new software deployments actually drive-up ticket volume rather than cut through the noise.

Add that 48% of organizations still run end-of-life software, and the picture becomes clear: this is a data environment that's messy by design.

As David Pickering, Ivanti's Product Marketing Director, told me: when data is formatted differently across systems, entered inconsistently, siloed by department, shaped by years of acquisitions, you’ll find agentic AI workflows that span those systems quickly run into trouble. You can't tell an AI which data to trust if you don't know yourself. And without that foundation, even well-designed automations will fall apart at the seams.

In other words: "Garbage in, garbage out" still applies. But pristine data isn't coming anytime soon. Any serious approach to master data management and machine learning must account for the mess, not wait for it to resolve itself.

The decision framework — choosing your data management strategy

There are two primary paths for data management for AI in IT. Both are valid, both have trade-offs, and many organizations will use both for different use cases.

Path 1: Manual/programmatic cleaning

When my team introduced ticket classification for Ivanti’s ITSM system, we were training a model to categorize service requests. That demanded clean, well-labeled training data. So, we built a step into the workflow that gave administrators the opportunity to review and clean data before it fed the model. That human review made a measurable difference in accuracy.

This path works best when you're training or fine-tuning a custom model, ingesting data into a knowledge base or working with structured datasets where quality standards can be defined. The trade-off is time and resources. The outcome is high accuracy and full control.

It also works best when baseline data hygiene is already in place. Many organizations aren't there yet: just 35% track device age or location, and only 37% track patch status.

Path 2: Generative AI processing

Sometimes manual cleaning isn't feasible. I learned this working on Ivanti's survey analytics. Survey responses are some of the messiest data any IT team encounters: freeform text, inconsistent formatting, wildly varying detail. Cleaning that manually at scale isn't realistic.

Instead, we used large language models to identify themes, patterns and sentiment across incomplete and unstructured inputs. We could summarize entire surveys, flag satisfaction drivers, and surface actionable insights fast.

This path is ideal for high-volume unstructured data, situations where manual cleaning simply isn't possible, or any scenario where the cost of cleaning exceeds the value of the output. It does require access to capable large language models and validation that the use case is a fit.

Choosing between the two strategies

The decision comes down to data volume and variety, time constraints, accuracy requirements and how much control you need over where your data goes and how it's processed.

Fine-tuning a model where precision is critical? Invest in cleaning. Working with large volumes of unstructured input where speed matters? Lean into generative AI. The goal is deliberate choice, not inaction because the data isn't perfect.

Building AI-ready infrastructure for data management

Cloud services are essential here, and I don't say that lightly. When my team built a digital experience score to measure, quantify and improve digital employee experience, cloud was the critical enabler. It served as our integration hub, bringing together service tickets, device telemetry, application performance, and security signals.

That level of multi-source integration isn't feasible at scale without cloud infrastructure. Cloud also enabled us to run a hybrid AI model that processes both text and numeric telemetry simultaneously. Supporting thousands of devices and users at that complexity level isn't feasible on-premises.

Beyond compute, AI-ready infrastructure means tackling master data management for machine learning. Organizations need a single source of truth across systems. Data formats need to be standardized, particularly when growth through acquisition introduces legacy platforms with different conventions.

Data governance complicates the picture further. Regulations like GDPR and CCPA impose strict requirements on how personal data is processed and where it can be transmitted. For global organizations, that means AI pipelines need to account for regional jurisdictional differences, particularly when evaluating whether to use external AI services or keep processing in-house.

Our Autonomous Endpoint Management research found that just 32% of IT professionals use a unified endpoint management system. Without consolidated visibility, AI and automation can’t reach their potential. Effective AI data management starts with visibility: you can't automate what you can't see.

Best practices for IT teams implementing AI

When it comes to data management for AI, adopting tools without developing the processes to support them is one of the most common mistakes I see.

Establishing Knowledge Management Practices

Ivanti’s ITSM platform uses AI to generate knowledge articles from past tickets and incident resolutions. The productivity gain is real. But it doesn't eliminate the need for management discipline.

