Cayosoft Launches AI-Assisted Forensics and Group Policy Management to Strengthen Ransomware Resilience
New capabilities accelerate identity investigations, support trusted recovery, and control policy changes that could
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
COLUMBUS, Ohio, Nov. 10, 2026 (GLOBE NEWSWIRE) — Cayosoft, the undisputed leader in Microsoft hybrid Active Directory (AD), Entra ID, and Microsoft 365 enterprise management, monitoring, and recovery, today announced AI-assisted forensics in Cayosoft Guardian, a SaaS deployment option for Guardian Instant Forest Recovery, and Cayosoft Group Policy Management. These new offerings accelerate ransomware investigations, support trusted recovery, and reduce the risk of malicious policy changes.
Cayosoft will showcase the new capabilities at Microsoft Ignite, Booth 5163, November 17-20, 2026, at the Moscone Center in San Francisco.
AI-Assisted Forensics Accelerates Investigations and Informs Trusted Recovery
With the new AI-assisted forensics capabilities, administrators can ask Guardian questions in plain language to determine which identities acted, what changed, and when. That evidence helps teams select a known-good recovery state that predates the compromise.
“Today’s AI-assisted attacks, including ransomware operations, move with machine speed, reasoning, and persistence,” said Bob Bobel, Founder and Chief Executive Officer, Cayosoft. “Resilience to future attacks depends on having a validated standby forest ready and the ability to identify the last known-good state to prevent restoring the compromise.”
Restoring a compromised state can reintroduce attacker access or unauthorized changes. Guardian reconstructs identity change timelines, including when an AI agent was created, who created it, and how its permissions changed. Administrators control query execution, evidence interpretation, and containment and recovery decisions.
Instant Forest Recovery Introduces New SaaS Deployment Option
According to Gartner®, “Because malicious changes often predate incident detection by weeks or months, recovery efforts should combine backup data with change visibility, threat investigation and recovery validation processes. Success depends not only on having backups but also on trusting the recovered identity state.”
Guardian Instant Forest Recovery can maintain multiple standby Active Directory forests powered down in isolation. Teams can use forensic timelines to select and activate a validated standby forest, reducing the risk of restoring a compromise. The new SaaS option reduces the infrastructure teams need to deploy and maintain for forest recovery, freeing them to focus on validating recovery states and testing readiness.
Group Policy Management Replaces Unsupported AGPM With Stronger Controls
Group Policy Management helps control a ransomware distribution path. Attackers with privileged access can misuse Group Policy to deliver malicious payloads or disable defenses across devices and servers. However, Microsoft ended support for Advanced Group Policy Management (AGPM) in April 2026, leaving organizations still using it dependent on unsupported change controls.
Cayosoft Group Policy Management provides an alternative for organizations that relied on AGPM to govern policy changes. Teams can prepare policies in an offline repository, review proposed settings, and approve changes before deployment to live Active Directory. Separate editing, approval, and deployment permissions limit privilege exposure. Archived versions and approval records support audit review and rollback.
The new offerings provide:
- AI-assisted investigation that helps administrators trace identity changes and identify the likely compromise window using plain-language questions.
- SaaS deployment option for Guardian Instant Forest Recovery standby forest recovery that helps teams activate a validated, known-good Active Directory environment.
- Governed Group Policy changes with approval workflows, version history, policy analysis, and rollback across trusted and untrusted domains and forests.
AI-assisted forensics will be available Q1 2027 and is included in Guardian for current customers. The Guardian Instant Forest Recovery SaaS option will be available Q1 2027 under a separate license. Cayosoft Group Policy Management will be available now. For more information, visit cayosoft.com.
Click here to book a personalized Microsoft Ignite demonstration with Cayosoft.
Gartner, IAM Backup and Recovery Playbook, Sankalp Rastogi, Michael Hoeck, 17 September 2026.
Gartner is a trademark of Gartner, Inc. and/or its affiliates.
About Cayosoft
Cayosoft delivers the control, visibility, and resilience organizations need to manage, monitor, and recover hybrid Microsoft identities and AI agents. Organizations worldwide rely on Cayosoft to automate administration, monitor critical changes and non-human identities, and recover confidently from mistakes, attacks, and disruptions across Active Directory, Microsoft Entra ID, Microsoft 365 and Intune.
Cayosoft is a leader in identity resilience, with continuous product innovation, analyst validation and award-winning solutions. Its portfolio includes Instant Forest Recovery, the industry’s first and only patented technology of its kind. Cayosoft was named a 2026 Inc. Best Workplaces winner for employee engagement and workplace culture and maintains a 100% CSAT rating for customer support.
Follow us: LinkedIn, X, and Facebook
Learn more: Visit Cayosoft.com
Media Contact:
Michelle Schafer
Merritt Group for Cayosoft
cayosoft@merrittgrp.com
Media gallery
