October 2026
Identity Posture Management (Beta)
Release date: October 29, 2026
As part of Identity Posture Management, the new Identities Browser brings every identity in your organization into one view, so you can see which accounts carry the most risk and why. Each identity combines the account attributes synced from your IdP with every exposure matched to that account, from leaked passwords and stealer logs to exposed PII.
- Unified Identity View: Every identity appears in a single list with its severity, most recent Event, Posture Tags, and last-seen date, so you can prioritize which identities to review first.
- Identity Profile: Open any identity to see its synced attributes, session and credential state, exposure history grouped by category, and a timeline of how its severity has changed over time.
- Security Posture Checks: Assess what an attacker could reach if an account were compromised, including the applications, roles, groups, and devices tied to it. Each failing check explains the risk, recommends remediation, and maps the finding to MITRE ATT&CK techniques and, where applicable, compliance controls.
This is a beta release, and its capabilities and interface may change. To request access, contact your CSM.
Learn moreLearn more
Matching Policy for Lookalike Domains
Release date: October 21, 2026
A new Matching Policy for Lookalike Domains is now available, giving you control over which lookalike domains appear in a domain Identifier’s feed. Each lookalike domain is detected through a permutation strategy, such as a removed character or a homoglyph substitution. When the Lookalike Domain Strategies policy is assigned, only domains detected through at least one selected strategy appear in the feed. All strategies are selected by default.
Use this policy to:
- Reduce noise: Filter out strategies that are not relevant to your organization and generate high volumes of low-value matches.
- Prioritize high-risk techniques: Concentrate on the strategies most likely to produce convincing impersonations of your domain.
API Key Management
Release date: October 5, 2026
API keys now have expanded management and visibility controls. These apply to all existing and new keys, with no impact on the usability of current keys.
- Disable keys: Disable an existing API key without deleting it.
- Usage visibility: See when a key was created and last used, updated hourly, with the exact time shown on hover.
- Expiration dates: Set an optional expiration date when creating a key or editing an existing one.
- Scoped permissions: Scope permissions with role-based access controls at creation.
Learn moreLearn more