Articles still require review and approval cadences, version control and clear ownership.

Despite 86% of IT professionals agreeing that AI is important to efficient operations, fewer than half use it for high-value scenarios like predictive maintenance or automated incident response. The gap in AI and data management isn't technology. It's process maturity.

Validation and governance

Validation is just as important on the output side as data quality is on the input side. AI-generated results need to be checked, especially as organizations move toward agentic AI, where autonomous systems act on decisions in real time. The question isn't just whether the data coming back looks right. It's whether the system is taking the right actions.

Measuring AI performance matters too: how often it's being used, how accurate it is and where it's failing. Ivanti's 2026 State of Cybersecurity Report found that 92% of security professionals say automation effectively reduces mean time to respond. That effectiveness, though, depends on continuous monitoring and tuning.

Using AI as a catalyst for better data practices

AI doesn’t just consume good data practices. It drives them. By lowering barriers to content creation and analysis, AI frees teams to build the governance frameworks they’ve deferred. When generating a knowledge article takes minutes instead of hours, the team can invest that time in approval workflows and quality assurance.

This is especially valuable when junior technicians get real-time AI guidance, enabling them to contribute at a higher level while senior staff focus on strategy.

Our Autonomous Endpoint Management Advantage Report found that 62% of IT professionals feel overwhelmed by day-to-day operations, and one in four say a colleague has resigned due to burnout. AI that augments human expertise helps teams scale without that cost.

The path isn’t always clear, but the strategy can be

Perfect data is a myth. That shouldn’t stop you.

Manual cleaning for structured, high-precision use cases. Generative AI for unstructured, high-volume scenarios. Both require intentional investment in cloud infrastructure, governance and process development.

As AI models continue evolving, incorporating not just statistical pattern recognition but explicit rules and structured reasoning, the barrier to AI-ready data management will keep dropping. The organizations that move now, clear-eyed about their data’s imperfections and equipped with a strategy to manage them, will capture the most value.

May 2026 Security Update

Tue, 12 May 2026 14:11:21 Z

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Secure Access Client, Xtraction, Virtual Traffic Manager and Endpoint Manager (EPM).

It is important for customers to know:

We have no evidence of these vulnerabilities being exploited in the wild.
These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

How AI will affect vulnerability announcements in our products

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

May 2026 EPMM Security Update

Thu, 07 May 2026 14:23:06 Z

In today’s rapidly evolving technology and threat landscape, responsible transparency should be a cornerstone of any product security program. Especially with the advancements in AI, we believe it is important to respond quickly when a new risk is discovered.

Ivanti’s efforts integrating AI into our development and product security process have increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities. Our objective in proactively discovering issues is to increase the resilience of our products in today’s threat environment and reduce the likelihood of exploited-in-the-wild Zero Days. We have already successfully identified vulnerabilities traditional tools missed, including some that are being disclosed today.

Importantly, we are committed to using AI responsibly in product security, including keeping a human in the loop to verify automated or agentic work. Our top priority is the security of our customers, and we expect that this work will naturally increase the number of vulnerabilities found, fixed, and disclosed. While this will result in an uptick in disclosures, we see this as a good thing, and an important part of ensuring our products keep pace with modern security requirements as they change.

To this end, we are issuing an important security update addressing vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM).

More information can be found in the Security Advisory, which describes the nature of the vunlerabilities and detailed remediation instructions for customers.
At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation.
We are not aware of any customers being exploited by the other vulnerabilities disclosed today.

The issues only affect the on-prem EPMM product, and are not present in Ivanti Neurons for MDM, Ivanti’s cloud-based unified endpoint management solution, Ivanti EPM (a similarly named, but different product), Ivanti Sentry, or any other Ivanti products.

Advanced AI models have collapsed the time-to-exploit from days to hours after disclosure. Because of this, we strongly encourage our customers to apply the patch to their on-premises EPMM promptly to protect their environment.

How AI will affect vulnerability announcements in our products

Ivanti continues to explore, test, and implement leading technologies and processes in our product development. In recent months, our security team began a project to integrate multiple advanced LLM models into our product security processes.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ticket Taker to Team Leader: Managing an Agentic IT Workforce

Thu, 30 Apr 2026 13:00:02 Z

The promise of AI in IT service management has been circulating for years. Chatbots that deflect tickets. Virtual agents that answer FAQs. Automation that routes requests. These are useful, but probably not the dream-state you were originally sold.

What's different today is the arrival of agentic AI: systems that don't just respond to instructions but reason, act, and adapt across multi-step workflows with real consequences. The question for IT leaders is no longer whether to adopt agentic ITSM. It's how to govern it well enough to run at speed.

AI agents aren't coming to your service desk — they're already there. Ivanti Neurons for ITSM is at the center of this shift by embedding AI agents directly into incident management, service requests and knowledge management.

The agentic service desk deployed

An agentic ITSM workforce isn't a chatbot with extra steps. In Ivanti Neurons, AI agents are purpose-built for defined ITSM personas, triaging and classifying incidents the moment they arrive, executing approved change workflows end-to-end, querying and reconciling the CMDB without analyst intervention, and surfacing knowledge articles that actually resolve issues — not just surface them.

These agents operate across your existing tech stack. Agentic AI agents should work across your entire tech stack, not in isolation. Our vision is to have agents across ITSM, endpoint management, patch management and security to enable the autonomous enterprise.

Here's how forward-looking IT leaders are governing, scaling and getting real results with an agentic ITSM workforce.

Real outcomes, not pilot projects

Organizations that have moved beyond experimentation with Ivanti Neurons for ITSM are seeing compounding returns as AI agents mature in production. According to Ivanti's own AITSM research: 86% of IT professionals say AI-powered technology is key to making IT organizations more efficient and 85% believe AI and automation solutions like root-cause analysis and predictive maintenance can help decrease IT ticket volume.

These findings reinforce the scale of the opportunity. Critically, 58% of organizations are already using AI for password resets and 52% for employee onboarding — routine tasks that consume analyst hours and deliver little strategic value.

Analysts estimate the average cost to resolve an IT ticket ranges from $15 to $17 — and multiples higher for escalated requests. AI agents that handle the high-volume, low-complexity tier of that queue don't just reduce costs. They free your best people for the work that actually moves the business.

— Ivanti AI: The Future of ITSM Automation Report.

This transformation is happening across sectors where Ivanti Neurons for ITSM is deployed:

Healthcare: Device provisioning and EHR access requests resolved autonomously across multi-site environments, reducing delays that previously stretched service windows.
Financial Services: AI-scored change risk surfaces CAB-critical flags, cutting review time and keeping audit trails complete without manual effort.
Manufacturing: Endpoint health signals are automatically correlated with open incidents, reducing MTTR across converged OT and IT environments.

Governance isn’t just a guardrail — it's the engine

The highest-performing agentic ITSM organizations share one trait: they treat AI agent governance with the same rigor as change management. Agents that are well-governed don't just perform — they improve. Agents that lack governance will degrade quietly, drifting as ticket patterns evolve; knowledge articles go stale and organizational change outpaces model assumptions.

What does good ITSM agent governance look like in practice?

Defined autonomy boundaries. IT teams need to configure exactly which workflow steps are fully autonomous, which require human confirmation and which must always escalate.
Continuous improvement through feedback loops at every touchpoint. Agents learn from analyst corrections, end-user satisfaction scores and resolution outcomes. These signals surface in the aggregate, so your team isn’t only closing tickets — they're also improving their processes.
Audit trails for every agent action. Every decision by an AI agent should be logged with full context — what triggered it, what data it used, what action it took. Compliance is built in, not bolted on.
Escalation that actually works. Agents know their limits. When confidence drops below a configurable threshold, the AI technology needs to seamlessly route it to the right human with the full context attached, so the analyst isn't starting from scratch.
Trusted information. AI agents must use data you trust rather than relying on external, unknown sources or hallucinations. Maintaining control over your data sources is vital for guaranteeing reliable information.

The new required IT leadership skill set

The shift to an agentic ITSM workforce changes what it means to be an effective IT manager. The core competency is no longer ticket throughput or process compliance but the ability to orchestrate a hybrid team of humans and agents, evaluate agent performance with the same critical eye you'd apply to a direct report and continuously tune the system to the evolving demands of the business.

Ivanti's 2025 Technology at Work Report and 2025 DEX Report bring this challenge to the surface:

46% of IT professionals report a rise in ticket volume due to new software deployments.
34% of help desks identify repetitive, time-consuming tasks and long resolution times as their top pain points.

These are exactly the pressures agentic AI is built to absorb, but only if leaders build the management muscle to direct it.

IT leaders using Agentic AI with ITSM should consider building weekly rhythms around agent performance reviews the same way they might review analyst KPIs by asking questions such as:

Which agents are underperforming, and why?
Which workflows are ready to expand AI autonomy?
Which escalation patterns suggest a knowledge gap in the model?

Organizations leading the way with agentic AI must go beyond evaluating analysts and AI agents in isolation. True performance measurement means assessing them together as one integrated team of humans and AI working toward a shared goal.

Slow adoption is technical debt

There's a tendency in IT to treat AI adoption as something to get right before going big. The instinct is understandable since ITSM touches every part of the organization, and failure is visible. But the risk calculus has flipped. In 2026, the cost of moving slowly isn't avoided risk. It's accumulated distance from organizations that are compounding their agentic advantage every quarter.

Ivanti's research identifies the real barriers: 42% of IT professionals cite security and compliance concerns as the number one challenge to IT automation. Moreover, 44% of organizations have invested in AI but say their employees lack adequate skills or training to use these tools effectively. These are fixable problems, but only when leadership steps up to solve them.

The barrier to agentic ITSM is seldom technical, but organizational. Unclear ownership of AI outcomes, misaligned incentives and cultural resistance from analysts who fear replacement rather than augmentation stand in the way of full-scale AI adoption.

It's worth noting that 74% of IT professionals are already using generative AI tools in 2025, up from 66% the year before. The workforce is moving. The question is whether the organization is moving with it or creating friction that drives that adoption underground.

The principles that drive real transformation

Organizations striving to build genuinely agentic IT operations share a common operating philosophy:

Start with outcomes, not use cases. Identify a strategic metric — SLA compliance, MTTR, analyst-to-ticket ratio — and build backward to the agentic workflows that move it.
Treat AI agents as team members with onboarding plans. New agents are supervised, coached with feedback, and given expanding autonomy as performance warrants — not released into production and forgotten.
Measure agent performance like human performance. Resolution rate, escalation rate, end-user satisfaction and knowledge contribution are tracked per agent workflow, not just at the aggregate service desk level.
Invest in human capability alongside AI capability. The service desk gets better, and the people in it do too. The best analysts aren't displaced; they're retrained as AI coaches, workflow architects and exception managers.
Build governance before you need it. Configure autonomy thresholds, escalation logic, and audit policies in the first deployment, not after the first incident.
Treat AI agents and analysts as one team. Treat AI agents and human analysts as one team — planning, executing, and evaluating together. Guide this combined team through the team development framework of Forming, Storming, Norming, and Performing to build the trust and cohesion that drives real results.

The era of the passive service desk is ending. No more waiting for a ticket, working through a queue and measuring success by closure rate. The organizations defining the next decade of IT operations are building proactive service management operations that sense, reason and act: where AI agents handle the volume, and your best people handle the future.

Ivanti Neurons for ITSM is built for that service desk. The question is whether your organization is ready to lead it.

Ready to build your agentic IT workforce?

See how Ivanti Neurons for ITSM embeds AI agents into your existing service desk workflows — from day one. Learn more.